A whitehat reported, via Immunefi, that `batchTrade()` in MCDEX's Broker contract failed to validate input
Jun–Jul 2021funds not affected- Outcome
- No loss: vulnerability disclosed and fixed
- Loss
- None; not exploited
MUX Protocol is a decentralized platform for leveraged perpetual futures, formerly known as MCDEX. It does two jobs 1:
Traders connect a self-custody wallet and can use up to 100x leverage, mostly on Arbitrum 112. Fees and income flow to liquidity providers and to holders of the MCB token who lock it as veMUX 7. MUX Protocol is unrelated to Mux, Inc., the video-streaming software company.
The aggregator compares connected perpetual venues and sends your position to one or more of them 3. It considers four things:
MUX's docs list its own V3, V1 and Degen pools, GMX V1 and V2, and Gains Network's gTrade as sources 1. That list should be read with care. GMX permanently stopped new v1 positions on Arbitrum after its July 2025 exploit 16, so routes depend on what each venue currently accepts.
The aggregator can also post extra margin on your behalf on the underlying venue. This lets you reach a higher leverage, or a lower liquidation price, than that venue would allow on its own 3.
The practical consequence is that fees and liquidation rules follow the venue your order lands on, not MUX's own schedule 45. For how market, limit and trigger orders differ, see crypto order types.
MUX also runs its own pools, where traders trade against pooled liquidity at an oracle price rather than against an order book 2:
MUX states that V1 and the aggregator processed more than $48 billion in volume by September 2024 2. That is a company figure, not independently checked here.
On MUX's own V1 and V3 pools, the docs list the following 4:
| Charge | How it works |
|---|---|
| Position fee | 0.06% of position value to open, and again to close |
| Borrowing (V3) / funding (V1) | Charged hourly; the annual rate is the higher of a base rate (8%) or utilization × a limit rate (40% for longs, 50% for shorts) |
| Liquidation fee | 0.06% on the fee page; the liquidation page gives 0.1% for the MUXLP pool 45 |
| Network gas | Paid in the chain's gas token, for example ETH on Arbitrum 11 |
Illustrative example (assumptions stated): a $10,000 position opened and closed on a MUX native pool pays $6 + $6 = $12 in position fees. Borrowing costs and gas come on top, and both depend on how long the position stays open and on pool utilization. Routes through GMX or gTrade use those venues' fee schedules instead 4.
MCB is the main token. Its supply is capped at 4,803,144, and 1 million of that is reserved for MUX vesting. MCB exists on Arbitrum, Ethereum and BNB Chain 6.
veMUX. Locking MCB or MUX for between two weeks and four years gives veMUX. A four-year lock earns 1 veMUX per token, and a one-year lock earns 0.25 6.
MUX. MUX is a non-transferable reward token issued at 1,000 a day. It can be locked for veMUX or vested into MCB over one year 67.
Where fees go 7:
The docs reviewed describe this fee-sharing model, not a token buyback-and-burn programme. Price data for MCB is outside this page's scope.
Custody. MUX is non-custodial: positions sit in smart contracts tied to your wallet.
Control. The contracts are controlled by a MUX DAO multi-sig 8:
Audits and bounty. Published audits cover V3 (Guardian), the aggregator (SolidProof, December 2022) and V1 (CertiK) 9. A bug bounty runs on Immunefi 10. Audits lower risk but do not guarantee contract safety.
Main risks:
Support. Support runs through Discord tickets 11. MUX never needs your seed phrase.
MUX began as MCDEX. Token Terminal names Jean Miao and Liu Jie as MCDEX's founders 13. The project relaunched under the MUX name in August 2022 alongside V1 213, and CoinMarketCap still lists the token under the MCDEX/MCB name with a rebrand notice 14. No incorporated company, headquarters or governing law was found in the documentation reviewed.
No exploit affecting MUX's own contracts was found in the sources reviewed (as of October 23, 2026). This reflects the sources checked, not a guarantee. Separately, GMX's July 2025 v1 exploit affected a venue that MUX listed as a routing source; MUX's contracts were not reported as affected 16.
Hacks in DefiLlama’s public database are also scored as the security record on the MUX Protocol rating page.
DeFiWhat Is a DEX and How Does It Work?A DEX is a decentralized exchange that lets you swap tokens directly from your own wallet using smart contracts, with no company holding your funds.6 min read·
ExchangesCEX vs DEX: Which Should You Use?CEX vs DEX comes down to custody, convenience and control. Compare how centralized and decentralized exchanges work so you can pick the right one.5 min read·
ExchangesCrypto Trading Fees and Spreads, ExplainedCrypto trading fees include more than the headline rate. Learn how maker-taker fees, spreads and network costs combine into what you really pay.5 min read·
RegulationBitcoin ETF Outflows Weigh on Market as Interactive Brokers Launches Ethereum StakingSpot Bitcoin ETFs recorded $65.4 million in net outflows as hawkish Federal Reserve comments pressured prices. Meanwhile, Interactive Brokers rolled out Ethereum staking for eligible US clients.4 min read·
MarketsCFTC Opens Retail Crypto Leverage Rulemaking as Bitcoin Holds Near $84KThe CFTC has begun a rulemaking on leveraged retail crypto trading, while Bitcoin hovers near $84,000 and traders wait for U.S. inflation data and the Fed’s October meeting.4 min read·
MarketsUS Moves $1B in Seized Bitcoin as Senate Scrutiny of Tether GrowsU.S.-linked wallets shifted 12,267 BTC from a Bitfinex hack seizure address without any exchange deposit, while Senator Richard Blumenthal pressed Cantor Fitzgerald over its Tether partnership.3 min read·Related: GMX · Hyperliquid · dYdX · All company profiles