Skip to content

Commit 1795cb0

Browse files
authored
fix: audit and bug bounty links (#1056)
1 parent 7f3338e commit 1795cb0

File tree

6 files changed

+54
-4
lines changed

6 files changed

+54
-4
lines changed

docs/contracts/v2/concepts/03-advanced-topics/04-security.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ The report also has a "Design Comments" section that provided a deep technical u
2222
2323
## Bug Bounty
2424

25-
Uniswap has an open and ongoing bug [bounty program](https://uniswap.org/bug-bounty/).
25+
Uniswap has an open and ongoing bug [bounty program](https://cantina.xyz/bounties/f9df94db-c7b1-434b-bb06-d1360abdd1be) on Cantina.
2626

2727
## Considerations when building on Uniswap
2828

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"label": "Concepts",
3+
"position": 3
4+
}
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
id: security
3+
title: Security
4+
---
5+
6+
# Audits
7+
8+
In early 2021, ABDK Consulting performed a general security review and thereafter published an audit report for the Uniswap V3 core contracts in March 2021 prior to its release.
9+
10+
> [Read the report](https://github.com/Uniswap/v3-core/blob/main/audits/abdk/audit.pdf)
11+
12+
In April 2021, ABDK Consulting also published an audit report for the Uniswap V3 Periphery contracts.
13+
14+
> [Read the report](https://github.com/Uniswap/v3-periphery/blob/main/audits/abdk/audit.pdf)
15+
16+
17+
During the week of January 4th, 2021 and from February 15th to March 12th, three engineers from Trail of Bits conducted a security review on the Uniswap V3 core contracts and subsequently published an audit report including results from [Echidna end-to-end tests](https://github.com/Uniswap/v3-core/tree/main/audits/tob#end-to-end-testing-with-echidna) and [verification](https://github.com/Uniswap/v3-core/tree/main/audits/tob#verification-with-manticore) from the symbolic execution tool Manticore.
18+
19+
> [Read the report](https://github.com/Uniswap/v3-core/blob/main/audits/tob/audit.pdf)
20+
21+
# Bug Bounty
22+
23+
Uniswap has an open and ongoing bug [bounty program](https://cantina.xyz/bounties/f9df94db-c7b1-434b-bb06-d1360abdd1be) on Cantina.
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"label": "Guides",
3-
"position": 3,
3+
"position": 4,
44
"collapsed": false
55
}
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"label": "Technical Reference",
3-
"position": 4,
3+
"position": 5,
44
"collapsed": true
55
}

docs/contracts/v4/concepts/10-security.mdx

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,32 @@ v4's flash accounting system requires careful implementation to prevent exploita
4040
### Pool Manager Interactions
4141
Direct interactions with the PoolManager require thorough understanding of the locking mechanism and callback patterns.
4242

43+
## Audits
44+
45+
Uniswap's V4 core contracts have undergone a handful of extensive security reviews by multiple providers, with some reviews still ongoing. Below is a list of completed and draft reports. The full list can be found in the respective repositories' [audits directory](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits):
46+
47+
> [Open Zeppelin report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/OpenZeppelin_audit_core.pdf) from July 17th 2024.
48+
49+
> [Certora draft report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/DRAFT_Certora_audit_core.pdf) from July 2024.
50+
51+
> [Trail of Bits report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/TrailOfBits_audit_core.pdf) from September 5th 2024.
52+
53+
> [Spearbit draft report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/DRAFT_Spearbit_audit_core.pdf) from September 5th 2024.
54+
55+
> [ABDK draft report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/DRAFT_ABDK_audit_core.pdf) from September 5th 2024.
56+
57+
58+
Similarly, the V4 periphery contracts have been reviewed by various audit providers, and the full list is inside the periphery repository's [audits directory](https://github.com/Uniswap/v4-periphery/tree/main/audits):
59+
60+
> [Open Zeppelin report](https://github.com/Uniswap/v4-periphery/blob/main/audits/OpenZeppelin_audit_periphery_universal_router.pdf) from September 5th 2024.
61+
62+
> [Spearbit draft report](https://github.com/Uniswap/v4-periphery/blob/main/audits/DRAFT_Spearbit_audit_periphery.pdf) from September 5th 2024.
63+
64+
> [ABDK draft report](https://github.com/Uniswap/v4-periphery/blob/main/audits/DRAFT_ABDK_audit_periphery_universal_router.pdf) from September 5th 2024.
65+
4366
## Bug Bounty Program
4467

45-
For non-emergency security issues, report vulnerabilities through Uniswap's official [bug bounty program](https://uniswap.org/bug-bounty/).
68+
In November 2024 Uniswap announced a [$15.5 million dollar bug bounty](https://blog.uniswap.org/v4-bug-bounty) for their V4 contracts. You can view the full [bounty page](https://cantina.xyz/bounties/f9df94db-c7b1-434b-bb06-d1360abdd1be) on Cantina.
4669

4770
## Additional Security Resources
4871

0 commit comments

Comments
 (0)