uniswap.org
Summary
Uniswap is the largest decentralized exchange by usage, with ~$2.9B TVL across 50+ chains and a seven-year track record of zero confirmed exploits in core v2/v3/v4 AMM contracts despite $2T+ cumulative volume. Ethereum mainnet admin actions route through UNI token voting, GovernorBravo, and a verified 2-day Timelock; core swap logic is immutable and heavily audited, including six tier-1 v4 reviews and a $15.5M Cantina bug bounty. The primary gap between marketing and on-chain reality is cross-chain governance: L2 v3/v4 factory and PoolManager admins do not answer to UNI holders—most critically, Arbitrum v4 is controlled by a single EOA with no timelock or multisig. Overall risk is low-to-moderate (3.7/10), driven by governance centralization on L2s, not by core contract fragility on Ethereum.
Trust Assumptions
Users must trust that (1) immutable core swap contracts on each chain match audited source and have not been replaced by unverified bytecode—two in-scope contracts (Ethereum SwapRouter02, Arbitrum V3Factory) currently block that assurance; (2) on Ethereum, UNI governance and the 2-day Timelock will not pass proposals that harm LPs or redirect fees maliciously, despite ~272M UNI (~27% of max supply) sitting in the Timelock treasury; (3) on Arbitrum, Base, Optimism, and Polygon, chain-local admins—especially the Arbitrum EOA 0x2BAD…46CD—will not abuse owner privileges over v3 fee tiers and v4 protocol-fee controllers; (4) swappers verify pool hook contracts before interacting with v4 pools, since permissionless hooks can alter swap amounts; and (5) users manage Permit2 and router approvals carefully, as phishing and third-party router abuse have caused ~$8M+ in user-side losses without compromising Uniswap core.
What Could Go Wrong
Compromise or misuse of the Arbitrum admin EOA could immediately reassign v4 PoolManager ownership or protocol-fee controllers on a chain holding significant liquidity—no UNI vote, no 2-day delay, no multisig co-signing required. A user swapping through a v4 pool with a malicious or buggy third-party hook could lose funds even though PoolManager core math is audited; Cork Protocol lost ~$12M via a hook exploit in May 2025. UNI governance capture or aggressive treasury deployment (~272M UNI in Timelock, top-10 holders at ~52%) could approve unfavorable fee changes, a 20M UNI/year growth budget that outpaces programmatic burns, or governance-logic upgrades via the GovernorBravo delegator proxy—each affecting value accrual and LP economics. Finally, unverified SwapRouter02 bytecode on Ethereum and unaudited per-chain deployments across 46+ networks create a deployment-equivalence blind spot where deployed logic may diverge from audited repositories.
Recommendation
Uniswap is suitable for substantial swap and LP exposure on Ethereum mainnet, where admin paths are Timelock-gated and core contracts are battle-tested. Treat Arbitrum and other L2 deployments as materially higher governance risk until admins are verified multisigs or bridged to Ethereum Timelock control—avoid large LP positions on Arbitrum v4 specifically while a single EOA holds PoolManager owner. Never interact with v4 pools without independently verifying hook contract source and behavior; prefer established pools with no hooks or audited hook implementations. Monitor UNI governance proposals (fee switches, treasury spend, GovernorBravo implementation changes), Certora M-02 status in v4, and Etherscan verification of SwapRouter02 and Arbitrum V3Factory. UNI holders should be cautious about treasury concentration and modest net inflation from the 2026 growth budget. Retail users should treat all Uniswap-branded airdrops and approval prompts as phishing until verified on official channels.
Key Findings (30)
Analysis Sections
Ethereum mainnet Uniswap is governed by on-chain UNI token voting through GovernorBravo and a 2-day Timelock (verified on-chain). Core v2/v3 pool contracts are immutable after deployment; v4 PoolManager ownership on mainnet sits with the Timelock. However, cross-chain governance is materially weaker: L2 v3/v4 factory and PoolManager admins are chain-specific addresses that do not route through Ethereum UNI governance—most critically, Arbitrum v3/v4 admin is an EOA (0x2BAD…46CD). Permit2 and Universal Router are immutable with no admin. Overall: credible DAO on mainnet, but L2 admin centralization is the primary governance risk.
Findings (8)
Uniswap v3 Factory and v4 PoolManager ownership on Arbitrum, Base, and Optimism uses chain-local admin addresses rather than the Ethereum Timelock (0x1a9C…35BC). On Arbitrum, both V3OpenFeeAdapter.owner and V4 PoolManager.owner resolve to EOA 0x2BAD8182C09F50c8318d769245beA52C32Be46CD (code length 0, nonce 8). On Base and Optimism, admins are small unverified contracts (~2840 bytes) with no Gnosis Safe interface. These admins can call owner-only functions such as enableFeeAmount (v3) and setProtocolFeeController/transferOwnership (v4) without UNI holder votes or a timelock delay.
The Arbitrum deployment admin 0x2BAD8182C09F50c8318d769245beA52C32Be46CD has no contract code, is not a Gnosis Safe (getOwners/getThreshold revert), and holds owner privileges over both v3 fee-tier configuration (via V3OpenFeeAdapter) and v4 PoolManager ownership. Compromise of this key enables immediate admin actions with no on-chain delay or multisig co-signing.
GovernorBravo uses a delegator/proxy pattern. _setImplementation is restricted to admin (the Timelock), meaning governance logic can be swapped via a successful UNI vote + timelock execution. Current implementation: 0x53a328F4086d7C0F1Fa19e594c9b842125263026. This is expected for Compound-style governors but represents a governance-controlled upgrade surface.
Ethereum v4 PoolManager.protocolFeeController() returns address(0). Protocol fee collection on v4 is not yet activated; when set, only the PoolManager owner (Timelock on mainnet) can assign the controller.
The Uniswap Timelock (0x1a9C8182C09F50C8318d769245beA52c32BE35BC) has delay=172800 seconds (2 days), GRACE_PERIOD=14 days, MINIMUM_DELAY=2 days, MAXIMUM_DELAY=30 days. Timelock.admin is GovernorBravo; pendingAdmin is zero. Governance-proposed actions queue through this delay before execution.
GovernorBravo (0x408ED6354d4973f66138C91495F2f2FCbd8724C3) is wired to the Timelock and UNI token. Verified parameters: votingDelay=13140 blocks (~1.8 days), votingPeriod=40320 blocks (~5.6 days), proposalThreshold=1,000,000 UNI, quorumVotes=40,000,000 UNI. Governor.admin is the Timelock (mutual admin pattern with Compound-style governance).
On Ethereum, v2 Factory feeToSetter, v4 PoolManager owner, and UNI minter all resolve to the Timelock. V3 Factory owner is V3OpenFeeAdapter (0xf2371551Fe3937Db7c750f4DfABe5c2fFFdcBf5A), whose owner() is the Timelock—adding an indirection layer but preserving DAO control for fee-tier enablement.
Uniswap v2 pairs and v3 pools have no admin keys after creation—liquidity cannot be seized via factory ownership. Factory owners can only enable new fee tiers (v3) or set protocol fee recipients (v2). v4 uses a singleton PoolManager where owner controls protocol fee settings but not existing LP balances. Permit2 and Universal Router have no owner/admin functions.
Governance Checklist
Key Governance Entities (Ethereum Mainnet)
Cross-Chain Admin Comparison
| Chain | V3 Admin | V4 PoolManager Owner | Matches ETH Timelock |
|---|---|---|---|
| Ethereum | V3OpenFeeAdapter → Timelock | Timelock (0x1a9C…35BC) | Yes |
| Arbitrum | V3OpenFeeAdapter → EOA 0x2BAD…46CD | EOA 0x2BAD…46CD | No |
| Base | V3OpenFeeAdapter → 0x31FA…72A9 | 0x31FA…72A9 (contract) | No |
| Optimism | V3OpenFeeAdapter → 0xa1dD…3518 | 0xa1dD…3518 (contract) | No |