Security & Risk Management - Multiliquid Protocol

Security Overview

The Multiliquid Protocol is built with institutional-grade security as a core requirement. Every contract, function, and integration point has been designed with security-first principles, incorporating multiple layers of protection, comprehensive access controls, and battle-tested frameworks. See our audits here.

Smart Contract Security

OpenZeppelin frameworks and secure coding practices

Access Control

Multi-tiered role-based permission model

Risk Management

Asset-specific controls and volume limits

Emergency Response

Pause capabilities and incident response

Smart Contract Security

Industry-Standard Frameworks

The protocol uses audited, production-tested libraries: OpenZeppelin Upgradeable Contracts

Usage: Access control, proxy patterns, reentrancy protection, safe external operations
Security: Industry-standard, extensively audited by multiple firms
Key Modules:
- AccessControlUpgradeable: Role-based permissions
- UUPSUpgradeable: Secure upgrade mechanism
- ReentrancyGuardUpgradeable: Reentrancy attack prevention
- PausableUpgradeable: Emergency pause functionality

Solady

Usage: Gas-optimized mathematical operations
Security: Extensively tested, overflow-safe operations
Key Module: FixedPointMathLib for WAD/RAY mathematics

Core Security Mechanisms

1. Reentrancy Protection

The unified swap() entrypoint, stablecoin settlement methods, and stateful RWA checks use reentrancy guards. Requested legs, derived liquidity operations, and delegate state changes revert atomically if settlement fails.

2. SafeERC20 Operations

Stablecoin delegates use OpenZeppelin’s SafeERC20 library for ERC20 transfers:

Handles non-standard ERC20 implementations
Reverts on failed transfers (even if token returns false)
Protects against tokens with unusual return values

using SafeERC20 for IERC20;

// Safe transfer with automatic revert on failure
IERC20(rwaToken).safeTransferFrom(user, custody, amount);

3. Integer Overflow Protection

Solidity 0.8.30: Built-in overflow/underflow protection
Checked Arithmetic: All operations automatically revert on overflow
WAD Mathematics: Consistent 18-decimal precision with explicit conservative rounding

4. Input Validation

Swap execution validates inputs before settlement:

Asset IDs must correspond to accepted assets
Amounts must be non-zero
Addresses must be non-zero

Upgrade Safety

UUPS Proxy Pattern

The protocol uses the Universal Upgradeable Proxy Standard (UUPS): Security Advantages:

Upgrade logic lives in implementation (not proxy)
Smaller proxy contract reduces attack surface
Explicit authorization required for upgrades
Event emission for all upgrades

Upgrade Authorization:

function _authorizeUpgrade(address newImplementation)
    internal
    override
    onlyRole(DEFAULT_ADMIN_ROLE)
{
    // Only DEFAULT_ADMIN_ROLE (typically multi-sig) can upgrade
}

Storage Layout Protection

Storage Gaps: All upgradeable contracts include __gap arrays
Layout Verification: Automated tools verify storage compatibility
Initialization Guards: initializer modifier prevents re-initialization

Access Control System

The protocol implements a sophisticated multi-tier permission model using OpenZeppelin’s AccessControl:

Global Roles

DEFAULT_ADMIN_ROLE

Permissions:

Authorize UUPS upgrades on contracts where the role is held
Administer roles according to each contract’s configured role hierarchy
Configure the protocol fee vault on MultiliquidSwap

Security Considerations:

Should never be held by EOA (Externally Owned Account)
Requires multi-party consensus for all operations

OPERATOR_ROLE

Permissions:

Accept new RWAs and stablecoins
Update price adapters
Configure protocol fee policy and stablecoin guardrails
Manage operational parameters and swap batch limits

Security Considerations:

Should never be held by EOA (Externally Owned Account)
Requires multi-party consensus for all operations

Restrictions:

Cannot upgrade contracts
Cannot directly transfer user funds

PAUSE_ROLE

Permissions:

Pause and unpause stablecoin and RWA delegate contracts through the Multiliquid pause path

Intended Holder: Security operations team Use Cases:

Smart contract vulnerability discovered
Suspicious trading activity detected
Oracle manipulation detected
Regulatory requirement

On MultiliquidSwap itself, OPERATOR_ROLE can pause and unpause. EXTERNAL_PAUSER_ROLE can pause but cannot unpause.

Asset-Specific Roles

Liquidity Provider Admin

Each stablecoin delegate has an independent Liquidity Provider admin role: Permissions:

Set RWA discount rates for their stablecoin
Set RWA redemption fees for their stablecoin
Add/remove RWAs from their whitelist
Pause their specific delegate
Configure custody addresses

Security Boundary:

Cannot affect other stablecoins
Cannot modify core protocol logic
Cannot access other Liquidity Providers’ funds

Example:

stablecoinDelegate.setRWADiscountRate(rwaID, 1e16); // 1% discount

RWA Admin

Each RWA delegate (when deployed) has an independent RWA admin role: Permissions:

Configure volume limits
Adjust risk parameters
Pause their specific delegate

Security Boundary:

Cannot affect other RWAs
Cannot modify core protocol logic
Cannot override Liquidity Provider controls

Permission Hierarchy

Risk Management Controls

Volume Limits

RWA delegates can implement daily volume limits to prevent:

Market manipulation through large swaps
Sudden liquidity drains
Compliance violations

Implementation Example (ULTRA):

Daily Limit: One RWA-admin-configured limit applied independently to each address
Reset Time: 2pm Singapore Time (UTC+8)
Tracking: Cumulative inflow and outflow volume in fixed daily windows
Enforcement: Automatic rejection when limit exceeded

Whitelist Management

Per-Stablecoin RWA Whitelisting:

Each Liquidity Provider controls which RWAs they accept
Granular risk management per Liquidity Provider
Prevents unwanted asset exposure

Whitelist Modification:

Only the Liquidity Provider admin can modify their whitelist
Events emitted for transparency
Takes effect immediately

Benefits:

Liquidity Providers maintain control over their risk profile
Flexible onboarding without protocol-wide impact
Compliance alignment with Liquidity Provider policies

Slippage Protection

ExactIn swaps specify an exact input and minimum acceptable output. ExactOut swaps specify an exact output and maximum acceptable input. If the calculated amount violates the slippage bounds, the transaction reverts atomically.

Rate Validation

LP-configured discounts, redemption fees, and stablecoin acceptance or redemption fees must remain below 100% WAD. Protocol LP-paid and spread-take rates cannot exceed 100%.

Emergency Mechanisms

Pause Functionality

The protocol implements multi-level pause capabilities:

Global Pause (MultiliquidSwap)

Trigger: OPERATOR_ROLE or the pause-only EXTERNAL_PAUSER_ROLE calls pause() Effects:

All swap functions revert
Price queries still available
Administrative functions still accessible

Use Cases:

Critical vulnerability discovered
Oracle manipulation detected
Regulatory requirement
Smart contract upgrade preparation

Delegate-Level Pause

Stablecoin Delegate Pause:

Triggered by the Liquidity Provider admin or PAUSE_ROLE
Affects only swaps involving that stablecoin delegate
Other stablecoin delegates remain operational

RWA Delegate Pause:

Triggered by the RWA admin or PAUSE_ROLE
Affects only swaps involving that RWA
Other RWAs remain operational

Unpause Requirements

Unpausing requires:

Root cause analysis completed
Fix implemented and tested (if applicable)
Security review of changes
Explicit unpause transaction by authorized role

Audit and Review Process

Pre-Deployment Security

Security validation includes:

Extensive Internal Code Review and Testing
- Unit, fuzz, invariant, mutation, and fork testing
- Security-focused checklist validation
- Gas optimization review
- Slither static analysis
Testnet Deployment
- Full system deployment on testnet
- Integration testing with real user flows
- Stress testing with edge cases
- Multi-day operational validation
Independent Security Review
- Completed reviews listed on the Multiliquid Cantina profile
Final Verification and Deployment
- Mainnet deployment scripts used
- Role assignments reviewed and documented

Post-Deployment Monitoring

Continuous monitoring includes:

Event Indexing: All contract events logged and analyzed
Transaction Monitoring: Unusual patterns detected
Price Oracle Monitoring: Deviation alerts for price feeds

Incident Response

In the event of a security incident:

Detection: Monitoring systems alert security team
Assessment: Rapid evaluation of severity and impact
Pause (if necessary): Immediate pause of affected components
Communication: Transparent disclosure to stakeholders
Remediation: Fix development and testing
Deployment: Upgrade execution by the authorized role
Post-Mortem: Detailed report and process improvement

Operational Security Best Practices

For institutions integrating with the protocol:

Key Management

Use Hardware Wallets: For all signing operations
Multi-Sig Wallets: Minimum 2-of-3 for operational roles
Geographic Distribution: Key holders in different locations
Regular Rotation: Periodic key refresh schedule

Transaction Security

Simulation: Use transaction simulation before signing
Verification: Double-check recipient addresses and amounts
Gas Limits: Set reasonable limits to prevent griefing
Nonce Management: Track nonces to prevent replay attacks

Known Limitations and Assumptions

Token Compatibility

The protocol assumes:

Tokens do not implement transfer fees or rebasing
Tokens do not have transfer requirements that break atomicity
Tokens follow standard ERC20 behavior
Price oracles remain available and accurate

If integrating a token with non-standard behavior, additional analysis and potentially custom delegate development is required.

Security Contacts

For security vulnerabilities or concerns:

DO NOT disclose security vulnerabilities publicly. Contact the Multiliquid team directly through secure channels.

Website: https://www.multiliquid.xyz/
Public Repository: https://github.com/uniformlabs/Multiliquid

This security documentation is a living document and will be updated as the protocol evolves, new security measures are implemented, and audit results become available.

Next: MultiliquidSwap Contract

Explore the central orchestrator contract managing all swap operations

​Security Overview

Smart Contract Security

Access Control

Risk Management

Emergency Response

​Smart Contract Security

​Industry-Standard Frameworks

​Core Security Mechanisms

​1. Reentrancy Protection

​2. SafeERC20 Operations

​3. Integer Overflow Protection

​4. Input Validation

​Upgrade Safety

​UUPS Proxy Pattern

​Storage Layout Protection

​Access Control System

​Global Roles

​DEFAULT_ADMIN_ROLE

​OPERATOR_ROLE

​PAUSE_ROLE

​Asset-Specific Roles

​Liquidity Provider Admin

​RWA Admin

​Permission Hierarchy

​Risk Management Controls

​Volume Limits

​Whitelist Management

​Slippage Protection

​Rate Validation

​Emergency Mechanisms

​Pause Functionality

​Global Pause (MultiliquidSwap)

​Delegate-Level Pause

​Unpause Requirements

​Audit and Review Process

​Pre-Deployment Security

​Post-Deployment Monitoring

​Incident Response

​Operational Security Best Practices

​Key Management

​Transaction Security

​Known Limitations and Assumptions

​Token Compatibility

​Security Contacts

Next: MultiliquidSwap Contract

Security Overview

Smart Contract Security

Industry-Standard Frameworks

Core Security Mechanisms

1. Reentrancy Protection

2. SafeERC20 Operations

3. Integer Overflow Protection

4. Input Validation

Upgrade Safety

UUPS Proxy Pattern

Storage Layout Protection

Access Control System

Global Roles

DEFAULT_ADMIN_ROLE

OPERATOR_ROLE

PAUSE_ROLE

Asset-Specific Roles

Liquidity Provider Admin

RWA Admin

Permission Hierarchy

Risk Management Controls

Volume Limits

Whitelist Management

Slippage Protection

Rate Validation

Emergency Mechanisms

Pause Functionality

Global Pause (MultiliquidSwap)

Delegate-Level Pause

Unpause Requirements

Audit and Review Process

Pre-Deployment Security

Post-Deployment Monitoring

Incident Response

Operational Security Best Practices

Key Management

Transaction Security

Known Limitations and Assumptions

Token Compatibility

Security Contacts