{"investigation":{"slug":"mux-protocol","entity_name":"MUX Protocol","trust_score":68,"severity_base":null,"score_modifier":0,"confidence":0.55,"status":"published","content_type":"investigation","summary":"MUX Protocol (formerly MCDEX) is a perpetuals trading protocol and aggregator, deployed mainly on Arbitrum, with the MCB token and a veMUX revenue-sharing model. The research found no reports of a MUX-specific exploit, and its documentation lists three third-party audits. The Immunefi bug bounty page showed a 'Paused' status when read, and the audit documentation lacks dates for two of three audits.","sections":[{"content":"MUX Protocol describes itself as a protocol suite comprising the MUX Perpetual Aggregator, MUX V3 Trading Protocol, MUX V1 Trading Protocol and MUX V1 Degen Protocol. Secondary reporting states that MCDEX launched its V4 under the MUX name in August 2022 as a multi-chain leveraged trading protocol with up to 100x leverage on Arbitrum, BNB Chain, Avalanche and Fantom. No primary MUX announcement of the rebrand was located; the date rests on secondary sources (BloFin, CoinMarketCap, Dealroom). The aggregator is described as routing trades across venues such as GMX, gTrade (Gains) and MUX's own pools; sources are not fully consistent on the current integration list.","heading":"Overview and history","sources":[{"url":"https://docs.mux.network/","name":"MUX documentation overview","type":"official","credibility":2},{"url":"https://blofin.com/news/mcdex-rebranded-as-mux-launched-multi-chain-leveraged-trading-protocol","name":"BloFin: MCDEX Rebranded as MUX","type":"news_article","credibility":3},{"url":"https://app.dealroom.co/companies/mcdex","name":"Dealroom: MCDEX","type":"other","credibility":3}],"severity":"low"},{"content":"DefiLlama's API for MUX Protocol, read on 2026-10-13, showed per-chain TVL of Arbitrum about $8.89M, Avalanche about $0.45M, BSC about $0.32M, OP Mainnet about $0.21M and Fantom about $1,400, summing to roughly $9.86M, with Arbitrum about 90% of the total. This differs from the roughly $9.0M figure supplied by the requester on 2026-10-07, which is consistent with TVL moving between reads. The Arbitrum concentration means the protocol's liquidity depends heavily on a single chain.","heading":"TVL and chain concentration","sources":[{"url":"https://api.llama.fi/protocol/mux-protocol","name":"DefiLlama API: mux-protocol","type":"on_chain","credibility":2}],"severity":"low"},{"content":"DefiLlama lists the token as MCB at contract 0x4e352cf164e64adcbad318c3a1e222e9eba4ce42 (CoinGecko ID mcdex, CoinMarketCap ID 5956). A ForkLog community article reports a total MCB supply of about 4.8 million, with 1 million reserved for MUX vesting, and that maximum supply can be changed by governance vote. CoinMarketCap listed a max supply of 4,803,143 MCB and a circulating supply of 3,821,523 at the time of the search snapshot; these figures were not independently verified and may be stale. Locking MCB yields veMUX, which per secondary sources entitles holders to a share of protocol revenue and MUX rewards. A governance-adjustable supply cap is a structural risk factor for holders.","heading":"MCB token and tokenomics","sources":[{"url":"https://api.llama.fi/protocol/mux-protocol","name":"DefiLlama API: mux-protocol","type":"on_chain","credibility":2},{"url":"https://forklog.com/hub-archive/mux-multichejn-torgovlya-s-ispolzovaniem-zaemnyh-sredstv/","name":"ForkLog Community Hub: MUX","type":"news_article","credibility":3},{"url":"https://coinmarketcap.com/currencies/mcdex/","name":"CoinMarketCap: MUX Protocol (MCB)","type":"other","credibility":3}],"severity":"medium"},{"content":"MUX documentation lists three audits: Guardian Audits for the MUX V3 Trading Protocol (no date stated), SolidProof for the Leveraged Trading Aggregator (report filename indicates 2022-12-15; the page itself does not state a date), and CertiK for the MUX V1 Trading Protocol (no date stated). Report PDFs were not read for this page, so findings and remediation status are unverified. The Immunefi listing offers a maximum bounty of $100,000 for critical smart contract issues and has been live since June 2021, but showed a status of 'Paused' with a last-updated date of 2026-04-30 when read. The Immunefi page lists no specific audits. The scope of audits relative to currently deployed contracts was not verified.","heading":"Audits and bug bounty","sources":[{"url":"https://docs.mux.network/protocol/audit.md","name":"MUX docs: Audit","type":"official","credibility":2},{"url":"https://immunefi.com/bug-bounty/mux/","name":"Immunefi: MUX bug bounty","type":"official","credibility":2},{"url":"https://docs.mux.network/protocol/bug-bounty.md","name":"MUX docs: Bug Bounty","type":"official","credibility":2}],"severity":"medium"},{"content":"Searches for exploit, hack, pause or vulnerability reports specific to MUX Protocol returned no results. This is an absence of evidence from a limited search and not confirmation that no incident has occurred; DefiLlama's hacks dashboard and MUX's own channels were not directly checked. Other Arbitrum perpetuals venues have reportedly suffered exploits, and MUX's aggregator routes to third-party venues, so exposure to integrated venues' risks is possible, though no MUX loss from such events was found.","heading":"Incidents","sources":[{"url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it","name":"Decrypt: AFX Trade drained (context on Arbitrum perps)","type":"news_article","credibility":2}],"severity":"low"}],"timeline":[{"date":"2021-06","event":"Immunefi bug bounty program for MUX/MCDEX reported live","source":"Immunefi","source_url":"https://immunefi.com/bug-bounty/mux/"},{"date":"2022-08","event":"MCDEX reported to have rebranded as MUX with V4 launch on Arbitrum, BNB Chain, Avalanche and Fantom","source":"BloFin (secondary)","source_url":"https://blofin.com/news/mcdex-rebranded-as-mux-launched-multi-chain-leveraged-trading-protocol"},{"date":"2022-12","event":"SolidProof audit of MUX Leveraged Trading Aggregator (date inferred from report filename)","source":"MUX docs","source_url":"https://docs.mux.network/protocol/audit.md"},{"date":"2026-04","event":"Immunefi MUX bounty page last updated; status shown as Paused when read","source":"Immunefi","source_url":"https://immunefi.com/bug-bounty/mux/"}],"sources_used":[{"url":"https://docs.mux.network/","name":"MUX documentation overview","type":"official","credibility":2},{"url":"https://docs.mux.network/protocol/audit.md","name":"MUX docs: Audit","type":"official","credibility":2},{"url":"https://docs.mux.network/protocol/bug-bounty.md","name":"MUX docs: Bug Bounty","type":"official","credibility":2},{"url":"https://immunefi.com/bug-bounty/mux/","name":"Immunefi: MUX bug bounty","type":"official","credibility":2},{"url":"https://api.llama.fi/protocol/mux-protocol","name":"DefiLlama API: mux-protocol","type":"on_chain","credibility":2},{"url":"https://blofin.com/news/mcdex-rebranded-as-mux-launched-multi-chain-leveraged-trading-protocol","name":"BloFin: MCDEX Rebranded as MUX","type":"news_article","credibility":3},{"url":"https://app.dealroom.co/companies/mcdex","name":"Dealroom: MCDEX","type":"other","credibility":3},{"url":"https://forklog.com/hub-archive/mux-multichejn-torgovlya-s-ispolzovaniem-zaemnyh-sredstv/","name":"ForkLog Community Hub: MUX","type":"news_article","credibility":3},{"url":"https://coinmarketcap.com/currencies/mcdex/","name":"CoinMarketCap: MUX Protocol (MCB)","type":"other","credibility":3},{"url":"https://decrypt.co/374133/arbitrum-perp-dex-afx-trade-drained-of-24m-offers-hacker-30-to-return-it","name":"Decrypt: AFX Trade drained","type":"news_article","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-10-13T05:34:32.977137+00:00","updated_at":"2026-10-13T05:34:37.71+00:00"},"source_quality":{"total":10,"tier1":0,"tier2":1,"tier3":0,"unrated":9},"follower_count":null,"content_updated_at":"2026-10-13T05:34:33.204Z","last_fact_checked_at":null,"fact_check_next_allowed_at":null,"update_next_allowed_at":null}