Uniswap Token Launcher audit
ABDK Consulting reviewed Uniswap (Uniswap Token Launcher audit) on 14 Nov 2025: 73 findings, 0 critical; 11 marked fixed, 62 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings73
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 10 | 2 |
| Low | 0 | 52 | 9 |
MediumForwarding the original error message as is makes it harder to know which particular operation failed.Acknowledged
The report gives no description here.
MediumHere we silently fallback to the full range position plan, which makes contract behavior less predictable.Acknowledged
The report gives no description here.
MediumProcedural in BaseUERC20.solAcknowledged
The report gives no description here.
MediumProcedural in IMulticall.solAcknowledged
The report gives no description here.
MediumReturning an error message from inner call as a normal returned value is a bad practice.Acknowledged
The report gives no description here.
MediumReturning onhte the revert reason makes it impossible to distinguish successful “permit2” call from a failed one that returned no error.Acknowledged
The report gives no description here.
MediumSuboptimal in TokenPricing.solAcknowledged
The report gives no description here.
MediumThe data is copied several times.Acknowledged
The report gives no description here.
MediumThe requirements for the salt value are not listed.Acknowledged
The report gives no description here.
MediumThis could be optimized, taking into account that MIN_TICK = -MAX_TICK.Acknowledged
The report gives no description here.
Show 10 more
LowBad datatype in Distribution.solAcknowledged
The report gives no description here.
LowBad datatype in ILBPStrategyBasic.solAcknowledged
The report gives no description here.
LowBad datatype in ITokenFactory.solAcknowledged
The report gives no description here.
LowBad datatype in ITokenFactory.solAcknowledged
The report gives no description here.
LowBad datatype in ITokenLauncher.solAcknowledged
The report gives no description here.
LowBad datatype in ITokenLauncher.solAcknowledged
The report gives no description here.
LowBad datatype in ITokenLauncher.solAcknowledged
The report gives no description here.
LowBad datatype in ITokenLauncher.solAcknowledged
The report gives no description here.
LowBad datatype in IUERC20Factory.solAcknowledged
The report gives no description here.
LowBad datatype in IUSUPERC20Factory.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in LBPStrategyBasic.solAcknowledged
The report gives no description here.
LowBad datatype in LBPStrategyBasic.solAcknowledged
The report gives no description here.
LowBad datatype in LBPStrategyBasicFactory.solAcknowledged
The report gives no description here.
LowBad datatype in LBPStrategyBasicFactory.solAcknowledged
The report gives no description here.
LowBad datatype in MerkleClaim.solAcknowledged
The report gives no description here.
LowBad datatype in MerkleClaimFactory.solAcknowledged
The report gives no description here.
LowBad datatype in MigratorParams.solAcknowledged
The report gives no description here.
LowBad datatype in MigratorParams.solAcknowledged
The report gives no description here.
LowBad datatype in PositionTypes.solAcknowledged
The report gives no description here.
LowBad datatype in TokenLauncher.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in TokenLauncher.solAcknowledged
The report gives no description here.
LowBad datatype in TokenLauncher.solAcknowledged
The report gives no description here.
LowBad datatype in UERC20Factory.solAcknowledged
The report gives no description here.
LowBad datatype in UERC20Factory.solAcknowledged
The report gives no description here.
LowBad datatype in USUPERC20Factory.solAcknowledged
The report gives no description here.
LowBad naming in ILBPStrategyBasic.solAcknowledged
The report gives no description here.
LowBad naming in ITokenFactory.solAcknowledged
The report gives no description here.
LowBad naming in ITokenLauncher.solAcknowledged
The report gives no description here.
LowDeclaring a top-level structure in a file named after a library makes it harder navigating through code.Acknowledged
The report gives no description here.
LowHere the position liquidity is compared to the maximum liquidity per tick, even though the position can be wider than one tick.Acknowledged
The report gives no description here.
Show 10 more
LowProcedural in ActionsBuilder.solAcknowledged
The report gives no description here.
LowProcedural in ActionsBuilder.solAcknowledged
The report gives no description here.
LowProcedural in HookBasic.solAcknowledged
The report gives no description here.
LowProcedural in LBPStrategyBasic.solAcknowledged
The report gives no description here.
LowProcedural in MerkleClaim.solAcknowledged
The report gives no description here.
LowProcedural in TokenLauncher.solAcknowledged
The report gives no description here.
LowSuboptimal in TickCalculations.solAcknowledged
The report gives no description here.
LowThe comparison to zero address is redundant, as it is anyway possible to pass a dead token address.Acknowledged
The report gives no description here.
LowThe current currency balance is queried twice.Acknowledged
The report gives no description here.
LowThe function name suggests that the output format is JSON while actually it is bae64 encoded JSON which is not the same.Acknowledged
The report gives no description here.
Show 10 more
LowThe names of these structures are not directly related to the name of the file they are declared in.Acknowledged
The report gives no description here.
LowThe same condition is checked twice.Acknowledged
The report gives no description here.
LowThe same expreion is check twice.Acknowledged
The report gives no description here.
LowThis check is redundant, as it is anyway possible to pass a dead recipient address.Acknowledged
The report gives no description here.
LowThis check is redundant, as it is anyway possible to pass a dead recipient address.Acknowledged
The report gives no description here.
LowThis check is redundant, as it is anyway possible to pass a dead recipient address.Acknowledged
The report gives no description here.
LowThis check is redundant, as it is anyway possible to pass a dead token.Acknowledged
The report gives no description here.
LowThis denominator is unconventional.Acknowledged
The report gives no description here.
LowThis like looks like a plain assignment, while actually it returns value from the function.Acknowledged
The report gives no description here.
LowThis version requirement is inconsistent with other files in the same code base.Acknowledged
The report gives no description here.
Show 2 more
LowWe didn’t review this file.Acknowledged
The report gives no description here.
LowWe didn’t review this file.Acknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Uniswap’s security record
UniswapSecurity firm
ABDK Consulting31 projects reviewed · 64 reports · latest Jan 2026
See ABDK Consulting’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us