CoreXus DEX Developer Documentation
Chain Information
Chain ID
1943
RPC Endpoint
wss://corexusdex.com/rpc
Substrate JSON-RPC over WebSocket behind a method allowlist: chain and state reads, storage subscriptions, fee estimation, and author_submitAndWatchExtrinsic for already-signed extrinsics. Rate-limited per connection.
Explorer
explorer.vitreus.ioPublic APIs
All endpoints are unauthenticated and CORS-enabled, and none is rate-limited.
https://corexusdex.com/api/vtrs-usdUSD per VTRS from the VTRS/USDC pool's reserves on Vitreus, at the finalized block — the pool found by asset id, never by symbol, and the only price source this site has. A price is published only from mainnet. The site currently reads a devnet: there vtrsUsd is null with reason: "test_network" (status 200), because a pool we seeded on a test chain is not a market. Its ratio is under poolRate for anyone who wants the test figure, labelled as such. On mainnet the endpoint responds 503 with vtrsUsd: null and a reason when there is no DEX or no such pool; nothing is estimated and no third-party price is consulted. network names the chain the figures were read on, by genesis hash. change24h is null unless the market has a price at both ends of the window.
curl https://corexusdex.com/api/vtrs-usdResponse shape (illustrative — values are placeholders, not sample data):
{
"symbol": "VTRS",
"quote": "USD",
"vtrsUsd": <number> | null, // USD per VTRS; mainnet only
"reason": null | "test_network" | "no_dex" | "no_pool"
| "usdc_unconfigured" | "pool_read_failed",
"change24h": <number> | null, // fraction over 24h, e.g. 0.012 = +1.2%
"network": {
"key": "mainnet" | "testnet" | "devnet" | null, // null: unknown chain
"label": "Mainnet" | "Testnet" | "Devnet" | null,
"genesis": "<0x… genesis hash>",
"isTestNetwork": <boolean> // true unless mainnet; unknown counts as test
},
"poolRate": null | { // test networks only: NOT a market price
"usd": <number> | null,
"change24h": <number> | null,
"note": "<why this is not a price>"
},
"source": {
"kind": "pool",
"pool": "native-<usdc asset id>", // the pool the reserves were read from
"base": "native",
"quoteAsset": "<usdc asset id>"
},
"finalized": <number>, // block the reserves were read at
"generatedAt": <ms since epoch>
}Embeddable Widgets
Drop these into any website to show live Vitreus data.
Price Widget
Displays live VTRS price with 24h change, from mainnet only; on a test network it shows “no market price” and no number. Two lines of HTML, zero dependencies.
<script src="https://corexusdex.com/widget.js"></script>
<div id="vtrs-widget"></div>DEX Pallet Reference
Every call, storage item, event and error of pallet-vitreus-dex, read from the runtime metadata of the node this page is connected to. Signatures cannot go stale; the explanations are maintained by hand.
Asset arguments are Native for VTRS or WithId(u128) for a pallet-assets id. Amounts are base units (VTRS has 18 decimals).
Reading the DEX pallet reference from the runtime…
Launchpad
Bonding-curve token launches: pallet-launchpad. Every figure below is read from the runtime when this page loads.
Reading the launchpad reference from the runtime…
Launch Treasury
Validator-backed treasuries for launch tokens: pallet-launch-treasury. A share of every trade is staked, the yield buys the token back, the buyback is burned. Every figure below is read from the runtime when this page loads.
Reading the treasury reference from the runtime…
Security
Internal security review — April 2026
In April 2026 the maintainers ran an AI-assisted internal review of pallet-vitreus-dex. It is not an independent third-party audit. It identified and resolved 12 findings — 1 Critical, 4 High, 4 Medium, 3 Low — against a pallet with 11 unit tests. Two more were recorded in September: Finding 13 (Critical, fixed — pool accounts collided on 20-byte account ids) and Finding 14 (Low, fixed — a first routed fee below the existential deposit could not create its recipient). Fourteen from this document, sixteen failure modes in the launchpad's design spec and eleven from the September review make 41 findings on record, all addressed; two things are stated as open rather than fixed — a donation arriving before a pool's first routed fee strands the withheld existential deposit, and four Informational notes in the review.
1
Critical
4
High
4
Medium
3
Low
Key fixes: first depositor attack prevention (MINIMUM_LIQUIDITY), pair canonicalization, reserve syncing, fee separation, optimal deposit calculation, slippage enforcement.
On 2026-09-17 an adversarial review of all three pallets — pallet-vitreus-dex, pallet-launchpad and pallet-launch-treasury — read them against energy-generation, the energy broker, balances and assets, starting from what the eight bugs found since April had in common: every one lived where a value crosses a pallet boundary and changes meaning. Eleven findings (2 High, 4 Medium, 5 Low), each with a red test; nine fixed and enacted as runtimes 222 and 223, one (R11: the R9 fix also refused a holder selling their whole token position) fixed in 224, and Finding 14 fixed since. The same pass added a property-based fuzz harness that runs arbitrary call sequences against every invariant after every step; it reproduced Finding 14 and found two of the eleven — and missed R11, through an allowlist arm too wide, since narrowed. The review is pallets/REVIEW_2026-09-17.md in the pallet repository.
As of 2026-09-22, cargo test reports 108 tests in pallet-vitreus-dex, 44 in pallet-launchpad and 40 in pallet-launch-treasury (the fuzz harness among them). All three compile into the full runtime. None of this is an independent audit; treat the system as testnet-stage.
Security Contact
Report vulnerabilities to security@vitreus.io. We operate a responsible disclosure policy.
Changelog
- Swap interface (UI only; on-chain execution landed in September)
- Pool creation form (UI only; removed in September — create_pool is a governance call)
- Pool detail pages: reserves, fee tier, price from reserves, LP composition — read from chain
- Analytics: DEX-wide TVL, 100-block volume, top pools and tokens — read from chain
- Token Explorer: every registered asset with its headline price from the deepest pool
- Solver solvers table and per-solver detail pages — read from chain
- pallet-vitreus-dex internal security review — 14 findings resolved
- Developer documentation, public VTRS price API and embeddable price widget
- Swaps execute on chain: signed by a Substrate wallet extension (Ethereum-type account), tracked through InBlock and Finalized
- Public RPC at wss://corexusdex.com/rpc behind a method allowlist
- Token launchpad (pallet-launchpad, index 57): live launch board at /launch, creation at /launch/new, per-launch curve pages with buy / sell
- Landing page, ticker and every list page read live chain data; routes with nothing on chain behind them were taken offline
- Removed the ERC-20 token wizard — it generated Solidity for a chain that cannot deploy it
- Removed the pool-creation wizard and its advisor endpoint — create_pool is Root-gated on chain, so no user could have submitted it; add_liquidity (permissionless) has no UI yet and the pool pages say so
- Removed the EVM wallet connector (MetaMask): every transaction the site sends is signed by the Substrate extension, so the navbar now connects that one wallet
- Removed eight placeholder routes (activity, bridge, compare, governance, leaderboard, liquidity, portfolio, stake) that had nothing behind them
- Removed /api/lens, an unauthenticated proxy to the Lens backend that no page called; Vitreus Lens is linked directly instead
- A graduated launch trades on its own page: the swap panel from /swap sits where the curve panel was, pinned to the pool the graduation seeded; /swap takes ?in=&out= by asset id and pool pages link to their pair
- One page per launch token: /tokens/<asset id> redirects to the launch page (after confirming the launch records that asset), which now shows the pool, headline price, volume and recent activity
- Fixed swap volume and swap activity, which were only ever counted for VTRS: event asset ids came out of the node as numbers or hex and were compared against decimal strings, so no registered asset matched
- Token directory groups by provenance — chain assets, launches, hand-registered — decided from the id and chain storage, never from metadata; the explainer points at the live case of two tokens sharing a symbol. Analytics' USD reference is pinned by asset id (VITREUS_USDC_ASSET_ID) instead of found by symbol, which a 1-VTRS launch could hijack
- Pool pages add and remove liquidity (add_liquidity / remove_liquidity, open to anyone). Every position shows its own lock: a graduated launch's escrow seed is locked forever and is named as such; liquidity anyone adds afterwards is unlocked and withdrawable. lock_liquidity deliberately has no UI
- Event indexer: a finalized event log with explicit gaps and an alarm replaces every per-request block scan. Volume, trades, fees routed and activity are 24h figures from the log; price charts are one series per token across graduation; when the indexer is down the pages say so instead of showing a ten-minute window as data
- Solver marketplace pages are labelled read-only and say why: intents are not submitted from the site until a solver runs against the chain. /solvers lists every intent with its assets by id and any commitment; analytics names the asset its USD figures are pinned to
- Search (⌘K) lists the tokens and pools that exist on chain instead of a fixed list; fixed /swap mis-addressing launchpad assets (ids above 2^53 were rounded)
- Per-pool fee routing (D4, runtime 219): every swap on a native-quoted pool routes protocol and creator slices, snapshotted per pool; pool accounts re-derived by hash after a collision on 20-byte accounts (D8, Finding 13, runtime 220)
- pallet-launch-treasury (index 59, runtime 221): a slice of every launch token trade on both legs is staked with validators as one pooled cooperator, the LNRG yield is sold to the energy broker and burns the token back on its own venue; dormant launches retire and their principal is burned into the venue. /treasury is the pitch with live figures; the launch page carries the treasury card; the site's indexer runs the keeper
- A table of every shape the frontend assumes about the chain, checked against the runtime's metadata at every connect, after three client-side mirrors drifted silently in a week
- Adversarial review of the three pallets (2026-09-17): eleven findings, all fixed red→green (runtimes 222, 223 and 224); a proptest fuzz harness over arbitrary call sequences with every invariant checked after every step
- Creator record beside every creator address; a Telegram launch feed on the indexer (off until a channel exists); Launch in the phone's bottom bar; devnet lines on Markets, Swap and the pool pages