Ostium affiliate program review: 50 bps builder fees, paid on-chain, and the July exploit

Ostium lets any application that routes a trade charge the trader up to 50 basis points of the opening notional, and it pays that charge to the builder’s address in USDC inside the same Arbitrum transaction that opens the position. That is what the builder set-up page and the published contract code say, read on 2 October 2026, and for once we did not have to take a payout promise on trust: the live callbacks contract recorded 3,023 builder-fee transfers between 15 July and 10:00 UTC on 2 October, 12,536 USDC in all, to 14 addresses. The same ledger shows the thing a builder has to price in. On 15 July an exploit emptied the liquidity pool, builder-routed trades stopped at 14:44 UTC and did not resume for eight days, and the combined income of every builder on the venue in the last week of September ran at about a sixth of its June rate. Ordinary referral links earn points, not money. Our score is 6.5/10.

Who runs the program

The terms of use name two parties: Ostium Foundation, which provides “certain of these Services”, and Ostium Labs Co., “a developer of software, and a service provider to such software”. The OLP recovery terms add that the Foundation is “a Cayman Islands exempted foundation company”. For Labs, the Global LEI index records a Delaware corporation, file number 6736850, formed on 14 April 2022, status active, at a registered-agent address in Wilmington. Neither entity claims a licence; clause 9(b) of the terms says in capitals that Ostium “is not an exchange, trust company, licensed broker, dealer, broker-dealer, investment advisor, investment manager, or adviser”, and we found no derivatives authorisation for either company.

The builder program is the self-serve side of a company that is now selling something else at the front door. On 2 October the homepage is titled “Gateway by Ostium”, pitches “one API for perpetuals on equities, indices, commodities, FX, and crypto” to perpetual exchanges, neobanks, market makers and “fintech builders”, and ends every section with “Get in touch”. Nothing on that page prices anything; the builder route is the one with public numbers, so it is the one we score.

Its history is short. The Python SDK changelog adds “builder fee support” in version 3.0.0 of 15 October 2025. The blog post that announced the feature on 6 November 2025, “Introducing: Ostium Builder Codes”, is no longer on Ostium’s site; the Internet Archive copy of 15 April 2026 preserves its three promises: “anyone can become a builder and charge fees. No additional verification required”, “there’s no closing fee on Ostium”, and “payments are handled atomically as soon as the order is filled”. The current TypeScript builder SDK changelog starts at version 0.4.0 on 11 June 2026 and reached 0.9.0 on 23 September; its 0.6.0 entry of 23 July moved the default API endpoints, the day builder-routed trades resumed after the exploit.

Commission structure

A builder is paid by the trader, not by Ostium. The set-up page puts the recipient address and a fee in basis points into the client configuration, “the allowed range is 0 to 50 bps”, and “builder fees apply on open, not on close”. The trade preview reference shows what the trader’s order ticket contains: a protocol opening fee, a flat oracle fee, the builder fee “charged on notional”, and a total “deducted from collateral at open”. Our arithmetic on the published range:

Builder rate	Share of opening notional	Per 1,000 USDC opened	Per 1 million USDC opened
1 bp	0.01%	0.10 USDC	100 USDC
10 bps	0.10%	1 USDC	1,000 USDC
20 bps	0.20%	2 USDC	2,000 USDC
50 bps (ceiling)	0.50%	5 USDC	5,000 USDC

The rates are examples, not tiers; the builder picks any whole number of basis points. What the trader feels is the leverage. A trader who posts 1,000 USDC at 10 times opens 10,000 USDC of notional, so a builder at the ceiling takes 50 USDC, 5% of the collateral, before Ostium’s own charges; at 10 bps the same trade costs the trader 10 USDC. Ostium’s fee page puts its own opening fee at “3 to 10 bps (varies by asset)” plus 0.10 USDC for the oracle, so a builder at 50 bps is charging five to seventeen times what the venue charges, on a ticket the venue lets the trader preview line by line. That is the commercial constraint. A wallet or a trading terminal with its own customers can add a few basis points to an execution its users already pay for; a publisher cannot buy traffic against the ceiling and expect strangers to keep paying it.

The chain shows what builders actually collect. Of the 3,023 transfers since 15 July, the median was 1.06 USDC, the mean 4.15 USDC, 285 were 10 USDC or more and 28 were 50 USDC or more; the largest single transfer was 210.54 USDC. There is no CPA, hybrid or sub-builder rate anywhere in the documents, and no rate card for ordinary links.

Ordinary links earn points. The referrals page in the app shows a five-tier table of boosts for referred traders and tells the referrer to “share your referral code to earn a boost on your base score”. Its “Go to Docs” link leads to a referral page in the older documentation (marked deprecated, last updated about four months before our read) with the full ladder: a referrer earns 10% of the weekly trading scores of the traders they bring in at tier 1, 12% once referred volume passes $1 million all-time, 15% at $10 million, 19% at $25 million (with a custom referral code) and 25% at $100 million, which also earns an “Ostium Merch Package”; referred traders get a 2% to 12% boost on their own scores, keyed to the referrer’s tier. The points page converts weekly scores into points each Sunday; on 2 October it showed Season 2, week 39 and 25.0 million points in total. Ostium’s own launch release of 2 April 2025 says points “have no monetary value, cannot be transferred, sold, or exchanged for any consideration, and do not represent any ownership interest, investment opportunity, or any right to any future rewards”. We assign them none.

Attribution and cookies

There is no cookie, because there is no account relationship to attribute. The order reference says “builder.address and builder.feeBps can be overridden per trade; omitted fields fall back to the client builder config”, and omitting the builder configuration altogether opens the trade with no surcharge. The fee belongs to whichever address is on the order that fills. If your customer opens the next position in Ostium’s own app or through a competitor’s interface, your introduction earns nothing; if a competitor’s interface puts its own address on the order, the fee is theirs. The word “lifetime” does not appear in any builder document, and it should not: the design has no memory of who found the trader.

Reporting needs one filter. getBuilderOrders returns the opening orders tagged with your address and then adds the related close, take-profit and stop-loss orders for the same positions, so a raw count overstates billable events. The contract’s own BuilderFeeCharged event, which fires once per fee-bearing opening, is the honest ledger; it is what we counted. The SDK also reports every submitted transaction hash to Ostium’s builder API “for SDK usage attribution”, per the changelog; that is Ostium measuring its integrators, not a commission mechanism.

No builder identity check exists. The older builder guide, still online behind a deprecation notice, says “any address can act as a builder without prior approval or registration”, the launch post said “no additional verification required”, and the current set-up page asks for nothing. The territorial restrictions below apply all the same, and the app enforces them at the door: opened from a connection in the United States on 2 October, it displayed “You cannot access our products from a restricted jurisdiction” above the trading screen; from Romania it did not. Self-referral is pointless by construction, since a builder routing its own trades pays its own fee out of its own collateral.

Payouts

The payout clause is a function. In the callbacks library, trade registration computes the fee as the builder’s rate times the opening notional, calls the storage contract to transfer that amount of USDC to the builder’s address, subtracts it from the trader’s collateral, and the callbacks contract emits BuilderFeeCharged with the trade identifier, the trader, the builder and the amount. The trading contract refuses any order whose builder fee exceeds 500,000 in its millionths-of-a-percent precision, which is 0.5%. There is no accrued balance, no claim transaction, no withdrawal request, no minimum, no payout fee and no holdback, because there is no intermediary step at which any of those could exist. Payment is USDC on Arbitrum, the asset the funding guide requires for trading; moving it afterwards is an ordinary wallet transfer. Gas is the one cost that can land on the builder: in the delegated client modes the set-up page describes, the builder’s own key “pays gas”.

We checked the ledger rather than the prose. The callbacks contract at 0x7720fC8c8680bF4a1Af99d44c6c265a74e9742a9 (listed on Ostium’s audits page) emitted the following BuilderFeeCharged events, read through a public Arbitrum node on 2 October 2026. Period boundaries are block timestamps; the September and last-week rows are approximate to within a few hours.

Period	Builder-fee transfers	USDC paid to builders	Addresses paid
15 June to 15 July (30 days before the exploit)	3,127	11,702.60	14
15 July to 2 October, 10:00 UTC	3,023	12,536.15	14
of which September	1,385	5,899.72	8
of which 24 September to 2 October	238	438.75	2

Two addresses took 98% of the money since July, and they were the only two active in the final week. Per day, the whole builder ecosystem on Ostium collected about 389 USDC in the month before the exploit, about 197 USDC in September and about 58 USDC in the last week we measured. Those are facts about demand, not about the mechanism: every one of the 3,023 transfers settled, the last of them at 09:12 UTC on 2 October. We matched the public source to the live contract’s behaviour, not to its bytecode, and we placed no trade of our own.

Negative carryover and player-loss accounting do not exist here; the base is opening notional, not a customer’s result. Nothing in the documents claws back a fee once transferred: the money is in your wallet before the position exists.

The terms that bite

The terms of use carry no date at the top, although clause 4 says modified terms “will provide the last updated date at the top”. We read them on 2 October 2026. What they contain:

• Restricted jurisdictions, clause 5(a). No one “residing in, a citizen of, organized in or located in” the United States, the United Kingdom, the European Union, the Philippines, or any territory under comprehensive United States sanctions (“including but not limited to Iran, Syria, Cuba, North Korea, and the Crimea, Dontesk and Luhansk regions of Ukraine”) may access, use or trade with the Services. A separate representation bans VPNs “to circumvent, or attempt to circumvent, any restrictions”. The introduction adds: “There are no exceptions.” The Services include the API and “code repository”, so the clause covers the builder as well as the trader.
• Termination, clause 5(b). “We also reserve the right to terminate your access to the Services at any time, for any or for no reason, with or without notice to you.”
• Changes, clause 4. Modified terms “will become effective upon posting”; services may be “modified, suspended or discontinued” without notice. Nothing freezes the 50 bps ceiling, the fee formula or the builder parameter itself.
• Brand use, clause 6(c). Ostium’s marks may not be used “without our prior written permission”. There is no paid-search, brand-bidding or incentivised-traffic policy anywhere, because there is no affiliate agreement; the terms of use are the whole contract.
• Recourse, clauses 9(d) and 10. Aggregate liability “will not exceed $100”, and the same clause excludes compensation for “any unanticipated or unscheduled downtime of all or a portion of the Services for any reason” and for “investments, expenditures, or commitments by you in connection with the Terms”. Governing law is the Cayman Islands with its courts as “exclusive jurisdiction” (10(a)), and every claim goes to JAMS arbitration “in Delaware before a single arbitrator” with class actions waived (10(c) and (d)).

Read together, the builder gets exactly what has already been transferred and no promise about tomorrow: no notice period, no compensation for an outage, no protection for integration costs. An eight-day outage, as it happens, is already on the record.

The July exploit

Clause 1.1 of the OLP recovery plan terms: “On or about 15 July 2026, certain smart contracts deployed as part of the protocol were exploited by an unauthorized third party (the Incident), resulting in a loss of assets held by Ostium Liquidity Pool (OLP) depositors. Following the Incident, trading was paused and the affected smart contracts were frozen at Arbitrum block 484,137,016.” That block was mined at 14:18 UTC on 15 July. The callbacks contract recorded seven more builder-fee transfers, the last at 14:44 UTC, and then none until 14:13 UTC on 23 July. Ostium’s documents give no loss figure. A Bitcointalk post of 16 July at 01:37 forum time quotes the security firm Blockaid: “an attacker used a registered PriceUpKeep forwarder and future-dated authorized oracle reports to create artificial trade profits, triggering an ~$18 million USDC payout from the vault”. We quote it as relayed; we could not read Blockaid’s original statement.

The recovery plan is for liquidity providers, not builders. Depositors owed 1,000 USDC or less are paid in full in USDC; larger claims are paid pro rata from whatever is recovered, in amounts and at times “not guaranteed and within Ostium’s discretion”, or the holder may elect to take 1,000 USDC and forfeit the rest; collecting anything releases Ostium from all claims about the incident and the pause. The audits page says three Pashov reviews, in January 2025, April 2025 and January 2026, “confirmed no critical vulnerabilities”; the attack as Blockaid describes it went through the price-update path.

For a builder the lesson is narrow and important. Atomic settlement means no commission balance was ever at risk, and the ledger confirms that nothing owed to builders went unpaid. It also means income is exactly zero for as long as trading is paused, with a contract that excludes compensation for downtime, and it means the venue your product depends on lost its liquidity pool eleven weeks before you read this.

What affiliates report

Trustpilot has no page for ostium.com, ostium.io or app.ostium.com; each address returned “the page you’re looking for could not be found” on 2 October 2026. We found no dated report of an unpaid Ostium builder fee on Reddit, Bitcointalk, GPWA or AffiliateFix, and no report of a paid one either, which is what you would expect of a fee that never passes through a dashboard. The forum discussion that exists is about the exploit, in Bitcointalk’s DeFi hacks thread, and it is written by observers, not integrators.

The on-chain record is the only testimony, and it says three things: builders are paid every time, in the same transaction; fourteen addresses have been paid since July, two of them in the last week we measured; and the money is small, 12,536 USDC across all of them in eleven weeks. Whether a new integration becomes the third active builder or the fifteenth dormant one depends on the users it brings, not on Ostium.

Ostium against the alternatives

The right comparison is the other builder-fee programs, because a surcharge on notional and a share of the venue’s own fee are different products. We reread the Hyperliquid and Lighter pages on 2 October 2026. The per-1,000 column is our arithmetic at each ceiling, on eligible perpetual volume.

Program	Perpetual ceiling	Gross per 1,000 USDC at ceiling	Billable activity	Trader consent and payment
Ostium builders	50 bps	5 USDC	Opening trades only, on notional	No user signature; fee appears on the preview if the interface shows it; USDC transferred to the builder as the trade registers
Hyperliquid builder codes	10 bps (1% on spot)	1 USDC	Both sides of perpetual trades; spot sells only	User signs an approval of a maximum fee, revocable; builder must hold at least 100 USDC; fees claimed “through the usual referral reward claim process”
Lighter Partner Attribution	10 bps (1% on spot)	1 USDC	Routed trades; paying users must be on Plus or Premium accounts	User signs an approval with optional expiry, revocable; credited in USDC to the partner’s Lighter account per trade, per the integration guide

Ostium’s ceiling is five times the other two, but it bills one leg. On a 1,000 USDC position opened and closed at the same size, the ceilings yield 5 USDC on Ostium against 2 USDC on Hyperliquid or Lighter, and at a chosen 1 bp the order reverses, 0.10 against 0.20 USDC. The larger difference is consent. Hyperliquid and Lighter make the trader sign a cap on what the builder may charge; Ostium puts the fee on the order the builder’s software submits and relies on the builder to show it. That is convenient for the builder and worth a line in your own terms, because a trader who finds a 50 bps charge on a receipt will not read it as Ostium’s fee.

Our Lighter review covers its separate referral scheme, which pays cash kickbacks every Monday. Aster and GRVT are the exchange-administered alternative: a share of the venue’s fee, computed off-chain and credited by the operator. The centralised exchanges are in our exchange affiliate comparison.

Verdict

6.5/10. The mechanism is the best we have reviewed in this vertical: a published ceiling, a rate the builder sets, a documented contract, and a payment that happens inside the trade and that we could count, 3,023 times, on the live chain. That meets every item our DEX rubric asks of a program scoring 8 or above, and if the mechanism were the whole story the score would be there.

The rest of the story takes two points off. The venue lost its liquidity pool to an oracle exploit on 15 July and paid no builder for eight days; the builders’ collective income has since fallen to a fraction of its pre-exploit rate and is concentrated in two addresses; the terms bar the United States, the United Kingdom, the European Union and the Philippines, which removes most of the audiences a publisher would otherwise sell to; access ends for no reason without notice; liability is $100; and attribution lasts exactly one order. The referral scheme, the only route for a non-developer, pays in points that Ostium itself says are worth nothing.

It suits a wallet, terminal or bot with existing users outside the restricted list, who can add a few basis points to an execution those users already value and who can live with a venue that has been down once. It does not suit a content site expecting commission from links. Budget the integration as a product feature with support costs, pick a rate your users would accept if they saw it, show it to them, and keep a second venue wired in. Pacifica runs builder codes the Hyperliquid way, with a user-signed fee cap and a revocation call, next to a selective affiliate tier of up to 40% of the venue’s own fee; our Pacifica affiliate program review covers both.

FAQ

What is the Ostium affiliate commission?

For builders, 0 to 50 basis points of the opening notional of each trade routed through their integration, set by the builder and paid by the trader on top of Ostium’s own 3 to 10 bps opening fee. Closes carry no builder fee. For ordinary referral links there is no cash commission: referrers earn 10% to 25% of referred traders’ weekly points scores, which have no monetary value.

When does Ostium pay builders?

In the same transaction that opens the trade. The contract transfers the fee in USDC to the builder’s address and then deducts it from the trader’s collateral; there is no claim, minimum, schedule or holdback. We counted 3,023 such transfers on the live Arbitrum contract between 15 July and 2 October 2026.

Is the Ostium affiliate program legit?

The builder fee is real and verifiable: the code is public, the contract is listed on Ostium’s audits page, and its events show builders being paid daily. The company behind it is identifiable (Ostium Foundation in the Cayman Islands, Ostium Labs Co. in Delaware) and unlicensed by its own account. The venue suffered an exploit of its liquidity pool on 15 July 2026 and paused trading for eight days. We score it 6.5/10.

What is the difference between Ostium referrals and builder codes?

Referral codes are shared by traders and earn points: a bonus of 10% to 25% of referred traders’ scores for the referrer and a 2% to 12% boost for the referred trader, by tier. Builder codes are a parameter on an order submitted by software, and earn USDC. A referral link does not make you a builder, and a builder address does not earn points.

Does Ostium offer lifetime attribution?

No. The builder address and rate are attached to each opening order and can be changed or omitted on every trade. A trader you introduced who later opens positions in Ostium’s own app, or through another builder’s interface, earns you nothing on those trades.

Can builders in the United States, the United Kingdom or the European Union use Ostium?

Not under the terms of use. Clause 5(a) bars anyone residing in, a citizen of, organised in or located in the United States, the United Kingdom, the European Union or the Philippines, as well as sanctioned territories, from accessing or using any of the Services, which include the API and code repositories. The app displays a restricted-jurisdiction notice to visitors from the United States.

adbench.io earns nothing from the programs discussed here. We do not use referral links.