MCDEX
Quantstamp reviewed MCDEX Arbitrum Integration (MCDEX) on 11 Apr 2021: 19 findings, 0 critical; 11 marked fixed, 6 acknowledged, 2 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings19
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 2 |
| Low | 2 | 5 | 8 |
HighDangerous External Calls From `Broker.sol`Fixed
The function `callFunction`, can be called by any user to call any external contracts. This enables a user to have privilege of the `Broker.sol` contract and could be used as a tool to conduct a complex attack.
MediumTrade Price Can Be ZeroFixed
Within the function `validatePrice`, the trade price can be set to zero. This could lead to devastating results.
MediumTrading Privilege Check Returns Incorrect ResultsFixed
The sequence of the arguments in `isAuthorized` for calling `IAccessControl.isGranted` on `L814` is incorrect. The sequence of `grantee` and `grantor` is switched.
Low`rebalance` Does Not Have a Return ValueFixed
As in the title, `rebalance` does not have a return value; this may lead to undesirable results or wasted computation.
LowAmbiguous Liquidity Pool Ownership And Operator Privilege ControlFixed
Within the function `setLiquidityPoolOwnership`, there is a permission check so that it can only be called by a liquidity pool instance. However, there seems to be a difference in being the "owner" of a liquidity pool vs the "operator" of a liquidity pool. The operator privilege is transfered via `transferOperator` and `transferOperator`, but this does not automatically transfer liquidity pool ownership.
LowIncorrect ConstantsFixed
There is an error in `L759-761` of `validateBaseParameters`: `INDEX_OPEN_SLIPPAGE_FACTOR` is used instead of `INDEX_MAINTENANCE_MARGIN_RATE` to validate the liquidation penalty parameter. Having said that, both constants are set to 1 so the result is the same.
LowIncorrect Data RepresentationFixed
There is a difference in the representation of `int256 deltaPosition` between `liquidateByAMM` and `liquidateByTrader`, which may cause confusion in the future. Specifically, `deltaPosition` in `liquidateByAMM` represents the position to be taken on by the AMM, which is the trader’s current position. In contrast, `deltaPosition` represents the change in the trader’s position in `liquidateByTrader`.
LowMissing ArgumentFixed
`OperatorCheckIn` event should contain `address indexed operator` as an argument.
LowMissing Input ValidationFixed
Several functions do not validate that input arguments are values are trivially incorrect, such as addresses possibly being zero. The following list may be incomplete. 1. `Governance.sol`: `transferOperator` does not check that input address is non-zero. 0. `Broker.sol`: `_transfer`, `callFunction` do not check that input addresses are non-zero. 0. `PoolCreator.sol`: Constructor, `_createLiquidityPoolWith` do not check that addresses are non-zero. 0. `SymbolService.sol`: `isWhitelistedFactory` does not check if input address is non-zero.
LowOmitted EventFixed
`SetOracle` event from `module/PerpetualModule.sol` is not included.
Show 1 more
LowPossibly Incorrect Revert Condition In `validateBaseParameters`Fixed
In `L759-762`: the revert message is inconsistent with the revert condition.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (74)
- contracts/Perpetual.sol
- contracts/libraries/EnumerableMapExt.sol
- contracts/module/OrderModule.sol
- contracts/module/LiquidityPoolModule.sol
- contracts/governance/RewardDistribution.sol
- contracts/test/TestMarginAccount.sol
- contracts/libraries/Utils.sol
- contracts/module/TradeModule.sol
- contracts/factory/PoolCreator.sol
- contracts/module/MarginAccountModule.sol
- contracts/test/TestTracer.sol
- contracts/test/BlackHole.sol
- contracts/libraries/BitwiseMath.sol
- contracts/governance/GovernorAlpha.sol
- contracts/test/TestAccessControl.sol
- contracts/factory/VersionControl.sol
- contracts/interface/IWETH.sol
- contracts/oracle/mock/OracleWrapper.sol
- contracts/symbolService/SymbolService.sol
- contracts/test/TestGovernanceToken.sol
- contracts/LiquidityPool.sol
- contracts/test/TestOrder.sol
- contracts/interface/ILiquidityPool.sol
- contracts/module/PerpetualModule.sol
- contracts/libraries/Validator.sol
- contracts/thirdparty/weth/WETH9.sol
- contracts/LibraryEvents.sol
- contracts/test/TestCalc.sol
- contracts/factory/AccessControl.sol
- contracts/test/TestPerpetual.sol
- contracts/libraries/Signature.sol
- contracts/interface/IPoolCreator.sol
- contracts/test/TestShareToken.sol
- contracts/interface/ILiquidityPoolGovernance.sol
- contracts/test/TestBitwiseMath.sol
- contracts/Getter.sol
- contracts/reader/Reader.sol
- contracts/libraries/SafeMathExt.sol
- contracts/test/TestAMM.sol
- contracts/test/TestLibMath.sol
- contracts/test/TestSymbolService.sol
- contracts/interface/IGovernor.sol
- contracts/interface/IRelayRecipient.sol
- contracts/factory/UpgradeableProxy.sol
- contracts/broker/Broker.sol
- contracts/oracle/router/OracleRouterCreator.sol
- contracts/test/MockAMMModule.sol
- contracts/factory/Variables.sol
- contracts/test/LiquidityPoolAdmin.sol
- contracts/module/CollateralModule.sol
- contracts/interface/IShareToken.sol
- contracts/oracle/router/OracleRouter.sol
- contracts/interface/IOracle.sol
- contracts/test/TestTrade.sol
- contracts/libraries/OrderData.sol
- contracts/factory/Tracer.sol
- contracts/libraries/Math.sol
- contracts/test/MockLiquidityPool.sol
- contracts/interface/ISymbolService.sol
- contracts/test/TestGovernance.sol
- contracts/module/AMMModule.sol
- contracts/test/TestGovernor.sol
- contracts/libraries/Constant.sol
- contracts/Governance.sol
- contracts/thirdparty/cloneFactory/CloneFactory.sol
- contracts/governance/LpGovernor.sol
- contracts/interface/IAccessControl.sol
- contracts/test/TestLibSafeMathExt.sol
- contracts/Storage.sol
- contracts/Type.sol
- contracts/test/TestLiquidityPool.sol
- contracts/test/TestHelper.sol
- contracts/test/CustomERC20.sol
- contracts/interface/IDecimals.sol
Part of MCDEX Arbitrum Integration’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us