InterSwap security record
As of 3 Nov 2026, InterSwap has 1 audit report on Trustblock, by QuillAudits, dated 20 Mar 2023. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Interswap | Security firm: QuillAudits | Date: | Scope: Files named in the report | No open critical findings | Open · quillaudits.com |
Findings8
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 8 | 0 | 0 |
LowCheck transferFrom allowance subtraction logicInterswap · QuillAudits · 20 Mar 2023Open
In case someone sets a uint.max allowance then the contract never subtracts the allowance in transferFrom(). transferFrom function only subtracts the allowance when its not set as uint.max value (i.e when its less than uint.max) because of the if statement
Open the reportLowFloating solidity (pragma solidity ^0.8.24)Interswap · QuillAudits · 20 Mar 2023Open
When specific solidity pragma version is not defined in a solidity program, it could cause the program to be compiled with either outdated or recent compiler, possibly introducing some known and/or undiscovered bugs. It is a good practice to have a locked solidity compiler version to avoid deployed contracts with bugs.
Open the reportLowLog ln() function will give error on values less than 0Interswap · QuillAudits · 20 Mar 2023Open
In library contracts LogExpMath there is log function ln() which takes int256 means it should not take any values less than 0 but the check which is implemented is: if(a == 0) revert InterswapErrors.OutOfBounds() but it also should revert for values less than 0.
Open the reportLowNo zero value check for variableInterswap · QuillAudits · 20 Mar 2023Open
In library contracts FixedPoint file there are functions divUp() and divDown() which take a,b as input parameters but they do not check zero value for b variable as it is used as denominator which might result in 0 value.
Open the reportLowRedundant functionInterswap · QuillAudits · 20 Mar 2023Open
getPool() is redundant as pools mapping is public, the compiler automatically creates getter functions for all public state variables.
Open the reportLowRedundant importInterswap · QuillAudits · 20 Mar 2023Open
import for InterswapConstants is redundant as anything from InterswapConstants is not getting used in BasePoolFactory
Open the reportLowUnused function and errorInterswap · QuillAudits · 20 Mar 2023Open
In the InterswapPool contract, the _updateChecksum function is defined but never used. Same with the UnexpectedFailedMethod error in the BaseRouter. The unused functions add to the contract bytecode size and could increase deployment cost unnecessarily.
Open the reportLowUse of incorrect errorInterswap · QuillAudits · 20 Mar 2023Open
Both setDefaultSwapFee() and setSwapFee() functions are checking that if _swapFee is less than InterswapConstants._MIN_FEE_NUMERATOR (99e16) then it reverts the transaction with InterswapErrors.TooBigFee() error which is incorrect as its checking if _swapFee is less and reverting with error that says TooBigFee.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="interswap"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us