multidex.ai Code and data in canisters
The order books, market maker and margin accounts live in replicated smart-contract memory. An asset canister delivers the website to your browser.
§ Spotlight · MULTI/DEX
The whole exchange,
native and verifiable.
MULTI/DEX brings swaps, order-book trading and margin to an app written by AI agents. Its engine and interface run on the Internet Computer. You can try the open-source exchange today with play assets.
What it is
The exchange runs on ICP.
Canisters run the matching engine, manage balances and serve the interface. The price oracle fetches data from external markets through the network.
Written by AI agents
AI agents wrote the application, including its Motoko trading engine and documentation. A built-in assistant lets you ask about your account and request trades in plain language.
Open for community testing
Anyone can inspect or fork the source. Multidex plans to put production upgrades under the Network Nervous System (NNS), ICP’s governance system, through public proposals and votes.
Today · play mode
Every balance is play money. Real-asset custody has not been built, and the move to NNS governance is still planned.
The product
Trading with MULTI/DEX.
Swap tokens, place limit orders or manage margin positions. The same account gives you access to Earn and an AI assistant.
Swap & markets
Swap tokens or set your price.
In Swap, choose what to sell and buy, then set the maximum price slippage you will accept. Use Markets to place a limit order at your chosen price, inspect the order book or follow recent trades.
The play versions of BTC, ETH, SOL and ICP trade against ICPUSD, the exchange’s dollar-denominated quote asset. Swapping BTC for ICP, for example, passes through both assets’ ICPUSD order books.
Order controls and minimums
Market orders fill within your slippage limit and return any unfilled amount. Limit orders can stay on the book until filled, cancelled or expired. The minimum is 10 ICPUSD, unless you spend your entire remaining balance. If an order would trade against your own resting order, the exchange cancels the resting order.
Margin
Keep each pool’s risk separate.
You choose how much to transfer from your wallet into a margin pool. Each pool holds its own collateral, positions and debt. Losses stay within that pool, leaving your wallet and other pools untouched.
Borrowed longs use ICPUSD to buy an asset; shorts borrow the asset and sell it. Interest applies only to the borrowed amount. A purchase covered by the pool’s cash has no borrowing cost. Leverage increases losses as well as gains.
Your walletFunds you have not committed
You choose what to transfer
Collateral, positions, debtSeveral positions share one cushion. A winner can carry a loser.
Collateral, positions, debtA single position, fenced on its own. You can run several of each.
Each pool is its own account at the protocol level, so a loss stops at the pool wall. Conceptual view; balances are simulated in play mode.
How pool health controls liquidation
Pool health is collateral value, adjusted for each asset’s loan-to-value weight, divided by debt. Opening or increasing a position requires health of at least 1.25. Below 1.15, the protocol partially liquidates the position to target 1.25 again. A 5% liquidation penalty goes to the insurance fund.
Earn
Fund the market maker or its insurance pool.
Earn lets you deposit into the AMM vault or stake in the insurance fund. Both expose your stake to losses; the income comes from different sources.
AMM vault
The automated market maker (AMM) trades using the vault’s inventory. Depositors share its profit and loss, including trading spreads, half the exchange’s trading fees and interest from margin lending.
Asset prices and unpaid margin debt can reduce your stake.
Insurance fund
The fund covers losses when a liquidated margin pool cannot repay its debt. Stakers receive a share of liquidation penalties and absorb these losses before the AMM vault does.
Covering unpaid debt can reduce your stake.
Why a vault withdrawal can be less than its displayed value
The displayed value includes outstanding loans. Withdrawals pay out available assets only, leaving the claim on those loans with the remaining depositors. At the lending cap, the payout can be about half the displayed value. The Earn card shows the adjusted figure. A separate 0.4% withdrawal fee stays in the vault.
Profit and loss are measured against what you deposited. Deposits are limited by vault conditions and blocked while prices are stale or a price jump awaits confirmation.
AI & automation
Use the exchange through your AI chat.
Ask the built-in assistant about your positions, or connect ChatGPT, Claude or another AI app through MCP. An external assistant needs write permission to place orders on your behalf.
You can also query exchange data in the Memory Explorer and export history for your own analysis. Live account queries are scoped to your identity; the permanent record of money movements is public.
“How much is my account worth?”
Your AI chatYour identityExchange data
Read access and permission to act are separate. MCP grants expire; the built-in assistant presents trade actions for confirmation.
Fees, levels & badges
Trading activity sets your fee level.
Levels use a rolling 30-day score, with maker volume counting twice as much as taker volume. Higher levels reduce fees and can improve access under load; L4 also requires regular two-sided quotes. Levels can fall as activity drops. Badges record lifetime milestones and have no effect on fees or priority.
Why this matters
Inspect the rules your trades follow.
Multidex publishes its code, matching rules and balance history. You can inspect how it handles orders and check the record of what happened.
Application hosting
The network runs the engine and serves the interface. Certified responses let your browser check that the website’s files match those stored in the asset canister.
Order priority
Pending orders stay hidden from other traders until the matching pass releases them. Earned access rank determines release order, with earlier arrivals going first within each rank.
Public records
Anyone can read the source and replay the ledger’s balance changes. Hash links and network certificates let you check that the downloaded records match the certified history.
Code upgrades
The production plan would require public NNS proposals and votes for upgrades, with no developer retaining an upgrade key. That governance model is planned for after play-mode evaluation.
How it works
How the exchange works.
Your browser connects to the exchange’s canisters. They manage the order books and balances, while other canisters serve the interface and store permanent history.
From order to trade.
When you place an order, the exchange reserves the funds it needs and holds the order out of view of other traders. Roughly once a second, the matching engine releases queued orders by earned access rank, then arrival time within each rank. On an order’s first release pass, resting user offers get the opportunity to fill it; the protocol’s AMM is not available to that order.
If an offer meets your terms, the trade fills and your balances change. An unfilled limit order can remain on the book until it fills, expires or is cancelled. An unfilled market-order amount is returned.
- You place itFunds reservedHeld out of view of other traders
- About a secondRelease passEarned rank first, then arrival time
- It resolvesFills, rests, or returnsResting user offers fill it before the AMM
Nothing is visible between placing and release, so there is no pending order for anyone to trade ahead of.
Prices come from public markets.
A price oracle fetches data from multiple public sources through HTTPS calls validated by ICP’s nodes. It filters outliers to produce a reference price. The AMM places buy offers below that price and sell offers above it, adjusting quotes as inventory changes. Margin valuations and liquidation checks use the same reference.
In play mode, an arbitrage canister simulates trading between exchanges to bring prices closer to the reference. It follows the same order queue and pays trading fees. If the oracle becomes stale, the AMM stops quoting and user-to-user fills are limited to within 2% of the last reference price.
CoinbaseKrakenOKXKuCoinCryptoCompareCoinGecko
Median, discard anything beyond two standard deviations, median of the rest
Reference priceCentres the AMM, marks collateral, triggers liquidationsCounts as stale after 45 seconds
The canister fetches the sources itself, so there is no price bot and no account with permission to move the mark.
Trading fees fund the exchange.
Half of each collected trading fee goes to the AMM vault and its depositors. The other half goes to the treasury, which is designed to fund the exchange’s compute and storage in cycles. You do not need gas tokens for each action.
The design also calls for burning surplus ICP once operating reserves reach their target.
Every balance change leaves a record.
Trades, deposits, withdrawals and liquidations go into a public ledger. Each entry links to the one before it through a hash, so changing an old entry breaks the chain. Network certificates let you check the records against the archive’s certified history.
Open Ledger to verify the chain in your browser, or use the repository’s standalone verifier to reconstruct balances. These records identify accounts and remain public, even though live queries restrict access to your balances and positions.
Before real-asset trading.
MULTI/DEX still uses play assets. Real-asset custody has not been built, so the ledger can verify recorded balances but cannot yet prove that real reserves cover them. The planned custody component would use ICP’s chain-key cryptography for native-chain deposits and withdrawals.
The production plan also puts upgrades under NNS governance. A public proposal would identify the exact code for a vote. If adopted, production upgrades would require NNS approval, with no developer retaining an upgrade key.
Getting started
Try the exchange with play assets.
The public test is open. You can trade, report bugs or submit a working version of an improvement.
- 01
Sign in
Use Internet Identity with a linked Google account during play mode. The anonymized Google link helps keep the competition to one account per player.
- 02
Collect dummy crypto
Claim the play allowance to register your account. These balances have no real value. Never send real assets to the displayed addresses.
- 03
Trade and take part
Try Swap or Markets. The leaderboard compares your performance with what you would have earned by holding your deposits. DFINITY reviews results for fair play before awarding prizes.
Try MULTI/DEX Play mode · no real deposits
Report a bug or propose a change.
Send a reproducible bug report, or fork the source and share a deployed improvement. Rewards are at DFINITY’s discretion; there is no standing bug-bounty programme. Using exploits to inflate trading results disqualifies prize eligibility.
multidex@dfinity.org ↗Continue with the official guidesExplore the source code ↗