Unizen / Unizen-Trade-Aggregator
Hacken reviewed Unizen (Unizen-Trade-Aggregator) on 27 Nov 2024: 35 findings, 1 critical; 18 marked fixed, 17 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings35
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 2 |
| Medium | 1 | 0 | 4 |
| Low | 16 | 0 | 11 |
CriticalMissing Validation of Permit User in _routerTransferTokens FunctionFixed
The report gives no description here.
HighLack of Access Control in LayerZero Configuration Functions Allows Unauthorized Alteration of Protocol SettingsFixed
The report gives no description here.
HighMissing Initialization for Critical Variables Results in Contract Non-FunctionalityFixed
The report gives no description here.
MediumIncorrect Parameter Usage and Ordering in setConfig and getConfig FunctionsFixed
The report gives no description here.
MediumLack of Call Success Check in Native Asset WithdrawalFixed
The report gives no description here.
MediumLack of Nonce or Order Tracking in GasLessExecutor Allows Replay Attacks by Authorized RelayersFixed
The report gives no description here.
MediumMissing isETHTrade Logic in swapSimple FunctionFixed
The report gives no description here.
LowBlocking Message Queue Handling in lzReceive May Halt Cross-Chain CommunicationFixed
The report gives no description here.
LowInconsistent DEX Whitelisting Management Allows Unauthorized Access to Removed DEX FunctionsFixed
The report gives no description here.
LowInconsistent User Address in lock Function Call for Cross-Chain DepositsFixed
The report gives no description here.
Show 8 more
LowLack of nonReentrant Protection in swapGasLessFixed
The report gives no description here.
LowLack of Pausing Mechanism in Critical Functions of UnizenRouterFixed
The report gives no description here.
LowLack of Verification Check in addOrRemoveFuncSign Allows Function Selectors for Unverified DEXesFixed
The report gives no description here.
LowNot Leveraging LzApp for LayerZero IntegrationFixed
The report gives no description here.
LowRedundant Use of SafeMath Leads to Unnecessary Gas Costs in Arithmetic OperationsFixed
The report gives no description here.
LowSuboptimal Order of Validations in GasLessExecutor Increases Unnecessary Gas ConsumptionFixed
The report gives no description here.
LowUnused WETH Address in BaseExecutorFixed
The report gives no description here.
LowUse of tx.origin for Access Control in GasLessExecutorFixed
The report gives no description here.
Contracts in scope2
| Address | Chain | Source code |
|---|---|---|
| 0xc52c326331e9ce41f04484d3b5e5648158028804 | Chain: Ethereum | Source code: Verified source |
| 0xdd75542611d57c4b6e68168b14c3591c539022ed | Chain: Polygon (POS) | Source code: Verified source |
Part of Unizen’s security record
UnizenSecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us