Skip to content
Quantix Security Labs

Corvid AMM

Constant-product AMM written in Anchor.

A constant-product automated market maker on Solana. Pools are program-derived accounts holding two SPL token vaults; liquidity providers receive pool tokens minted by the program and swap fees accrue to the vaults.

Ecosystem
SOLSolana
Category
DEX
Languages
Rust (Anchor)
Launched
Sept 2025
76.1BBBModerate risk

Grade BBB · Moderate risk

Adequate posture with notable weaknesses in one or more areas.

+3.7 since Nov 2025 · +0.6 since Jul 2026

Quantix Protocol Research · as of 24 Oct 2026 · About this data

Risk Index

How the score is built

Six weighted components, each scored 0–100 where higher means less risk. Points are the component value multiplied by its weight; the gap is what the component costs against a perfect score.
ComponentWeightValuePointsGap
Code Security30%7422.2−7.8
Operational Security20%7615.2−4.8
Governance Risk15%7210.8−4.2
Economic Security15%7811.7−3.3
Infrastructure Resilience10%808.0−2.0
Transparency10%828.2−1.8
Quantix Risk Index100%76.1−23.9
CodeOperationalGovernanceEconomicInfrastructureTransparencyCorvid AMM, Code: 74Corvid AMM, Operational: 76Corvid AMM, Governance: 72Corvid AMM, Economic: 78Corvid AMM, Infrastructure: 80Corvid AMM, Transparency: 82
Risk Index components: Corvid AMM Code 74, Operational 76, Governance 72, Economic 78, Infrastructure 80, Transparency 82
ComponentCorvid AMM
Code74
Operational76
Governance72
Economic78
Infrastructure80
Transparency82

Grade scale

  1. AAA90–100
  2. AA85–89.9
  3. A80–84.9
  4. BBB75–79.9
  5. BB70–74.9
  6. B65–69.9
  7. CCC60–64.9
  8. CC55–59.9
  9. C50–54.9
  10. D0–49.9

Score history

12 monthly snapshots

Each point is the Risk Index computed from that month’s component values. Markers below the chart show the events that moved a component.
Corvid AMM Quantix Risk Index by month
PeriodQuantix Risk Index
Nov ’2572.4
Dec ’2572.4
Jan ’2672.4
Feb ’2673.3
Mar ’2673.3
Apr ’2673.3
May ’2675.5
Jun ’2675.5
Jul ’2675.5
Aug ’2676.1
Sep ’2676.1
Oct ’2676.1

  1. 3 Aug 2026

    Operations

    Program-upgrade alerts

    Notifications on upgrade-authority use and buffer account writes.

    • Operational Security+3

  2. 20 May 2026

    Research assessment

    Research assessment completed: Smart Contract Audit

    6 findings (1 critical, 1 high, 2 medium, 2 low). All critical and high findings addressed.

    Read the research assessment
    • Code Security+6
    • Transparency+4

  3. 9 Feb 2026

    Governance

    Upgrade authority moved to multisig

    The deployer key was replaced by a 3-of-5 multisig.

    • Governance Risk+6

Risk factors

What keeps the score from being higher, most severe first.

  • HighGovernance RiskProfile analysis

    Instant program upgrades

    The upgrade authority can deploy new program bytecode at once. A compromised quorum could drain vaults before LPs react.

  • MediumCode SecurityProfile analysis

    Large account-validation surface

    Swap and deposit instructions take many accounts; safety relies on every constraint being present and correct across versions.

  • MediumOperational SecurityProfile analysis

    Single-key fee administration

    The protocol fee collector is controlled by one key, a target for theft or misuse.

Recommendations

Each recommendation raises one component to a target value. The score effect is recomputed with the Risk Index model, holding every other component fixed.

  • Governance Risk: 72 → 82

    Enforce an upgrade delay

    Route upgrades through a timelocked multisig program, or freeze the program once stable.

    +1.5

    → 77.6

  • Operational Security: 76 → 82

    Move fee admin to the multisig

    Retire the single fee-admin key and require multisig approval for withdrawals.

    +1.2

    → 77.3

Analysis

Contract, governance and operations

Contract analysis

Source
Partially verified
Upgradeability
Program upgrade authority
Administrative control
3-of-5 multisig holds the upgrade authority; fee admin is a single key
Enforced delay
None identified
External dependencies
SPL Token program; Token-2022 for some pools
  • CautionVerifiable build. Reproducible build published for the current program version only.
  • CautionUpgrade authority. Multisig-controlled with no enforced delay.
  • PassAccount constraints. Anchor constraints on pool, vault and mint accounts.
  • FailFee withdrawal. Protocol fee withdrawal signed by a single admin key.

Governance exposure

High

The program can be replaced immediately by a 3-of-5 multisig; there is no delay for users to withdraw liquidity.

Operational resilience

Adequate

Program-upgrade alerts are in place; fee administration still relies on one key.

Monitoring

Monitoring history

2 recorded security events for Corvid AMM, most recent first.
Open in Security Monitoring
  1. 30 Aug 2026CriticalFlash-loan sized round trip through the TLW/SOL poolSuspicious Transaction Pattern · Pool PDAResolved
  2. 29 May 2026InformationalProgram upgraded to the assessed buildProxy Upgrade · corvid_amm programResolved

Research assessment

QX-TSA-2026-003Smart Contract AuditPublished

Pool initialisation, swaps, liquidity deposits and withdrawals, and fee collection. 2,310 lines of Rust.

Review 11 May 2026 – 20 May 2026 · published 2 Jun 2026

Critical1
High1
Medium2
Low2
Informational0
  • 5 resolved
  • 0 partially resolved
  • 1 acknowledged
  • 0 open
Read the assessmentReport PDF

Continue with

Comparable protocols

Compare side by side

Research

Relevant research

Publications on the risks that matter most for a dex protocol on Solana.

Architecture

System components

corvid_amm program
Pool initialisation, swaps, deposits and withdrawals
Pool PDA
Holds pool state and authority over token vaults
Token vaults
SPL token accounts owned by the pool authority
Fee collector
Protocol fee accounting and withdrawal

Turn risk factors into a remediation plan.

A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.

Discuss Your Security RequirementsBack to the Security Explorer