Monadex V1
Two-week security assessment of the Monadex V1 contracts on Monad: a Uniswap V2-style DEX with a Pyth-oracle-backed raffle that mints tickets on swap activity. The 1,021 nSLOC review across the Router, Raffle, Pool and supporting libraries identified 16 issues including 2 Critical (broken raffle registration and a confidence-value bug zeroing out ticket mints) and 2 High (decimal-precision errors and a missing Pyth price update before reads), plus 6 Medium and 6 Low quality issues.
Scope
6 files · 1,021 SLOCFindings
click any row for the full write-upKey Findings
- Nearly impossible for any user to register to the raffle. The
register()function inMonadexV1RafflechecksticketsToBurn < balanceand reverts in either branch, so registration always fails and the entire raffle becomes non-functional regardless of the user's balance. - Incorrect confidence calculation in ticket minting.
calculateTicketsToMintinMonadexV1Libraryuses_pythPrice.priceinstead of_pythPrice.conffor the confidence value, causing the(price - confidence)arithmetic to produce zero or negative ticket amounts and reverting every purchase withMonadexV1Raffle__ZeroTickets. - Multiple decimal precision issues in ticket calculation.
calculateTicketsToMinthardcodes 18 decimals for all tokens and mishandles the Pyth payload'sexpofield, so users with non-18-decimal tokens receive orders of magnitude more or fewer tickets than intended, destabilising the raffle's economy. - Missing Pyth price update leads to users being unable to receive tickets.
_getTicketsToMintcallsgetPriceNoOlderThan()without first callingupdatePriceFeeds(), so the contract reads stale or missing data and the post-swap ticket flow always reverts. The mitigation propagates anupdateDataparameter through the swap interface and updates feeds before each read.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
