As of 3 Nov 2026, MCDEX Arbitrum Integration has 2 audit reports by 1 security firm on Trustblock; the latest is by Quantstamp, dated 21 Jun 2021. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| MCDEX Arbitrum Integration | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| MCDEX | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 3 | 2 |
| Low | 3 | 7 | 12 |
There is a [recommendation](https://mcdex.io/references/#/en-US/mai-protocol-v3?id=_7-insurance-fund) to fill the initial and supplementary Insurance Funds with capital `liquidityPool.donatedInsuranceFund` from the operator (`We encourage operators to donate to the initial capital and supplement the insurance fund as the contract runs.`). There is also a mechanism to refill the Insurance Fund of the Perpetual with a certain ratio (`perpetual.insuranceFundRate` L457 of `TradeModule`) from the liquidation penalty (`When trader’s position gets liquidated due to insufficient margin, a certain ratio (based on the AMM parameters) of the charged liquidation penalty goes to the insurance fund`) that goes into `liquidityPool.insuranceFund`. But if the donated operator funds are insufficient then the liquidation penalty fraction assigned to insurance will always be insufficient to bail out the liquidated users because the liquidation penalty is always bigger than the ratio assigned for the replenishment (see L470-473 and check that `penaltyToFund < penalty`). > int256 penaltyToLP = liquidityPool.updateInsuranceFund(penaltyToFund); > perpetual.updateCash(address(this), penaltyToLP); > perpetual.updateCash(liquidator, penaltyToLiquidator); > perpetual.updateCash(trader, penalty.add(vaultFee).neg());
Open the reportAccording to [documentation](https://mcdex.io/references/#/en-US/mai-protocol-v3?id=_6-settlement) `when Oracle does not provide updates for over 24 hours, the contract will also enter settlement`, but this functionality is not implemented.
Open the reportAccording to `updatePrice` in `contracts\module\PerpetualModule.sol` and `contracts\interface\IOracle.sol`, the oracles that the current system uses do not have any backup. The system only collects price data of each `path` from one oracle so there is no backup oracle. The system could fail to work correctly when any of the oracles is operating abnormally or being manipulated.
Open the reportWithout optimizations, the contract size for `LiquidityPoolModule` several contracts`` exceeds 24576 bytes (a limit introduced in Spurious Dragon hard fork).
Open the report`PoolCreator.createLiquidityPool` allows the caller to introduce the same nonce multiple times which will result in a contract deployment failure.
Open the reportThe function `calculateCashToReturn` assumes that the context is fully prepared without excluding any perpetuals.
Open the reportFor `account.cash` and `collateralToken`, the system stores its own balance data for calculation instead of utilising real-time token contract data. This could lead to faulty calculation when non-standard tokens (e.g., those which may be deflationary, involve rebasing, or have wrong return values from `transfer`) are used.
Open the reportIn the function `brokerTrade`, a user can interact with `Perpetual.sol` directly by giving it a manipulated `OrderData` that seems to be sent by a broker, from a relayer.
Open the report`L61` in `setRewardRate` may truncate unfinished reward distribution.
Open the reportFunctions `transferFromUserToPool` and `transferFromPoolToUser` are unused. There are also comments indicating risks of incorrect calculation if used in `addLiquidity` or `removeLiquidity`.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="mcdex-arbitrum-integration"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us