Dromos Labs MetaDEX Application Layer
About Dromos Labs MetaDEX Application Layer
Dromos Labs implements the application layer of MetaDEX, the emission and reward infrastructure that runs on each leaf chain together with the AMM pools that feed it. Gauges distribute emissions to staked LP tokens, voting rewards contracts pass pool fees and incentives on to veNFT holders, and a metarouter is the unified access point for user interactions, including those arriving from another chain. We have conducted a thorough review of the scope with a focus on reward and emission accounting, liveness, and the handling of failing external calls:
Audit Summary
Emissions and voting rewards are accounted for across gauges, voting rewards contracts and the LeafVoter. The original design pushed vote updates to the voting rewards contracts through a try/catch that an attacker could force into the failure branch, which caused Attacker Caused Missing Gauge Rate Windows and A failed checkpoint keeps a veNFT’s weight on two gauges. Both have been resolved by a pull-based design that reverts on failure.
Staked LP tokens must stay withdrawable and emissions claimable also in case of chain suspensions and when cross-chain messages are delivered by permissionless relayers. In prior versions, chain suspension locked staked LP tokens, see Chain suspension locks staked LP tokens, and a malicious relayer could forfeit a staker’s accrued emissions, see Malicious relayer can forfeit all accrued emissions.
Several contracts wrapped calls into fee modules, tapes and other external contracts so that a failing callee does not block swaps or gauge actions. A caller could starve these calls of gas to select their failure branch, see Griefing via passing insufficient gas, and the fixed gas stipends could not adapt to future gas repricing, see Hardcoded gas stipends cannot adapt to gas repricing. The stipends are now configurable, and the calls with a fixed gas limit check that enough gas is left before forwarding it. Several calls that forward 63/64 of the remaining gas inside a try/catch remain unguarded, so a caller may still be able to force their fallback branch.
We provide this audit report to assist in forming an opinion on the risk profile of MetaDEX Application Layer. In summary, we find that the codebase provides a good level of security, if operated under the assumptions documented in System Overview, Trust Model and System Considerations.
The emergency withdrawal mechanism added in Version 5, which bypasses accounting that the rest of the system relies on, was reviewed on a short notice of only days before launch. One related issue was identified, see Emergency withdraw role can disable the early unstake penalty. Due to the higher risk of undiscovered issues, further review and testing should be conducted before emergency withdrawals are relied on in production.
It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don’t replace other vital measures to secure a project.