MCDEX

QuantstampFiles named in the report

Audit

Quantstamp reviewed MCDEX Arbitrum Integration (MCDEX) on 11 Apr 2021: 19 findings, 0 critical; 11 marked fixed, 6 acknowledged, 2 open.

No open critical findings
Open the reportOpen MCDEX Arbitrum Integration’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings19

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium012
Low258
MediumNo Backup Oracle Nor Protection From Erroneous Price DataAcknowledged

According to `updatePrice` in `contracts\module\PerpetualModule.sol` and `contracts\interface\IOracle.sol`, the oracles that the current system uses do not have any backup. The system only collects price data of each `path` from one oracle so there is no backup oracle. The system could fail to work correctly when any of the oracles is operating abnormally or being manipulated.

Low`calculateCashToReturn` Does Not Exclude PerpetualsAcknowledged

The function `calculateCashToReturn` assumes that the context is fully prepared without excluding any perpetuals.

LowContract Stores Its Own Balance For Calculation Instead Of Utilising Real-Time Token Contract ValueAcknowledged

For `account.cash` and `collateralToken`, the system stores its own balance data for calculation instead of utilising real-time token contract data. This could lead to faulty calculation when non-standard tokens (e.g., those which may be deflationary, involve rebasing, or have wrong return values from `transfer`) are used.

LowEnd User Can Pretend To Be A Broker Or RelayerAcknowledged

In the function `brokerTrade`, a user can interact with `Perpetual.sol` directly by giving it a manipulated `OrderData` that seems to be sent by a broker, from a relayer.

LowPossible Reward TruncationAcknowledged

`L61` in `setRewardRate` may truncate unfinished reward distribution.

LowUnused FunctionsAcknowledged

Functions `transferFromUserToPool` and `transferFromPoolToUser` are unused. There are also comments indicating risks of incorrect calculation if used in `addLiquidity` or `removeLiquidity`.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (74)

  • contracts/Perpetual.sol
  • contracts/libraries/EnumerableMapExt.sol
  • contracts/module/OrderModule.sol
  • contracts/module/LiquidityPoolModule.sol
  • contracts/governance/RewardDistribution.sol
  • contracts/test/TestMarginAccount.sol
  • contracts/libraries/Utils.sol
  • contracts/module/TradeModule.sol
  • contracts/factory/PoolCreator.sol
  • contracts/module/MarginAccountModule.sol
  • contracts/test/TestTracer.sol
  • contracts/test/BlackHole.sol
  • contracts/libraries/BitwiseMath.sol
  • contracts/governance/GovernorAlpha.sol
  • contracts/test/TestAccessControl.sol
  • contracts/factory/VersionControl.sol
  • contracts/interface/IWETH.sol
  • contracts/oracle/mock/OracleWrapper.sol
  • contracts/symbolService/SymbolService.sol
  • contracts/test/TestGovernanceToken.sol
  • contracts/LiquidityPool.sol
  • contracts/test/TestOrder.sol
  • contracts/interface/ILiquidityPool.sol
  • contracts/module/PerpetualModule.sol
  • contracts/libraries/Validator.sol
  • contracts/thirdparty/weth/WETH9.sol
  • contracts/LibraryEvents.sol
  • contracts/test/TestCalc.sol
  • contracts/factory/AccessControl.sol
  • contracts/test/TestPerpetual.sol
  • contracts/libraries/Signature.sol
  • contracts/interface/IPoolCreator.sol
  • contracts/test/TestShareToken.sol
  • contracts/interface/ILiquidityPoolGovernance.sol
  • contracts/test/TestBitwiseMath.sol
  • contracts/Getter.sol
  • contracts/reader/Reader.sol
  • contracts/libraries/SafeMathExt.sol
  • contracts/test/TestAMM.sol
  • contracts/test/TestLibMath.sol
  • contracts/test/TestSymbolService.sol
  • contracts/interface/IGovernor.sol
  • contracts/interface/IRelayRecipient.sol
  • contracts/factory/UpgradeableProxy.sol
  • contracts/broker/Broker.sol
  • contracts/oracle/router/OracleRouterCreator.sol
  • contracts/test/MockAMMModule.sol
  • contracts/factory/Variables.sol
  • contracts/test/LiquidityPoolAdmin.sol
  • contracts/module/CollateralModule.sol
  • contracts/interface/IShareToken.sol
  • contracts/oracle/router/OracleRouter.sol
  • contracts/interface/IOracle.sol
  • contracts/test/TestTrade.sol
  • contracts/libraries/OrderData.sol
  • contracts/factory/Tracer.sol
  • contracts/libraries/Math.sol
  • contracts/test/MockLiquidityPool.sol
  • contracts/interface/ISymbolService.sol
  • contracts/test/TestGovernance.sol
  • contracts/module/AMMModule.sol
  • contracts/test/TestGovernor.sol
  • contracts/libraries/Constant.sol
  • contracts/Governance.sol
  • contracts/thirdparty/cloneFactory/CloneFactory.sol
  • contracts/governance/LpGovernor.sol
  • contracts/interface/IAccessControl.sol
  • contracts/test/TestLibSafeMathExt.sol
  • contracts/Storage.sol
  • contracts/Type.sol
  • contracts/test/TestLiquidityPool.sol
  • contracts/test/TestHelper.sol
  • contracts/test/CustomERC20.sol
  • contracts/interface/IDecimals.sol

Part of MCDEX Arbitrum Integration’s security record

MCDEX Arbitrum Integration
Audits2 audits by 1 firmLast audit Jun 2021, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open MCDEX Arbitrum Integration’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us