MCDEX Arbitrum Integration
Quantstamp reviewed MCDEX Arbitrum Integration on 21 Jun 2021: 9 findings, 0 critical; 4 marked fixed, 4 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 2 | 0 |
| Low | 1 | 2 | 4 |
MediumInsurance Fund Not Replenished by Liquidation Penalty RatioAcknowledged
There is a [recommendation](https://mcdex.io/references/#/en-US/mai-protocol-v3?id=_7-insurance-fund) to fill the initial and supplementary Insurance Funds with capital `liquidityPool.donatedInsuranceFund` from the operator (`We encourage operators to donate to the initial capital and supplement the insurance fund as the contract runs.`). There is also a mechanism to refill the Insurance Fund of the Perpetual with a certain ratio (`perpetual.insuranceFundRate` L457 of `TradeModule`) from the liquidation penalty (`When trader’s position gets liquidated due to insufficient margin, a certain ratio (based on the AMM parameters) of the charged liquidation penalty goes to the insurance fund`) that goes into `liquidityPool.insuranceFund`. But if the donated operator funds are insufficient then the liquidation penalty fraction assigned to insurance will always be insufficient to bail out the liquidated users because the liquidation penalty is always bigger than the ratio assigned for the replenishment (see L470-473 and check that `penaltyToFund < penalty`). > int256 penaltyToLP = liquidityPool.updateInsuranceFund(penaltyToFund); > perpetual.updateCash(address(this), penaltyToLP); > perpetual.updateCash(liquidator, penaltyToLiquidator); > perpetual.updateCash(trader, penalty.add(vaultFee).neg());
MediumNo Settlement for Stale OracleAcknowledged
According to [documentation](https://mcdex.io/references/#/en-US/mai-protocol-v3?id=_6-settlement) `when Oracle does not provide updates for over 24 hours, the contract will also enter settlement`, but this functionality is not implemented.
LowContract Limit Size ExceededAcknowledged
Without optimizations, the contract size for `LiquidityPoolModule` several contracts`` exceeds 24576 bytes (a limit introduced in Spurious Dragon hard fork).
LowNonce Not AutoincrementedAcknowledged
`PoolCreator.createLiquidityPool` allows the caller to introduce the same nonce multiple times which will result in a contract deployment failure.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (82)
- contracts/Perpetual.sol
- contracts/libraries/EnumerableMapExt.sol
- contracts/module/OrderModule.sol
- contracts/oracle/simple/OracleWrapper.sol
- contracts/module/LiquidityPoolModule.sol
- contracts/governance/RewardDistribution.sol
- contracts/test/TestMarginAccount.sol
- contracts/libraries/Utils.sol
- contracts/module/TradeModule.sol
- contracts/factory/PoolCreator.sol
- contracts/module/MarginAccountModule.sol
- contracts/test/TestTracer.sol
- contracts/test/BlackHole.sol
- contracts/test/WETH9.sol
- contracts/interface/IVersionControl.sol
- contracts/libraries/BitwiseMath.sol
- contracts/governance/GovernorAlpha.sol
- contracts/test/TestAccessControl.sol
- contracts/factory/VersionControl.sol
- contracts/interface/ILiquidityPoolFull.sol
- contracts/interface/ITracer.sol
- contracts/symbolService/SymbolService.sol
- contracts/interface/IPoolCreatorFull.sol
- contracts/interface/IProxyAdmin.sol
- contracts/LiquidityPool.sol
- contracts/test/TestOrder.sol
- contracts/interface/ILiquidityPool.sol
- contracts/module/PerpetualModule.sol
- contracts/libraries/Validator.sol
- contracts/LibraryEvents.sol
- contracts/test/TestCalc.sol
- contracts/interface/IPerpetual.sol
- contracts/interface/ILiquidityPoolGetter.sol
- contracts/factory/AccessControl.sol
- contracts/test/TestPerpetual.sol
- contracts/libraries/Signature.sol
- contracts/interface/IPoolCreator.sol
- contracts/test/TestShareToken.sol
- contracts/interface/ILiquidityPoolGovernance.sol
- contracts/test/TestBitwiseMath.sol
- contracts/Getter.sol
- contracts/reader/Reader.sol
- contracts/libraries/SafeMathExt.sol
- contracts/test/TestAMM.sol
- contracts/test/TestLibMath.sol
- contracts/test/TestSymbolService.sol
- contracts/interface/IGovernor.sol
- contracts/interface/IVariables.sol
- contracts/broker/Broker.sol
- contracts/test/TestLiquidityPoolUpgraded.sol
- contracts/oracle/router/OracleRouterCreator.sol
- contracts/test/MockAMMModule.sol
- contracts/interface/IUpgradeableProxy.sol
- contracts/factory/Variables.sol
- contracts/test/LiquidityPoolAdmin.sol
- contracts/module/CollateralModule.sol
- contracts/oracle/router/OracleRouter.sol
- contracts/interface/IOracle.sol
- contracts/test/TestTrade.sol
- contracts/libraries/OrderData.sol
- contracts/factory/Tracer.sol
- contracts/test/MockPoolCreator.sol
- contracts/libraries/Math.sol
- contracts/test/MockLiquidityPool.sol
- contracts/interface/ISymbolService.sol
- contracts/test/TestGovernance.sol
- contracts/module/AMMModule.sol
- contracts/test/TestGovernor.sol
- contracts/libraries/Constant.sol
- contracts/Governance.sol
- contracts/test/TestLpGovernor.sol
- contracts/governance/LpGovernor.sol
- contracts/interface/IAccessControl.sol
- contracts/test/TestLibSafeMathExt.sol
- contracts/Storage.sol
- contracts/Type.sol
- contracts/remargin/RemarginHelper.sol
- contracts/test/TestLiquidityPool.sol
- contracts/test/TestHelper.sol
- contracts/test/TestLpGovernorUpgraded.sol
- contracts/test/CustomERC20.sol
- contracts/interface/IDecimals.sol
Part of MCDEX Arbitrum Integration’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us