MCDEX
Quantstamp reviewed MCDEX Arbitrum Integration (MCDEX) on 11 Apr 2021: 19 findings, 0 critical; 11 marked fixed, 6 acknowledged, 2 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings19
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 2 |
| Low | 2 | 5 | 8 |
LowGas Usage / `for` Loop ConcernsOpen
Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely. For example, if a `for` loop requires too much gas to exit, then it may prevent the contract from functioning correctly entirely. It is best to break such loops into individual functions as possible. There are several functions which use a `for` loop in the listed contracts.
LowInteger Overflow / UnderflowOpen
Integer overflow/underflow occur when an integer hits its bit-size limit. Every integer has a set range; when that range is passed, the value loops back around. A clock is a good analogy: at 11:59, the minute hand goes to 0, not 60, because 59 is the largest possible minute. Integer overflow and underflow may cause many unexpected kinds of behavior and was the core reason for the `batchOverflow` attack. Here's an example with `uint8` variables, meaning unsigned integers with a range of `0..255`. ``` function under_over_flow() public { uint8 num_players = 0; num_players = num_players - 1; // 0 - 1 now equals 255! if (num_players == 255) { emit LogUnderflow(); // underflow occurred } uint8 jackpot = 255; jackpot = jackpot + 1; // 255 + 1 now equals 0! if (jackpot == 0) { emit LogOverflow(); // overflow occurred } } ``` In this project, some contracts do not use SafeMath everywhere to protect against this issue. 1. `Broker.sol`: `SafeMath` not used on `L321`, `L179`. 0. `EnumerableMapExt.sol`: `SafeMath` not used in several places. 0. `SymbolService.sol`: `SafeMath` not used on `L133`.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (74)
- contracts/Perpetual.sol
- contracts/libraries/EnumerableMapExt.sol
- contracts/module/OrderModule.sol
- contracts/module/LiquidityPoolModule.sol
- contracts/governance/RewardDistribution.sol
- contracts/test/TestMarginAccount.sol
- contracts/libraries/Utils.sol
- contracts/module/TradeModule.sol
- contracts/factory/PoolCreator.sol
- contracts/module/MarginAccountModule.sol
- contracts/test/TestTracer.sol
- contracts/test/BlackHole.sol
- contracts/libraries/BitwiseMath.sol
- contracts/governance/GovernorAlpha.sol
- contracts/test/TestAccessControl.sol
- contracts/factory/VersionControl.sol
- contracts/interface/IWETH.sol
- contracts/oracle/mock/OracleWrapper.sol
- contracts/symbolService/SymbolService.sol
- contracts/test/TestGovernanceToken.sol
- contracts/LiquidityPool.sol
- contracts/test/TestOrder.sol
- contracts/interface/ILiquidityPool.sol
- contracts/module/PerpetualModule.sol
- contracts/libraries/Validator.sol
- contracts/thirdparty/weth/WETH9.sol
- contracts/LibraryEvents.sol
- contracts/test/TestCalc.sol
- contracts/factory/AccessControl.sol
- contracts/test/TestPerpetual.sol
- contracts/libraries/Signature.sol
- contracts/interface/IPoolCreator.sol
- contracts/test/TestShareToken.sol
- contracts/interface/ILiquidityPoolGovernance.sol
- contracts/test/TestBitwiseMath.sol
- contracts/Getter.sol
- contracts/reader/Reader.sol
- contracts/libraries/SafeMathExt.sol
- contracts/test/TestAMM.sol
- contracts/test/TestLibMath.sol
- contracts/test/TestSymbolService.sol
- contracts/interface/IGovernor.sol
- contracts/interface/IRelayRecipient.sol
- contracts/factory/UpgradeableProxy.sol
- contracts/broker/Broker.sol
- contracts/oracle/router/OracleRouterCreator.sol
- contracts/test/MockAMMModule.sol
- contracts/factory/Variables.sol
- contracts/test/LiquidityPoolAdmin.sol
- contracts/module/CollateralModule.sol
- contracts/interface/IShareToken.sol
- contracts/oracle/router/OracleRouter.sol
- contracts/interface/IOracle.sol
- contracts/test/TestTrade.sol
- contracts/libraries/OrderData.sol
- contracts/factory/Tracer.sol
- contracts/libraries/Math.sol
- contracts/test/MockLiquidityPool.sol
- contracts/interface/ISymbolService.sol
- contracts/test/TestGovernance.sol
- contracts/module/AMMModule.sol
- contracts/test/TestGovernor.sol
- contracts/libraries/Constant.sol
- contracts/Governance.sol
- contracts/thirdparty/cloneFactory/CloneFactory.sol
- contracts/governance/LpGovernor.sol
- contracts/interface/IAccessControl.sol
- contracts/test/TestLibSafeMathExt.sol
- contracts/Storage.sol
- contracts/Type.sol
- contracts/test/TestLiquidityPool.sol
- contracts/test/TestHelper.sol
- contracts/test/CustomERC20.sol
- contracts/interface/IDecimals.sol
Part of MCDEX Arbitrum Integration’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us