uniswap.org
Summary
Uniswap is a battle-tested AMM spanning v1–v4 with roughly $2.77B TVL across 40+ chains and no verified production exploit of audited v2/v3/v4 core contracts since 2018. On-chain governance uses UNI token voting through Governor Bravo with a verified 2-day Timelock, and swap entrypoints like UniversalRouter and Permit2 are immutable with no owner. The main risks are not in the core swap math but in the expanding perimeter: cross-chain factory control depends on Wormhole and Axelar bridges (a guardian compromise could bypass DAO control on remote chains), v4 permissionless hooks run unaudited third-party code inside the swap pipeline, and contract addresses are not uniform across chains — on Base, the canonical CREATE2 address hosts an unrelated 'Recover' contract, not the real factory. Post-UNIfication tokenomics add net inflationary pressure (~20M UNI/year issuance vs ~4–5M burns) while the Timelock holds 27% of supply. Overall risk is moderate (4.0/10).
Trust Assumptions
Users trust that audited v2/v3/v4 core contracts and immutable periphery (UniversalRouter, Permit2) behave as designed; that UNI governance with its 10M-proposal threshold and 2-day Timelock will not pass malicious proposals altering factories, minting, or Governor logic; that Wormhole's 19-guardian set and Axelar validators will not sign fraudulent cross-chain governance messages; that integrators use chain-specific factory addresses from official SDKs rather than assuming CREATE2 parity; that liquidity providers in v4 pools independently vet hook contracts before depositing; and that Uniswap Labs' interfaces route users to correct on-chain contracts rather than impersonators.
What Could Go Wrong
A Wormhole guardian-set compromise (precedent: Feb 2022, $325M) could forge VAAs that execute unauthorized factory parameter changes on BSC, Celo, or other Wormhole-governed chains without passing through the Ethereum Timelock. A malicious or buggy v4 hook could drain liquidity from pools that opt into it — Cork Protocol lost $11–12M and Bunni $8.4M via hook flaws, validating this composability risk. Integrators or users assuming the Ethereum V3 factory address (0x1F984…) on Base would interact with an unverified 'Recover' impersonator, not Uniswap. Governance could mint up to 2% of supply annually (20M UNI under the approved growth budget), outpacing programmatic fee burns and diluting holders. A passed governance proposal could upgrade Governor Bravo implementation or redirect the 272M UNI Timelock treasury without any independent multisig veto.
Recommendation
Uniswap is suitable for significant trading and LP exposure on v2/v3 and on v4 pools without custom hooks, given seven years of operation and zero audited-core production exploits. Treat v4 hook pools as unaudited third-party integrations — verify hook bytecode before providing liquidity. Always confirm factory and router addresses per chain via official SDK documentation; never assume cross-chain address parity. Monitor Wormhole guardian-set changes, cross-chain governance bridge health, and UNI governance proposals affecting minting, fee switches, or Governor upgrades. Reduce exposure on Wormhole-governed L1 deployments (BSC, Celo) relative to Ethereum mainnet if bridge risk tolerance is low. UNI holders should track whether the 20M UNI/year growth budget continues to exceed Firepit burns, creating net supply inflation.
Key Findings (30)
Analysis Sections
Uniswap uses on-chain UNI token voting via Governor Bravo with a 2-day Timelock (verified on-chain). Ethereum mainnet factories and v4 PoolManager trace to the Timelock through V3OpenFeeAdapter intermediaries. Cross-chain deployments use heterogeneous bridge paths—Wormhole receivers on BSC/Celo and canonical L2 bridge accounts on Arbitrum/Base/Optimism—with no local owner/admin on receivers. Bridge compromise or guardian failure could enable unauthorized remote factory control. No multisig protects core governance; Governor admin is the Timelock contract.
Findings (9)
Non-Ethereum v3 factory ownership is mediated by immutable bridge receiver contracts with no on-chain admin. BSC chain verified: V3OpenFeeAdapter (0x3F07F08b45912dCd6691C5B9412975D5113B2910) owner is UniswapWormholeMessageReceiver (0x341c1511141022cf8eE20824Ae0fFA3491F1302b), which executes governance messages relayed from Ethereum Wormhole Sender (0xf5F4496219F31CDCBa6130B5402873624585615a, Timelock-owned). Wormhole guardian compromise or fraudulent VAA signing could authorize unauthorized setOwner/enableFeeAmount calls on remote factories.
Verified on-chain ownership patterns differ by chain: BSC uses Wormhole receivers; Arbitrum V3OpenFeeAdapter owner resolves to 0x2bad8182c09f50c8318d769245bea52c32be46cd (L2 address alias of Ethereum Timelock); Base and Optimism use separate CrossChainAccount-style bridge receivers (0x31fafd4889fa1269f7a13a66ee0fb458f27d72a9, 0xa1dd330d602c32622aa270ea73d078b803cb3518) with no owner()/admin(). Each path inherits distinct liveness, upgrade, and trust assumptions. A bridge failure on one chain does not affect others but leaves that deployment outside DAO control until migration.
On-chain verification shows Timelock admin is Governor Bravo (contract), Governor admin is Timelock (contract), and neither is a Gnosis Safe—getOwners()/getThreshold() revert on both addresses. Governance changes require UNI holder votes (10M UNI proposal threshold, verified) plus 2-day Timelock delay. This is decentralized in structure but vulnerable to governance attacks (vote buying, low turnout) and whale coordination; there is no independent multisig safety layer.
GovernorBravoDelegator stores admin as Timelock and exposes _setImplementation() callable only by admin. Any successful governance proposal routed through the Timelock can swap the Governor delegate logic, altering quorum rules, voting parameters, or execution behavior. Admin is not an EOA (verified), so upgrades require full proposal lifecycle—but a malicious or mistaken passed proposal could reparameterize governance without a separate safeguard.
Ethereum UniswapWormholeMessageSender (0xf5F4496219F31CDCBa6130B5402873624585615a) is listed as unverified in the pipeline contract cache, though on-chain owner() confirms Timelock ownership. Without verified source, outbound governance message encoding and access controls cannot be fully audited from disk. This is the sole outbound bridge for Wormhole-governed chains.
Ethereum v3 factory owner is V3OpenFeeAdapter (0xf2371551fe3937db7c750f4dfabe5c2fffdcbf5a), not the Timelock directly. Adapter owner() = Timelock (verified). v4 PoolManager (0x000000000004444c5dc75cb358380d2e3de08a90) is owned directly by Timelock. The adapter layer adds a contract hop for fee-switch logic; compromise of the adapter (not owner-updatable without Timelock) would affect factory fee parameters only.
Timelock storage slot 2 reads 172800 seconds (2 days). Contract enforces MINIMUM_DELAY = 2 days, MAXIMUM_DELAY = 30 days, GRACE_PERIOD = 14 days. setDelay() and setPendingAdmin() require msg.sender == address(this), meaning delay changes must themselves pass through a queued Timelock transaction.
On-chain Governor Bravo storage: proposalThreshold = 10,000,000 UNI (1e25 wei); votingDelay = 13,140 blocks (~2 days); votingPeriod = 40,320 blocks (~7 days); proposalCount = 97; timelock = 0x1a9C8182C09F50C8318d769245beA52c32BE35BC. UNI token has no owner()/admin() and fixed 1B supply. Governance is fully on-chain token voting (not Snapshot-only).
BSC and Celo UniswapWormholeMessageReceiver contracts have no owner/admin functions. receiveMessage() is publicly callable by any relayer once a valid Wormhole VAA is obtained. Security relies entirely on Wormhole guardian set verification, emitter address matching Ethereum sender, monotonic sequence enforcement, and 2-day message timeout. Celo receiver contract bytecode present (8392 bytes); BSC receiver bytecode present (14068 bytes).
Governance Checklist
Verified Ownership Chain
| Chain | Contract | Owner (verified) | Control Path |
|---|---|---|---|
| Ethereum | UniswapV3Factory | V3OpenFeeAdapter | Timelock → Adapter → Factory |
| Ethereum | PoolManager (v4) | Timelock | Direct Timelock ownership |
| Ethereum | Wormhole Sender | Timelock | Outbound cross-chain messages |
| BSC | UniswapV3Factory | V3OpenFeeAdapter | Wormhole Receiver → Adapter → Factory |
| BSC | Wormhole Receiver | None (immutable) | Wormhole VAA from Ethereum sender |
| Arbitrum | UniswapV3Factory | V3OpenFeeAdapter | Timelock L2 alias → Adapter → Factory |
| Base | UniswapV3Factory | V3OpenFeeAdapter | CrossChainAccount → Adapter → Factory |
| Optimism | UniswapV3Factory | V3OpenFeeAdapter | CrossChainAccount → Adapter → Factory |
| Celo | Wormhole Receiver | None (immutable) | Wormhole VAA from Ethereum sender |