Uniswap v4 Periphery and Universal Router Audit

OpenZeppelinFiles named in the report

Audit · firm’s term: audit

OpenZeppelin reviewed Uniswap (Uniswap v4 Periphery and Universal Router Audit) on 30 Aug 2024: 17 findings, 1 critical; 15 marked fixed, 1 acknowledged, 1 open.

1 critical finding, fixed
Open the reportOpen Uniswap’s security record

Report hosted on blog.openzeppelin.com.

Trustblock does not review code.

Findings17

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High001
Medium002
Low1111
CriticalAccrued Fees Can Be StolenFixed

The report gives no description here.

HighSlippage Checks Are Not Enforced When Fees Accrued Exceed Tokens Required for a Liquidity DepositFixed

The report gives no description here.

MediumSlippage Check Can Be Bypassed With Unsafe CastFixed

The report gives no description here.

MediumUniversal Router Does Not Forward Native Tokens to V4 Position ManagerFixed

The report gives no description here.

LowBurning a Position Notifies the Subscriber But Does Not Unsubscribe ThemFixed

The report gives no description here.

LowChecks-Effects-Interactions Pattern Not Followed for Unsubscribe LogicFixed

The report gives no description here.

LowDiscrepancies Between Interfaces and Implementation ContractsFixed

The report gives no description here.

LowERC-721 Permit Signatures Cannot Be RevokedFixed

The report gives no description here.

LowIncorrect Decoding of bytes[] params Calldata LengthFixed

The report gives no description here.

LowMisleading DocumentationFixed

The report gives no description here.

Show 5 more
LowPermit2 Signatures Could Be Front-Run to Temporarily Prevent ExecutionFixed

The report gives no description here.

LowShadowed State VariableFixed

The report gives no description here.

Lowtry-catch Block Can Still RevertFixed

The report gives no description here.

LowUnreachable Branch in _mapInputAmountFixed

The report gives no description here.

LowUnsafe ABI EncodingFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (37)

  • src/lens/StateView.sol
  • src/base/DeltaResolver.sol
  • src/interfaces/ISubscriber.sol
  • src/libraries/CalldataDecoder.sol
  • src/libraries/PoolTicksCounter.sol
  • src/libraries/Locker.sol
  • src/interfaces/IMulticall_v4.sol
  • src/interfaces/IPositionManager.sol
  • src/PositionManager.sol
  • src/base/hooks/BaseHook.sol
  • src/libraries/PathKey.sol
  • src/base/Multicall_v4.sol
  • src/base/ReentrancyLock.sol
  • src/interfaces/external/IERC20PermitAllowed.sol
  • src/interfaces/IEIP712_v4.sol
  • src/base/ERC721Permit_v4.sol
  • src/libraries/PositionConfig.sol
  • src/libraries/SlippageCheck.sol
  • src/V4Router.sol
  • src/base/ImmutableState.sol
  • src/libraries/SafeCast.sol
  • src/interfaces/IQuoter.sol
  • src/base/UnorderedNonce.sol
  • src/base/BaseActionsRouter.sol
  • src/interfaces/INotifier.sol
  • src/interfaces/IV4Router.sol
  • src/base/PoolInitializer.sol
  • src/libraries/BipsLibrary.sol
  • src/base/EIP712_v4.sol
  • src/base/SafeCallback.sol
  • src/base/Notifier.sol
  • src/interfaces/IERC721Permit_v4.sol
  • src/lens/Quoter.sol
  • src/libraries/ERC721PermitHash.sol
  • src/base/Permit2Forwarder.sol
  • src/libraries/Actions.sol
  • src/libraries/ActionConstants.sol

Part of Uniswap’s security record

Uniswap
Audits16 audits by 5 firmsLast audit Aug 2026, by Cantina.
Critical findingsNo open critical findingsAcross the 16 reports, 7 critical findings were reported. Each is marked fixed by the firm that reported it.
IncidentIncident 17 Apr 2020Source: De.Fi incident database.
Open Uniswap’s security record

Security firm

OpenZeppelin

67 projects reviewed · 184 reports · latest Aug 2026

See OpenZeppelin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us