MCDEX Arbitrum Integration
Quantstamp reviewed MCDEX Arbitrum Integration on 21 Jun 2021: 9 findings, 0 critical; 4 marked fixed, 4 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 2 | 0 |
| Low | 1 | 2 | 4 |
LowImplicity Use of InterfacesFixed
Some interfaces, such as `ILiquidityPool` are used a lot to cast contracts, but the implementation `Perpetual` does not implement explicitly this interface. The implementation assumes implicitly the interface. This can lead to difficulty maintaining the code and error-prone development.
LowMissing Parameter ValidationFixed
1. Variables.sol::L52 `setVault` can be set to address(0) despite L23 rejecting that. 2. LiquidityPoolModule.sol In `initialize`, should validate `insuranceFundCap >= 0` using at the minimum as a negative cap does not seem to have meaning. Has precedence in `validateLiquidityPoolParameter` and `setLiquidityPoolParameter`. 3. LiquidityPoolModule.sol `setPerpetualOracle` should validate for whether `newOracle != address(0)`. If `address(0)` has a meaning here (ie. no oracle set or not to use oracle), then it should be well documented. 4. LiquidityPoolModule.sol L436 does not check for whether `length > 0`, does this function `setAllPerpetualsToEmergencyState` have meaning when there is no perpetuals? 5. Reader.sol `constructor` `_poolCreator` against `address(0)` given that it is immutable.
LowRebalance Before Checking Not FulfilledFixed
L178 claims that `isTraderMarginSafe` has to fulfill `the need to rebalance before checking`, but there is no `rebalance` happening here unlike in functions below with the same requirement. A `rebalance()` function is possible missing.
LowTODO in `Variable.getMCBToken`Fixed
We recommend using a mock contract to simulate addresses in a test environment. Never leave TODOs in the contract during the audit phase or deployment phase.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (82)
- contracts/Perpetual.sol
- contracts/libraries/EnumerableMapExt.sol
- contracts/module/OrderModule.sol
- contracts/oracle/simple/OracleWrapper.sol
- contracts/module/LiquidityPoolModule.sol
- contracts/governance/RewardDistribution.sol
- contracts/test/TestMarginAccount.sol
- contracts/libraries/Utils.sol
- contracts/module/TradeModule.sol
- contracts/factory/PoolCreator.sol
- contracts/module/MarginAccountModule.sol
- contracts/test/TestTracer.sol
- contracts/test/BlackHole.sol
- contracts/test/WETH9.sol
- contracts/interface/IVersionControl.sol
- contracts/libraries/BitwiseMath.sol
- contracts/governance/GovernorAlpha.sol
- contracts/test/TestAccessControl.sol
- contracts/factory/VersionControl.sol
- contracts/interface/ILiquidityPoolFull.sol
- contracts/interface/ITracer.sol
- contracts/symbolService/SymbolService.sol
- contracts/interface/IPoolCreatorFull.sol
- contracts/interface/IProxyAdmin.sol
- contracts/LiquidityPool.sol
- contracts/test/TestOrder.sol
- contracts/interface/ILiquidityPool.sol
- contracts/module/PerpetualModule.sol
- contracts/libraries/Validator.sol
- contracts/LibraryEvents.sol
- contracts/test/TestCalc.sol
- contracts/interface/IPerpetual.sol
- contracts/interface/ILiquidityPoolGetter.sol
- contracts/factory/AccessControl.sol
- contracts/test/TestPerpetual.sol
- contracts/libraries/Signature.sol
- contracts/interface/IPoolCreator.sol
- contracts/test/TestShareToken.sol
- contracts/interface/ILiquidityPoolGovernance.sol
- contracts/test/TestBitwiseMath.sol
- contracts/Getter.sol
- contracts/reader/Reader.sol
- contracts/libraries/SafeMathExt.sol
- contracts/test/TestAMM.sol
- contracts/test/TestLibMath.sol
- contracts/test/TestSymbolService.sol
- contracts/interface/IGovernor.sol
- contracts/interface/IVariables.sol
- contracts/broker/Broker.sol
- contracts/test/TestLiquidityPoolUpgraded.sol
- contracts/oracle/router/OracleRouterCreator.sol
- contracts/test/MockAMMModule.sol
- contracts/interface/IUpgradeableProxy.sol
- contracts/factory/Variables.sol
- contracts/test/LiquidityPoolAdmin.sol
- contracts/module/CollateralModule.sol
- contracts/oracle/router/OracleRouter.sol
- contracts/interface/IOracle.sol
- contracts/test/TestTrade.sol
- contracts/libraries/OrderData.sol
- contracts/factory/Tracer.sol
- contracts/test/MockPoolCreator.sol
- contracts/libraries/Math.sol
- contracts/test/MockLiquidityPool.sol
- contracts/interface/ISymbolService.sol
- contracts/test/TestGovernance.sol
- contracts/module/AMMModule.sol
- contracts/test/TestGovernor.sol
- contracts/libraries/Constant.sol
- contracts/Governance.sol
- contracts/test/TestLpGovernor.sol
- contracts/governance/LpGovernor.sol
- contracts/interface/IAccessControl.sol
- contracts/test/TestLibSafeMathExt.sol
- contracts/Storage.sol
- contracts/Type.sol
- contracts/remargin/RemarginHelper.sol
- contracts/test/TestLiquidityPool.sol
- contracts/test/TestHelper.sol
- contracts/test/TestLpGovernorUpgraded.sol
- contracts/test/CustomERC20.sol
- contracts/interface/IDecimals.sol
Part of MCDEX Arbitrum Integration’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us