uniswap.org
Summary
Uniswap is the dominant multi-chain DEX with roughly $2.9B TVL across 40+ EVM chains, operating immutable v2/v3/v4 AMM contracts that have processed trillions in volume with no recorded core exploit since v2 launched in 2020. Core contract security is strong—non-upgradeable pools, nine pre-launch v4 audits, and an active $15.5M bug bounty—but governance and integration risks are elevated: an EOA controls Arbitrum v4 admin outside the Ethereum timelock, v4 hooks have caused ~$20M in third-party losses, and UNI voting power is concentrated in a 272M-token treasury and a small delegate set. Overall risk is moderate at 4.3/10.
Trust Assumptions
Users and LPs must trust that (1) immutable v2/v3/v4 pool math and reentrancy guards remain sound as deployed—admin keys cannot drain LP funds, only adjust fee switches; (2) on Ethereum mainnet, UNI governance via Governor Bravo and a 2-day timelock will act in the protocol's interest for fee and mint decisions; (3) on Base and Optimism, L2 admin contracts correctly relay L1 timelock control; (4) any v4 pool hook attached to a position behaves as audited, since PoolManager delegates swap and liquidity callbacks to arbitrary third-party hook code outside Uniswap's audit and bounty scope; and (5) integrators use chain-correct contract addresses from official deployment docs, not mainnet defaults.
What Could Go Wrong
The Arbitrum v4 PoolManager owner is EOA 0x2bad8182…, not the Ethereum UNI timelock—compromise or misuse of that single key could immediately reassign protocol-fee authority or transfer ownership without a 2-day delay or UNI vote, and the same EOA controls Unichain v2 feeToSetter. LPs depositing into v4 pools with unaudited hooks face direct fund loss: Cork Protocol (~$12M, May 2025) and Bunni (~$8.4M, September 2025) were drained via flawed custom hook logic while Uniswap core remained untouched. Governance concentration could steer treasury spending or fee policy against minority holders—the timelock holds 272M UNI (27.2% of supply), top ~50 delegates control over 90% of voting power, and the 20M UNI/year growth budget to Uniswap Labs exceeds estimated ~4–5M UNI/year fee-driven burns, creating net inflationary pressure.
Recommendation
Uniswap core AMM contracts are suitable for significant swap and LP capital on Ethereum v2/v3 standard pools, where admin actions route through UNI governance and a verified 2-day timelock. Treat v4 hook pools as a separate, higher-risk product: read the hook contract and its audit status before depositing; avoid pools whose hooks lack PoolManager-only access control. On Arbitrum and most non-Base/Optimism chains, assume fee and factory admin is not UNI-governed—factor that into chain selection for large positions. Integrators must pull per-chain addresses from official docs and verify bytecode against audited GitHub commits; users should revoke stale Permit2 approvals and treat any Uniswap-branded airdrop or LP site as phishing until confirmed on uniswap.org. Monitor Arbitrum EOA activity, UNIfication treasury outflows, v4 hook incident reports, and governance proposals affecting fee switches or the dormant 2% UNI mint cap.
Key Findings (30)
Analysis Sections
Ethereum mainnet core contracts are controlled by Uniswap Governor Bravo (0x408e…724c3) through a 2-day Compound-style timelock (0x1a9C…35BC), verified via on-chain storage reads. UNIfication (Dec 2025) activated v2/v3 protocol fees on mainnet and established DUNI (Wyoming DUNA) as the legal wrapper. Cross-chain governance is asymmetric: Base and Optimism L2 admin contracts reference the L1 timelock via CrossDomainMessenger, but Arbitrum v3/v4 admin is an active EOA (nonce 8, no contract code). Core AMM contracts are immutable with no pause; only fee switches and factory admin functions are governable.
Findings (8)
On Arbitrum, UniswapV3Factory owner (0xff7a…0699) and UniswapV4 PoolManager owner (0x2bad…46cd) both resolve to EOA 0x2bad8182c09f50c8318d769245bea52c32be46cd (verified: code length 0, transaction nonce 8). This EOA can call setOwner on the v3 ProtocolFeeController and transferOwnership on v4 PoolManager without the 2-day Ethereum timelock delay or UNI holder vote. Base and Optimism use bridged L2 admin contracts whose storage slot 1 points to the Ethereum timelock — Arbitrum lacks this linkage.
L2 factory/PoolManager admin addresses differ per chain and are not uniformly controlled by the Ethereum timelock. Base/Optimism L2 proxy contracts (1419 bytes) store admin=0x4200…0007 (L2CrossDomainMessenger) and reference L1 timelock 0x1a9C…35BC in storage slot 1, enabling L1-governance relay. Arbitrum uses a standalone EOA. Polygon, BSC, and 35+ other chains listed in discovery have independent deployments with no on-chain linkage to Ethereum governance verified in this analysis.
The UNI timelock at 0x1a9C8182C09F50C8318d769245beA52c32BE35BC has no verified source code on Etherscan. On-chain storage confirms Compound-style layout (admin=Governor Bravo, delay=172800s/2 days), but unverified bytecode prevents independent audit of the full execution logic and queued-transaction handling.
The Dec 2025 UNIfication proposal (passed with ~99.9% support) consolidates Uniswap Foundation teams into Uniswap Labs, establishes a Wyoming DUNA (DUNI) legal entity, creates a 20M UNI/year growth budget under a Labs–DUNI service provider agreement, and activates protocol fee switches. On-chain fee parameters remain governable by UNI votes, but operational execution, interface/API fee removal, and legal/regulatory engagement shift toward Labs and DUNI — increasing off-chain centralization relative to pure on-chain DAO control.
The timelock holds ~272.1M UNI (~27.2% of 1B total supply), verified via balanceOf RPC call. While UNI uses delegation-based voting, concentrated treasury holdings give governance participants who control or delegate timelock funds outsized proposal and voting influence. UNI minter role is also assigned to the timelock with a 2%-of-supply annual mint cap.
UniswapV4 PoolManager owner is the Ethereum timelock, but protocolFeeController storage is address(0) — protocol fees on v4 mainnet are not yet active. Governance must first call setProtocolFeeController() then set per-pool fees via the controller. This is by design but leaves v4 fee activation as a future governance action.
Uniswap v2/v3/v4 core contracts (factories, pools, PoolManager) have no Pausable, proxy, or upgrade mechanism. Universal Router and Permit2 also revert on owner() calls — deployed as immutable periphery. Protocol risk from admin key compromise is limited to fee switches and factory parameters, not user fund freezing or logic replacement.
DAO-governed claims on Ethereum mainnet are confirmed: Governor Bravo (name='Uniswap Governor Bravo') is timelock admin; timelock delay=2 days; v2 feeToSetter=timelock; v4 PoolManager owner=timelock; v3 factory owner is ProtocolFeeController (0xf237…cbf5a) which is itself owned by timelock. Governor parameters from storage: proposalThreshold=1M UNI, votingDelay=13,140 blocks (~36.5h), votingPeriod=40,320 blocks (~5.6 days).
Governance Checklist
On-Chain Governance Parameters (Ethereum)
Contract Admin Ownership (Verified On-Chain)
| Contract | Chain | Admin / Owner | Controlled By |
|---|---|---|---|
| UNI Token minter | ethereum | 0x1a9C8182C09F50C8318d769245beA52c32BE35BC | Timelock |
| Timelock admin | ethereum | 0x408eD6354d4973f66138c91495f2f2fcbd8724C3 | Governor Bravo |
| V2 Factory feeToSetter | ethereum | 0x1a9C8182C09F50C8318d769245beA52c32BE35BC | Timelock |
| V2 feeTo (TokenJar) | ethereum | 0xf38521f130fccf29db1961597bc5d2b60f995f85 | Owned by timelock |
| V3 Factory owner | ethereum | 0xf2371551fe3937db7c750f4dfabe5c2fffdcbf5a | ProtocolFeeController → timelock |
| V4 PoolManager owner | ethereum | 0x1a9C8182C09F50C8318d769245beA52c32BE35BC | Timelock |
| V4 protocolFeeController | ethereum | 0x0000000000000000000000000000000000000000 | Not set |
| V3 Factory owner | arbitrum | 0xff7ad5da31fecdc678796c88b05926db896b0699 | ProtocolFeeController → EOA |
| V4 PoolManager owner | arbitrum | 0x2bad8182c09f50c8318d769245bea52c32be46cd | EOA (no timelock) |
| V4 PoolManager owner | base | 0x31fafd4889fa1269f7a13a66ee0fb458f27d72a9 | L2 admin → L1 timelock via messenger |
| V4 PoolManager owner | optimism | 0xa1dd330d602c32622aa270ea73d078b803cb3518 | L2 admin → L1 timelock via messenger |