As of 3 Nov 2026, MCDEX Arbitrum Integration has 2 audit reports by 1 security firm on Trustblock; the latest is by Quantstamp, dated 21 Jun 2021. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Nov 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| MCDEX Arbitrum Integration | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| MCDEX | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 3 | 2 |
| Low | 3 | 7 | 12 |
The function `callFunction`, can be called by any user to call any external contracts. This enables a user to have privilege of the `Broker.sol` contract and could be used as a tool to conduct a complex attack.
Open the reportWithin the function `validatePrice`, the trade price can be set to zero. This could lead to devastating results.
Open the reportThe sequence of the arguments in `isAuthorized` for calling `IAccessControl.isGranted` on `L814` is incorrect. The sequence of `grantee` and `grantor` is switched.
Open the reportSome interfaces, such as `ILiquidityPool` are used a lot to cast contracts, but the implementation `Perpetual` does not implement explicitly this interface. The implementation assumes implicitly the interface. This can lead to difficulty maintaining the code and error-prone development.
Open the report1. Variables.sol::L52 `setVault` can be set to address(0) despite L23 rejecting that. 2. LiquidityPoolModule.sol In `initialize`, should validate `insuranceFundCap >= 0` using at the minimum as a negative cap does not seem to have meaning. Has precedence in `validateLiquidityPoolParameter` and `setLiquidityPoolParameter`. 3. LiquidityPoolModule.sol `setPerpetualOracle` should validate for whether `newOracle != address(0)`. If `address(0)` has a meaning here (ie. no oracle set or not to use oracle), then it should be well documented. 4. LiquidityPoolModule.sol L436 does not check for whether `length > 0`, does this function `setAllPerpetualsToEmergencyState` have meaning when there is no perpetuals? 5. Reader.sol `constructor` `_poolCreator` against `address(0)` given that it is immutable.
Open the reportL178 claims that `isTraderMarginSafe` has to fulfill `the need to rebalance before checking`, but there is no `rebalance` happening here unlike in functions below with the same requirement. A `rebalance()` function is possible missing.
Open the reportWe recommend using a mock contract to simulate addresses in a test environment. Never leave TODOs in the contract during the audit phase or deployment phase.
Open the reportAs in the title, `rebalance` does not have a return value; this may lead to undesirable results or wasted computation.
Open the reportWithin the function `setLiquidityPoolOwnership`, there is a permission check so that it can only be called by a liquidity pool instance. However, there seems to be a difference in being the "owner" of a liquidity pool vs the "operator" of a liquidity pool. The operator privilege is transfered via `transferOperator` and `transferOperator`, but this does not automatically transfer liquidity pool ownership.
Open the reportThere is an error in `L759-761` of `validateBaseParameters`: `INDEX_OPEN_SLIPPAGE_FACTOR` is used instead of `INDEX_MAINTENANCE_MARGIN_RATE` to validate the liquidation penalty parameter. Having said that, both constants are set to 1 so the result is the same.
Open the reportThere is a difference in the representation of `int256 deltaPosition` between `liquidateByAMM` and `liquidateByTrader`, which may cause confusion in the future. Specifically, `deltaPosition` in `liquidateByAMM` represents the position to be taken on by the AMM, which is the trader’s current position. In contrast, `deltaPosition` represents the change in the trader’s position in `liquidateByTrader`.
Open the report`OperatorCheckIn` event should contain `address indexed operator` as an argument.
Open the reportSeveral functions do not validate that input arguments are values are trivially incorrect, such as addresses possibly being zero. The following list may be incomplete. 1. `Governance.sol`: `transferOperator` does not check that input address is non-zero. 0. `Broker.sol`: `_transfer`, `callFunction` do not check that input addresses are non-zero. 0. `PoolCreator.sol`: Constructor, `_createLiquidityPoolWith` do not check that addresses are non-zero. 0. `SymbolService.sol`: `isWhitelistedFactory` does not check if input address is non-zero.
Open the report`SetOracle` event from `module/PerpetualModule.sol` is not included.
Open the reportIn `L759-762`: the revert message is inconsistent with the revert condition.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="mcdex-arbitrum-integration"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us