Haven1 - audit hSwap

CertiKFiles named in the report

Audit

CertiK reviewed Haven1 (Haven1 - audit hSwap) on 26 Feb 2025: 10 findings, 0 critical; 3 marked fixed, 7 open.

No open critical findings
Open the reportOpen Haven1’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High100
Medium100
Low503
LowH1 fee only charged once in `UniversalRouter` MulFixed

In the current implementation of `UniversalRouter`, the contract charges the fee once per transaction upon encountering the first swap command (V3_SWAP_EXACT_OUT or V3_SWAP_EXACT_IN), then exits the loop with break. This means if multiple swap commands are present in a single transaction , only the first swap will trigger a fee. Subsequent swaps in the same transaction will not pay additional fees. ```solidity=68 for (uint256 commandIndex = 0; commandIndex < numCommands; ) { bytes1 commandType = commands[commandIndex]; uint256 command = uint8(commandType & Commands.COMMAND_TYPE_MASK); if (command == Commands.V3_SWAP_EXACT_OUT || command == Commands.V3_SWAP_EXACT_IN) { _payH1Fee(); break; } unchecked { commandIndex++; } } ``` If the intended design is to collect only one fee per transaction, then the current logic is correct. If the contract should collect fees for each swap command, the logic should be adjusted.

LowPotential Storage Slot Collision in Upgradeable CFixed

The contract uses a custom storage slot for `H1NativeBaseStorage`. Using a custom storage slot is typically safe for non-upgradeable deployments, as it ensures the contract writes to a unique location unlikely to overlap with other storage variables. However, in an upgradeable proxy setup, future contract upgrades or modules may introduce new variables that use or overlap with this same slot. ```solidity bytes32 private constant H1NATIVE_STORAGE = 0x8e7ec97a86b55b46cf58cbcd08faba09d3e8d3aec4d6bf8802477f1aa7a4c700; ... function _getH1NativeStorage() private pure returns (H1NativeBaseStorage storage $) { assembly { $.slot := H1NATIVE_STORAGE } } ``` If the contract (or a child contract) is later upgraded and new variables or inherited contracts introduce different storage layouts, it could overwrite or corrupt the existing state stored in `H1NATIVE_STORAGE`. Such collisions may cause unpredictable behavior or loss of state.

LowUsage of Foundry's ConsoleFixed

The current contract code includes references to the `console` contract from Foundry. It is important to note that the `console` contract is exclusively intended for development and testing purposes, providing developers with debugging capabilities throughout the testing phase. ```solidity=61 function createPool( address tokenA, address tokenB, uint24 fee ) external override noDelegateCall returns (address pool) { console.log('createPool - 1'); require(tokenA != tokenB); console.log('createPool - 2'); (address token0, address token1) = tokenA < tokenB ? (tokenA, tokenB) : (tokenB, tokenA); console.log('createPool - 3'); require(token0 != address(0)); console.log('createPool - 4'); int24 tickSpacing = feeAmountTickSpacing[fee]; console.log('createPool - 5'); require(tickSpacing != 0); console.log('createPool - 6'); require(getPool[token0][token1][fee] == address(0)); console.log('createPool - 7'); pool = deploy(address(this), token0, token1, fee, tickSpacing); console.log('createPool - 8'); getPool[token0][token1][fee] = pool; console.log('createPool - 9'); // populate mapping in the reverse direction, deliberate choice to avoid the cost of comparing addresses getPool[token1][token0][fee] = pool; console.log('createPool - 10 pool: ', pool); emit PoolCreated(token0, token1, fee, tickSpacing, pool); } ``` While the `console` code may be commented out and thus inactive, its presence within the contract codebase can still negatively impact the overall tidiness and cleanliness of the contract. Comments intended for developers' understanding and debugging purposes should not be present in the final production-ready version of the smart contract.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (105)

  • v3-core/contracts/libraries/FixedPoint128.sol
  • v3-periphery/contracts/NonfungiblePositionManager.sol
  • universal-router/contracts/modules/PaymentsImmutables.sol
  • v3-periphery/contracts/lens/QuoterV2.sol
  • v3-core/contracts/UniswapV3Pool.sol
  • v3-core/contracts/interfaces/callback/IUniswapV3FlashCallback.sol
  • v3-periphery/contracts/base/LiquidityManagement.sol
  • v3-periphery/contracts/libraries/NFTSVG.sol
  • universal-router/contracts/UniversalRouter.sol
  • v3-periphery/contracts/libraries/TransferHelper.sol
  • v3-core/contracts/interfaces/callback/IUniswapV3SwapCallback.sol
  • universal-router/contracts/interfaces/IUniversalRouter.sol
  • v3-core/contracts/libraries/LowGasSafeMath.sol
  • v3-core/contracts/interfaces/pool/IUniswapV3PoolEvents.sol
  • v3-core/contracts/interfaces/IUniswapV3PoolDeployer.sol
  • universal-router/contracts/modules/uniswap/v2/V2SwapRouter.sol
  • v3-periphery/contracts/h1/H1FlashRouter.sol
  • v3-periphery/contracts/h1/base/H1NativeBaseV07Downgrade.sol
  • v3-core/contracts/UniswapV3Factory.sol
  • v3-periphery/contracts/libraries/Path.sol
  • v3-periphery/contracts/libraries/OracleLibrary.sol
  • universal-router/contracts/modules/Payments.sol
  • v3-core/contracts/interfaces/callback/IUniswapV3MintCallback.sol
  • v3-core/contracts/libraries/TickMath.sol
  • v3-core/contracts/interfaces/pool/IUniswapV3PoolActions.sol
  • v3-periphery/contracts/h1/interfaces/IFeeContractV07Downgrade.sol
  • v3-core/contracts/libraries/Position.sol
  • universal-router/contracts/base/Dispatcher.sol
  • v3-core/contracts/libraries/SafeCast.sol
  • universal-router/contracts/deploy/UnsupportedProtocol.sol
  • v3-periphery/contracts/SwapRouter.sol
  • v3-periphery/contracts/libraries/LiquidityAmounts.sol
  • v3-periphery/contracts/libraries/PoolAddress.sol
  • contracts/utils/UniswapV3Helper_WIP.sol
  • v3-core/contracts/libraries/BitMath.sol
  • v3-core/contracts/interfaces/IUniswapV3Pool.sol
  • v3-core/contracts/interfaces/pool/IUniswapV3PoolState.sol
  • v3-periphery/contracts/NonfungibleTokenPositionDescriptor.sol
  • v3-periphery/contracts/base/PeripheryValidation.sol
  • v3-periphery/contracts/libraries/ChainId.sol
  • v3-core/contracts/libraries/Tick.sol
  • v3-periphery/contracts/base/PoolInitializer.sol
  • v3-core/contracts/libraries/SqrtPriceMath.sol
  • universal-router/contracts/modules/uniswap/v3/V3Path.sol
  • universal-router/contracts/modules/h1-native-application/IFeeContract.sol
  • v3-periphery/contracts/libraries/BytesLib.sol
  • v3-periphery/contracts/lens/TickLens.sol
  • universal-router/contracts/interfaces/IRewardsCollector.sol
  • v3-periphery/contracts/libraries/NFTDescriptor.sol
  • universal-router/contracts/base/RouterImmutables.sol
  • v3-core/contracts/libraries/LiquidityMath.sol
  • universal-router/contracts/modules/h1-native-application/H1NativeApplication.sol
  • v3-periphery/contracts/base/PeripheryPaymentsWithFee.sol
  • v3-core/contracts/libraries/Oracle.sol
  • v3-core/contracts/libraries/TransferHelper.sol
  • v3-periphery/contracts/libraries/PositionKey.sol
  • v3-periphery/contracts/h1/H1Multicall.sol
  • v3-core/contracts/NoDelegateCall.sol
  • v3-core/contracts/libraries/FullMath.sol
  • v3-periphery/contracts/libraries/PoolTicksCounter.sol
  • v3-periphery/contracts/V3Migrator.sol
  • v3-core/contracts/interfaces/IERC20Minimal.sol
  • v3-periphery/contracts/libraries/SqrtPriceMathPartial.sol
  • v3-periphery/contracts/libraries/CallbackValidation.sol
  • universal-router/contracts/interfaces/external/IWETH9.sol
  • contracts/utils/OnChainRouting.sol
  • universal-router/contracts/modules/NFTImmutables.sol
  • v3-periphery/contracts/libraries/HexStrings.sol
  • v3-core/contracts/interfaces/pool/IUniswapV3PoolDerivedState.sol
  • v3-periphery/contracts/lens/UniswapInterfaceMulticall.sol
  • v3-periphery/contracts/h1/H1NativeApplicationV07Downgrade.sol
  • v3-core/contracts/UniswapV3PoolDeployer.sol
  • v3-core/contracts/libraries/SwapMath.sol
  • v3-periphery/contracts/libraries/TokenRatioSortOrder.sol
  • universal-router/contracts/modules/uniswap/v2/UniswapV2Library.sol
  • v3-periphery/contracts/h1/MockFeeContract.sol
  • contracts/utils/Address.sol
  • universal-router/contracts/modules/uniswap/UniswapImmutables.sol
  • universal-router/contracts/base/Callbacks.sol
  • v3-core/contracts/interfaces/pool/IUniswapV3PoolImmutables.sol
  • v3-periphery/contracts/h1/IH1FlashRouter.sol
  • v3-periphery/contracts/base/Multicall.sol
  • contracts/vendor/uniswapV3/libraries/v3-periphery/PoolAddress.sol
  • v3-core/contracts/libraries/UnsafeMath.sol
  • universal-router/contracts/interfaces/external/ICryptoPunksMarket.sol
  • universal-router/contracts/libraries/Commands.sol
  • v3-periphery/contracts/base/BlockTimestamp.sol
  • contracts/vendor/uniswapV3/libraries/base64.sol
  • v3-periphery/contracts/base/SelfPermit.sol
  • v3-core/contracts/libraries/TickBitmap.sol
  • v3-core/contracts/libraries/FixedPoint96.sol
  • v3-core/contracts/interfaces/IUniswapV3Factory.sol
  • v3-periphery/contracts/base/PeripheryImmutableState.sol
  • universal-router/contracts/modules/uniswap/v3/BytesLib.sol
  • universal-router/contracts/modules/Permit2Payments.sol
  • universal-router/contracts/modules/uniswap/v3/V3SwapRouter.sol
  • v3-periphery/contracts/base/ERC721Permit.sol
  • v3-periphery/contracts/base/PeripheryPayments.sol
  • universal-router/contracts/base/LockAndMsgSender.sol
  • v3-periphery/contracts/lens/Quoter.sol
  • universal-router/contracts/base/RewardsCollector.sol
  • universal-router/contracts/libraries/Constants.sol
  • universal-router/contracts/modules/h1-native-application/H1NativeBase.sol
  • v3-periphery/contracts/libraries/PositionValue.sol
  • v3-core/contracts/interfaces/pool/IUniswapV3PoolOwnerActions.sol

Part of Haven1’s security record

Haven1
Audits2 audits by 1 firmLast audit Mar 2025, by CertiK.
Critical findingsNo open critical findingsAcross the 2 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Haven1’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us