Uniswap

Smart Contract - Uniswap v4 Core

Critical Impact Examples (Maximum Reward: $15,500,000)

Vulnerability Type	Example Scenario	Why Critical
Theft of Pooled Liquidity	Reentrancy in modifyLiquidity() allows draining all liquidity from a pool during a single transaction	Affects 20%+ of TVL, immediate user fund loss
Accounting Manipulation	Integer overflow in swap calculation lets attackers drain pool reserves	Protocol insolvency, affects all pools
Hook Bypass	Vulnerability allows bypassing before/after hooks on all swaps, enabling unauthorized state changes	Breaks core security assumptions, affects all v4 pools using hooks
Misconfigured Contract Takeover	A misconfigured core protocol component allows taking ownership or DoS	Catastrophic protocol-wide impact
Flash Accounting Bypass	Exploit in flash accounting system allows withdrawing funds without repaying	Direct theft, affects entire protocol TVL

High Likelihood Indicators

• Exploitable by any user with basic knowledge
• Requires < $1,000 initial capital
• Can be executed in a single transaction
• No special timing or conditions needed

High Impact Examples (Maximum Reward: $1,000,000)

Vulnerability Type	Example Scenario	Why High
Single Pool Drain	Bug in specific tick math allows draining high-value pools (e.g., WETH/USDC)	0.5–20% of TVL affected
Oracle Manipulation	Time-weighted average price (TWAP) can be manipulated through specific transaction ordering	Price oracle compromise, affects dependent protocols
Lock Bypassing	Reentrancy mechanism can be bypassed to perform unauthorized nested operations	Security model violation, medium exploitation difficulty
Fee Collection Exploit	Bug allows claiming fees belonging to other LPs in specific conditions	Theft of unclaimed yield

Medium Likelihood Indicators

• Requires specific pool configurations or parameters
• Needs coordination of multiple transactions
• Requires moderate capital ($10K–$100K)
• Timing-dependent or requires specific market conditions

Medium Impact Examples (Maximum Reward: $100,000)

Vulnerability Type	Example Scenario	Why Medium
Tick Manipulation	Edge case in tick bitmap causes incorrect liquidity allocation or substantially different swap outcomes than expected	Undermines protocol guarantees, impacts only one pool
Rounding Errors	Minor rounding in specific edge cases causes dust-level losses (<$1 per tx)	Minimal economic impact

Low Likelihood Indicators

• Requires rare combination of conditions
• Very specific pool parameters needed
• Affects only certain token pairs or configurations
• Limited economic incentive for attacker

Smart Contract – Other Uniswap Contracts

Critical Examples – Up to $2,250,000

Contract Type	Example	Impact
Permit2	Signature validation bypass allows spending any user's tokens	Affects all users using Permit2
Universal Router	Command execution bug allows arbitrary calls with user's token approvals	Direct theft from router users

High Examples – Up to $500,000

Contract Type	Example	Impact
NFT Position Manager	Bug allows transferring someone else's liquidity position NFT	Theft of specific positions
Swap Router	Slippage protection can be bypassed, enabling sandwich attacks beyond tolerance	Affects individual swaps