Uniswap TWAP Auction audit
ABDK Consulting reviewed Uniswap (Uniswap TWAP Auction audit) on 14 Nov 2025: 81 findings, 0 critical; 22 marked fixed, 59 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings81
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 12 | 6 |
| Low | 0 | 47 | 14 |
MediumClearing free memory is redundant, as Solidity tolerates garbage in free memory.Acknowledged
The report gives no description here.
MediumIt is unclear why amount has to be scaled, as token amounts usually already have decimals.Acknowledged
The report gives no description here.
MediumSuboptimal in IDistributionContract.solAcknowledged
The report gives no description here.
MediumSuboptimal in IDistributionContract.solAcknowledged
The report gives no description here.
MediumSuch a complicated logic is a result of using multiple number formats and a hybrid fixed-point format, where the denominator is 2^96 * 10^7, i.e.Acknowledged
The report gives no description here.
MediumThe length of “data” is ignored, so memory outside of “data” could be read here.Acknowledged
The report gives no description here.
MediumThe name is confusing, as it gives no clue this value is per block.Acknowledged
The report gives no description here.
MediumThe original error message from the failed transfer is dropped here.Acknowledged
The report gives no description here.
MediumThese loops don’t scale and could exceed the block gas limit.Acknowledged
The report gives no description here.
MediumThis check doesn’t allow receiving tokens in several separate transfers.Acknowledged
The report gives no description here.
Show 10 more
MediumThis read the data back from the deployed contract just to validate it.Acknowledged
The report gives no description here.
MediumWrapping token as a currency is inefficient (due to zero address check in transfer) and also is not strictly correct, as zero token address will be interpreted as plain ether.Acknowledged
The report gives no description here.
LowBad datatype in Auction.solAcknowledged
The report gives no description here.
LowBad datatype in AuctionFactory.solAcknowledged
The report gives no description here.
LowBad datatype in AuctionFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IAuction.solAcknowledged
The report gives no description here.
LowBad datatype in IAuction.solAcknowledged
The report gives no description here.
LowBad datatype in IAuctionFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IAuctionFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IAuctionFactory.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in IAuctionFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IAuctionStepStorage.solAcknowledged
The report gives no description here.
LowBad datatype in IDistributionContract.solAcknowledged
The report gives no description here.
LowBad datatype in IDistributionStrategy.solAcknowledged
The report gives no description here.
LowBad datatype in IDistributionStrategy.solAcknowledged
The report gives no description here.
LowBad datatype in IDistributionStrategy.solAcknowledged
The report gives no description here.
LowBad datatype in IDistributionStrategy.solAcknowledged
The report gives no description here.
LowBad datatype in IDistributionStrategy.solAcknowledged
The report gives no description here.
LowBad datatype in TokenCurrencyStorage.solAcknowledged
The report gives no description here.
LowBad datatype in TokenCurrencyStorage.solAcknowledged
The report gives no description here.
Show 10 more
LowBad naming in IAuction.solAcknowledged
The report gives no description here.
LowBad naming in IAuctionFactory.solAcknowledged
The report gives no description here.
LowBad naming in IAuctionStepStorage.solAcknowledged
The report gives no description here.
LowBad naming in ITokenCurrencyStorage.solAcknowledged
The report gives no description here.
LowDeclaring a top-level structure in a file named after a contract makes it harder navigating through code.Acknowledged
The report gives no description here.
LowDeclaring a top-level structure in a file named after a library makes it harder navigating through code.Acknowledged
The report gives no description here.
LowDeclaring a top-level structure in a file named after a library makes it harder navigating through code.Acknowledged
The report gives no description here.
LowDeclaring a top-level structure in a file named after a library makes it harder navigating through code.Acknowledged
The report gives no description here.
LowDeclaring a top-level structure in a file named after an interface makes it harder navigating through code.Acknowledged
The report gives no description here.
LowHere the value is scaled twice, which is inefficient.Acknowledged
The report gives no description here.
Show 10 more
LowIt is unclear why one would prefer this minimal interface versus the standard IERC20.Acknowledged
The report gives no description here.
LowProcedural in CurrencyLibrary.solAcknowledged
The report gives no description here.
LowProcedural in TickStorage.solAcknowledged
The report gives no description here.
LowSuboptimal in IAuction.solAcknowledged
The report gives no description here.
LowSuboptimal in ITickStorage.solAcknowledged
The report gives no description here.
LowSuboptimal in PermitSingleForwarder.solAcknowledged
The report gives no description here.
LowSuboptimal in TokenCurrencyStorage.solAcknowledged
The report gives no description here.
LowThe ame condition is checked twice.Acknowledged
The report gives no description here.
LowThis bitwise “and” operation is redundant, as Solidity tolerates garbage in unused bits of narrow types.Acknowledged
The report gives no description here.
LowThis denominator is quite unusual.Acknowledged
The report gives no description here.
Show 9 more
LowUPPER_CASE identifiers are commonly used for constants, not for immutable variables.Acknowledged
The report gives no description here.
LowUsing the dollar sign in the name of a storage variable looks weird.Acknowledged
The report gives no description here.
LowWe didn’t review these files.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Uniswap’s security record
UniswapSecurity firm
ABDK Consulting31 projects reviewed · 64 reports · latest Jan 2026
See ABDK Consulting’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us