Skip to content
Quantix Security Labs

Merivale Markets

Order-book style DEX with an on-chain matching router.

A decentralised exchange on BNB Chain combining a hybrid order book with AMM fallback liquidity. A router matches orders against the book and routes remainder volume through pools; fees and listings are managed by an operator key.

Ecosystem
BNBBNB Chain
Category
DEX
Languages
Solidity
Launched
Feb 2026
61.3CCCHigh risk

Grade CCC · High risk

High risk; significant unresolved weaknesses.

+0.7 since Feb 2026 · +1.0 since Jul 2026

Quantix Protocol Research · as of 24 Oct 2026 · About this data

Risk Index

How the score is built

Six weighted components, each scored 0–100 where higher means less risk. Points are the component value multiplied by its weight; the gap is what the component costs against a perfect score.
ComponentWeightValuePointsGap
Code Security30%5817.4−12.6
Operational Security20%6012.0−8.0
Governance Risk15%527.8−7.2
Economic Security15%669.9−5.1
Infrastructure Resilience10%727.2−2.8
Transparency10%707.0−3.0
Quantix Risk Index100%61.3−38.7
CodeOperationalGovernanceEconomicInfrastructureTransparencyMerivale Markets, Code: 58Merivale Markets, Operational: 60Merivale Markets, Governance: 52Merivale Markets, Economic: 66Merivale Markets, Infrastructure: 72Merivale Markets, Transparency: 70
Risk Index components: Merivale Markets Code 58, Operational 60, Governance 52, Economic 66, Infrastructure 72, Transparency 70
ComponentMerivale Markets
Code58
Operational60
Governance52
Economic66
Infrastructure72
Transparency70

Grade scale

  1. AAA90–100
  2. AA85–89.9
  3. A80–84.9
  4. BBB75–79.9
  5. BB70–74.9
  6. B65–69.9
  7. CCC60–64.9
  8. CC55–59.9
  9. C50–54.9
  10. D0–49.9

Score history

9 monthly snapshots

Each point is the Risk Index computed from that month’s component values. Markers below the chart show the events that moved a component; the history starts at launch in Feb 2026.
Merivale Markets Quantix Risk Index by month
PeriodQuantix Risk Index
Feb ’2660.6
Mar ’2660.6
Apr ’2660.6
May ’2660.6
Jun ’2660.3
Jul ’2660.3
Aug ’2660.3
Sep ’2661.3
Oct ’2661.3

  1. 11 Sept 2026

    Research assessment

    Research assessment completed: Smart Contract Audit

    8 findings (3 high, 3 medium, 1 low, 1 informational). 2 critical or high findings remain open.

    Read the research assessment
    • Code Security+3
    • Transparency+1

  2. 2 Jun 2026

    Upgrade

    Router replaced

    Operator deployed a new router with AMM fallback routing.

    • Code Security−2
    • Economic Security+2

Risk factors

What keeps the score from being higher, most severe first.

  • HighCode SecurityFrom the research assessment

    2 open critical or high findings

    The research assessment reports 0 critical and 2 high findings still open or partially resolved. Code Security reflects this exposure until fixes are verified.

  • HighGovernance RiskProfile analysis

    Operator EOA controls the venue

    Theft or misuse of one key can change fees, list malicious markets or redirect routing.

  • MediumEconomic SecurityProfile analysis

    Thin fallback liquidity

    Remainder volume routes through shallow pools where price impact and manipulation are cheap.

Recommendations

Each recommendation raises one component to a target value. The score effect is recomputed with the Risk Index model, holding every other component fixed.

  • Governance Risk: 52 → 72

    Timelocked multisig for the operator role

    Replace the EOA with a multisig and a 48-hour delay on listings and fee changes.

    +3.0

    → 64.3

  • Economic Security: 66 → 76

    Minimum liquidity for fallback routes

    Skip pools below a depth threshold and cap price impact per route.

    +1.5

    → 62.8

Analysis

Contract, governance and operations

Contract analysis

Source
Verified
Upgradeability
Immutable core; router replaceable by operator
Administrative control
Single operator key (EOA)
Enforced delay
None identified
External dependencies
AMM pools used for fallback routing; Off-chain order relayer
  • PassSource verified. Order book and router verified.
  • FailOperator key. One EOA controls listings, fees and router replacement.
  • CautionExternal calls. Router forwards calls to pool addresses supplied in the route.
  • CautionFee bounds. Fees adjustable up to 25% on the MRV token.

Governance exposure

High

An externally owned operator key can change fees, list markets and replace the router without delay.

Operational resilience

Weak

Operational controls rely on the operator; no published incident procedure.

Monitoring

Monitoring history

3 recorded security events for Merivale Markets, most recent first.
Open in Security Monitoring
  1. 23 Oct 2026CriticalFlash-loan sized round trip through a GLF poolSuspicious Transaction Pattern · RouterOpen
  2. 26 Mar 2026HighFee operator transferred to an externally owned accountAccess Control · FeeControllerAcknowledged
  3. 18 Mar 2026MediumMarket listed by operator key without delayConfiguration Change · ListingManagerAcknowledged

Research assessment

QX-TSA-2026-010Smart Contract AuditUnder Review

Order book, matching router with AMM fallback, fee controller and listing manager. 2,104 nSLOC of Solidity on BNB Chain.

Review 17 Aug 2026 – 11 Sept 2026

Critical0
High3
Medium3
Low1
Informational1
  • 3 resolved
  • 2 partially resolved
  • 1 acknowledged
  • 2 open
Read the assessment

Continue with

Comparable protocols

Compare side by side

Research

Relevant research

Publications on the risks that matter most for a dex protocol.

Architecture

System components

OrderBook
Limit orders, cancellations and matching
Router
Matches against the book and routes remainder through pools
FeeController
Fee tiers and rebates
ListingManager
Market listings controlled by an operator key

Turn risk factors into a remediation plan.

A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.

Discuss Your Security RequirementsBack to the Security Explorer