[VPD-479]: Swap Router by Debugger022 · Pull Request #16 · VenusProtocol/venus-periphery

Debugger022 · 2025-10-17T11:34:58Z

This PR introduces the SwapRouter contract to the Venus periphery, along with its interface, deployment script, and supporting tests. The contract is now deployed and verified on both bsctestnet and bscmainnet.

What’s Included

SwapRouter Contract
- Implements swap-and-supply and swap-and-repay operations for Venus markets.
- Supports both ERC-20 and native token (BNB) flows.
- Includes robust error handling, slippage protection, and event emission for all major actions.
- Uses upgradeable and secure patterns (Ownable2StepUpgradeable, ReentrancyGuardUpgradeable).
ISwapRouter Interface
- Defines the external interface for all SwapRouter operations, including supply, repay, and sweep functions.
Deployment Script
- [003-deploy-swap-router.ts] automates deployment with proxy support and ownership transfer to the timelock.
- Handles all required dependencies and admin setup for mainnet and testnet.
Tests
- Comprehensive tests for SwapRouter functionality, covering all major flows and error cases.
Network Deployments
- SwapRouter is deployed and verified on both bsctestnet and bscmainnet

GitGuru7 · 2025-11-17T12:04:46Z

contracts/Interfaces.sol

+    function mint() external payable;
+
    function repayBorrowBehalf(address borrower) external payable;

    function liquidateBorrow(address borrower, IVToken vTokenCollateral) external payable;


Please include explicit return types in the function signatures.

VBNB doesn't have return types in the following functions.

GitGuru7 · 2025-11-17T12:07:00Z

contracts/SwapRouter/SwapRouter.sol

+    IComptroller public immutable COMPTROLLER;
+
+    /// @notice The swap helper contract for executing token swaps
+    SwapHelper public immutable swapHelper;
+
+    /// @notice The wrapped native token contract (e.g., WBNB)
+    IWBNB public immutable wrappedNative;


For consistency, could we use capitalized naming for all immutable variables?

GitGuru7 · 2025-11-17T12:08:32Z

contracts/SwapRouter/SwapRouter.sol

+    event SweepNative(address indexed receiver, uint256 amount);
+
+    /// @custom:error Thrown when an invalid vToken address is provided
+    error InvalidVToken(address vToken);


InvalidVToken doesn’t seem to be used anywhere, we can remove it

GitGuru7 · 2025-11-17T12:10:43Z

contracts/SwapRouter/SwapRouter.sol

+    IWBNB public immutable wrappedNative;
+
+    /// @notice The native vToken address (e.g., vBNB)
+    address public immutable NATIVE_VTOKEN;


For consistency with other immutable contract references, can we use the IVBNB interface here as well?

GitGuru7 · 2025-11-17T12:29:11Z

contracts/SwapRouter/SwapRouter.sol

+        if (vToken == NATIVE_VTOKEN) {
+            return address(wrappedNative);


I understand we’re returning the wrapped asset here instead of the native one since the native token doesn’t have an address and it simplifies the swap logic. This is later handled in _supply().
However, should we continue supporting this mapping for the native market? Since we plan to deprecate the native market and move fully to the wrapped version, should we all together skip the vBNB minting wdyt?

I agree with this approach, and it's worth discussing further.

GitGuru7 · 2025-11-17T12:35:09Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 balanceBefore = IERC20Upgradeable(tokenOut).balanceOf(address(this));
+
+        // Execute swap using SwapHelper multicall
+        bytes memory swapCallData = abi.encodeWithSelector(swapHelper.multicall.selector, swapData);


Please update swapHelper, the multicall interface has changed, so the encoding here should be adjusted accordingly.

GitGuru7 · 2025-11-17T12:36:11Z

contracts/SwapRouter/SwapRouter.sol

+     * @param amount The amount to supply
+     * @return amountSupplied The actual amount supplied
+     */
+    function _supply(address vToken, address token, uint256 amount) internal returns (uint256 amountSupplied) {


Can we rename the token parameter to asset or underlyingToken? for clarity.

GitGuru7 · 2025-11-17T12:38:52Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 vTokenBalance = IERC20Upgradeable(vToken).balanceOf(address(this));
+        if (vTokenBalance > 0) {
+            IERC20Upgradeable(vToken).safeTransfer(msg.sender, vTokenBalance);


If we decide to support vBNB minting, I would prefer to move this transfer block probably inside the NATIVE_VTOKEN specific if block.

Can you clarify why we should move it inside the if block?

agree, why not move this into NATIVE_VTOKEN block ?

The reason for this is only NATIVE_VTOKEN doesn't support mintBehalf.

GitGuru7 · 2025-11-17T12:47:22Z

contracts/SwapRouter/SwapRouter.sol

+     * @return actualAmountIn The actual amount transferred
+     */
+    function _handleTokenInput(address tokenIn, uint256 amountIn) internal returns (uint256 actualAmountIn) {
+        if (tokenIn == address(0)) {


Instead of mapping the native token to address(0), I’d prefer using the NATIVE_TOKEN_ADDR constant (0xbBbBBBBbbBBBbbbBbbBbbbbBBbBbbbbBbBbbBBbB) for consistency with how we handle native tokens in other contracts.

GitGuru7 · 2025-11-17T13:36:06Z

contracts/SwapRouter/SwapRouter.sol

+        if (vToken == NATIVE_VTOKEN) {
+            // Handle native token repayment
+            IWBNB(token).withdraw(repayAmount);
+            IVBNB(vToken).repayBorrowBehalf{ value: repayAmount }(msg.sender);
+            amountRepaid = repayAmount;
+        } else {


I would prefer this design:

Do not allow supplying collateral or repaying for the native market (vBNB).
As we are deprecating the native market.

It is still fine to accept native BNB as tokenIn.
The contract can wrap the native BNB, use it as input for swaps, and then supply/repay any non-native market.
Native BNB should only act as input to the flow not as the target market itself.

i think it's fine if we support it, it doesn't bring any drawback or complicate the logic a lot

GitGuru7 · 2025-11-18T06:01:44Z

contracts/SwapRouter/SwapRouter.sol

+            IERC20Upgradeable(token).safeApprove(vToken, 0);
+            IERC20Upgradeable(token).safeApprove(vToken, amount);


safeApprove is deprecated in oz v4 and removed in oz v5. We could use forceApprove or approveOrRevert

GitGuru7 · 2025-11-18T09:30:11Z

contracts/SwapRouter/SwapRouter.sol

+        if (amount > repayAmount) {
+            uint256 excess = amount - repayAmount;
+            if (vToken == NATIVE_VTOKEN) {
+                // Convert back to wrapped native and transfer
+                wrappedNative.deposit{ value: excess }();
+                IERC20Upgradeable(address(wrappedNative)).safeTransfer(msg.sender, excess);


In _repay, we only unwrap repayAmount, not the full amount.
So the excess stays as WBNB, not native BNB.
But the code tries to re-wrap it using:
wrappedNative.deposit{ value: excess }();

This might fails because there’s no native BNB corresponding to that excess.
We should just transfer the excess WBNB back to the user instead.

Fixed f2459c8

GitGuru7 · 2025-11-18T09:33:47Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 amountIn,
+        uint256 minAmountOut,
+        bytes[] calldata swapData
+    ) external payable nonReentrant {


Any specific reason for making swapAndSupply and swapAndRepay payable when native handling already uses separate functions (swapNativeAndSupply and swapNativeAndRepay)?

Removed payable f2459c8

GitGuru7 · 2025-11-18T09:49:42Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 debtAmount = IVToken(vToken).borrowBalanceCurrent(msg.sender);
+        if (debtAmount == 0) revert ZeroAmount();


I would prefer adding this as an early-revert check in all external repay-related functions instead of here, similar to how it’s already done in swapAndRepayFull

GitGuru7 · 2025-11-18T09:54:39Z

contracts/SwapRouter/SwapRouter.sol

+        // Return any excess tokens to user
+        if (amountOut > debtAmount) {
+            uint256 excess = amountOut - debtAmount;
+            IERC20Upgradeable(tokenOut).safeTransfer(msg.sender, excess);
+        }


Nit: Can we refactor the logic so excess tokens are transferred back to the user in one place instead of doing it twice, once here and once inside _repay?
I understand the calculations differ, but we can still consolidate the return excess logic to avoid duplication and make the flow cleaner.

fred-venus · 2025-11-20T05:30:22Z

contracts/SwapRouter/SwapRouter.sol

+     * @dev For native vToken (vBNB), returns wrapped native token address
+     */
+    function _getUnderlyingToken(address vToken) internal view returns (address underlying) {
+        if (vToken == address(NATIVE_VTOKEN)) {


so what's the value of IVToken(vWBNB).underlying() -> WETH ?

It will be WBNB. However, for VBNB, we are also returning WBNB.

fred-venus · 2025-11-20T05:41:38Z

contracts/SwapRouter/SwapRouter.sol

+            amountSupplied = amount;
+        } else {
+            // Handle ERC20 token supply
+            IERC20Upgradeable(token).forceApprove(vToken, amount);


should we reset the approve to 0 after mintBehalf ?

It's not needed.

fred-venus · 2025-11-20T05:47:07Z

contracts/SwapRouter/ISwapRouter.sol

+        address tokenIn,
+        uint256 amountIn,
+        uint256 minAmountOut,
+        bytes[] calldata swapData


should be " bytes calldata swapData " ?

fred-venus · 2025-11-20T05:49:50Z

contracts/SwapRouter/SwapRouter.sol

+    /**
+     * @notice Accepts native tokens sent to this contract
+     */
+    receive() external payable {}


lets add limit so that only wBNB can send fund, wdyt ?

fred-venus · 2025-11-20T05:51:04Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 amountIn,
+        uint256 minAmountOut,
+        bytes calldata swapCallData
+    ) external payable nonReentrant {


can remove payable here

fred-venus · 2025-11-20T05:56:51Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 actualAmountIn = _handleTokenInput(tokenIn, maxAmountIn);
+
+        // Perform swap - no minAmountOut since we need exact debt amount
+        uint256 amountOut = _performSwap(tokenIn, tokenOut, actualAmountIn, 0, swapCallData);


even tho we should still pass in debtAmount here, i mean we cant guarantee the underlying swap will return exact debtAmount

The function validates post-swap that amountOut >= debtAmount, which is more practical than constraining the swap upfront - this allows natural slippage while ensuring sufficient funds for full debt repayment.

Exef · 2025-11-20T10:06:51Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 minAmountOut,
+        bytes calldata swapCallData
+    ) external payable nonReentrant {
+        if (msg.value == 0) revert ZeroAmount();


Since this function uses mintBehalf it might be a good idea to check if msg.sender delegated this contract.

mintBehalf function doesn't require delegation logic.

Exef · 2025-11-20T10:40:30Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 minAmountOut,
+        bytes calldata swapCallData
+    ) external nonReentrant {
+        if (amountIn == 0) revert ZeroAmount();


Since this function uses mintBehalf it might be a good idea to check if msg.sender delegated this contract.

#16 (comment)

Exef · 2025-11-20T10:40:36Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 minAmountOut,
+        bytes calldata swapCallData
+    ) external payable nonReentrant {
+        if (msg.value == 0) revert ZeroAmount();


Since this function uses mintBehalf it might be a good idea to check if msg.sender delegated this contract.

#16 (comment)

Exef · 2025-11-20T10:40:45Z

contracts/SwapRouter/SwapRouter.sol

+        uint256 maxAmountIn,
+        bytes calldata swapCallData
+    ) external payable nonReentrant {
+        if (maxAmountIn == 0) revert ZeroAmount();


Since this function uses mintBehalf it might be a good idea to check if msg.sender delegated this contract.

#16 (comment)

Exef · 2025-11-20T10:44:21Z

contracts/SwapRouter/SwapRouter.sol

+            NATIVE_VTOKEN.mint{ value: amount }();
+            amountSupplied = amount;
+
+            // Transfer vBNB tokens to user (only needed for NATIVE_VTOKEN since it doesn't support mintBehalf)


Do I understand it correctly: mintBehalf like behaviour on vBNB market is to mint for a contract and transfer vTokens to user ?

Yes, VBNB doesn't have any mintBehalf logic.

fred-venus · 2025-11-21T02:57:34Z

overall lgtm, no other major issue found

Swap Router - merge develop to update SwapHelper

[VPD-458]: Cyfrin Audit Fixes for SwapRouter

[VPD-440]: Pashov Audit Fixes for SwapRouter

Prevents duplicate artifact errors (HH701) by making Interfaces.sol a re-export file pointing to contracts/Interfaces/*.sol, preserving the import path used by SwapRouter without requiring redeployment.

github-actions · 2026-02-23T10:19:05Z

Package	Line Rate	Branch Rate	Health
contracts	100%	100%	✔
contracts.DeviationSentinel	88%	86%	✔
contracts.DeviationSentinel.Oracles	93%	90%	✔
contracts.Interfaces	100%	100%	✔
contracts.LeverageManager	94%	80%	✔
contracts.Libraries	29%	33%	❌
contracts.PositionSwapper	0%	0%	❌
contracts.SwapHelper	100%	100%	✔
contracts.SwapRouter	79%	55%	➖
Summary	72% (569 / 786)	57% (261 / 460)	➖

fred-venus · 2026-02-24T04:42:27Z

https://venus.io/#/governance/proposal/593?chainId=56

## 1.2.0-dev.3 (2026-02-24) * Merge branch 'develop' into feat/swapRouter ([ec44ad8](ec44ad8)) * Merge branch 'develop' into feat/swapRouter-develop-merge ([e233965](e233965)) * Merge branch 'feat/swapper' into feat/swapRouter ([85f2930](85f2930)) * Merge pull request #16 from VenusProtocol/feat/swapRouter ([c4a7e6b](c4a7e6b)), closes [#16](#16) * Merge pull request #31 from VenusProtocol/feat/swapRouter-develop-merge ([059cd0a](059cd0a)), closes [#31](#31) * Merge pull request #43 from VenusProtocol/fix/vpd-440 ([6b3774d](6b3774d)), closes [#43](#43) * Merge pull request #45 from VenusProtocol/fix/VPD-458 ([f949020](f949020)), closes [#45](#45) * chore: clean up .gitignore duplicates and organize sections ([65165ef](65165ef)) * feat: add backend signature verification to the swapper ([e2312fa](e2312fa)) * feat: add barrel Interfaces.sol to re-export split interface files ([1db1685](1db1685)) * feat: add deployment script ([82082ba](82082ba)) * feat: add deployments ([d1d28c0](d1d28c0)) * feat: add generic swapper contract ([642375a](642375a)) * feat: add swapNativeAndRepayFull function ([4487e12](4487e12)) * feat: add SwapRouter audits ([50a4993](50a4993)) * feat: add swapRouter bscmainnet deployment ([9f06257](9f06257)) * feat: add SwapRouter contract ([2981707](2981707)) * feat: add SwapRouter fork test ([3417be5](3417be5)) * feat: I-01 ([0f8abbe](0f8abbe)) * feat: L-01 ([594b4ff](594b4ff)) * feat: L-05 ([aeb20e1](aeb20e1)) * feat: updating deployment files ([8de1ccf](8de1ccf)) * feat: updating deployment files ([41bb9e0](41bb9e0)) * feat: updating deployment files ([de928dd](de928dd)) * refactor: consolidate slippage check in repayFull ([f042ecd](f042ecd)) * test: add unit test for SwapRouter ([fbc3044](fbc3044)) * test: update swapRouter fork tests ([e6add02](e6add02)) * test: update unit test for swapRouter ([215a735](215a735)) * fix: fix comments ([f487c79](f487c79)) * fix: fix unit and fork test ([e21d01b](e21d01b)) * fix: major fixes ([f2459c8](f2459c8)) * fix: tests ([a5bf806](a5bf806))

kkirka and others added 3 commits August 28, 2025 12:49

feat: add generic swapper contract

642375a

feat: add backend signature verification to the swapper

e2312fa

feat: add SwapRouter contract

2981707

Debugger022 self-assigned this Oct 18, 2025

Debugger022 added 3 commits October 22, 2025 20:00

test: add unit test for SwapRouter

fbc3044

feat: add deployment script

82082ba

feat: add SwapRouter fork test

3417be5

Debugger022 marked this pull request as ready for review November 4, 2025 13:19

Debugger022 requested review from Exef, GitGuru7, fred-venus and web3rover November 4, 2025 13:20

Exef force-pushed the feat/swapper branch from e2312fa to fdedf52 Compare November 5, 2025 12:22

GitGuru7 reviewed Nov 17, 2025

View reviewed changes

GitGuru7 reviewed Nov 18, 2025

View reviewed changes

fix: fix comments

f487c79

fred-venus reviewed Nov 20, 2025

View reviewed changes

fix: major fixes

f2459c8

Exef reviewed Nov 20, 2025

View reviewed changes

Debugger022 added 2 commits November 20, 2025 16:52

fix: fix unit and fork test

e21d01b

Merge branch 'feat/swapper' into feat/swapRouter

85f2930

Exef force-pushed the feat/swapper branch from d13c1e3 to 36b894e Compare December 10, 2025 10:09

Exef and others added 17 commits December 15, 2025 13:38

Merge branch 'develop' into feat/swapRouter-develop-merge

e233965

test: update unit test for swapRouter

215a735

Merge pull request #31 from VenusProtocol/feat/swapRouter-develop-merge

059cd0a

Swap Router - merge develop to update SwapHelper

fix: tests

a5bf806

test: update swapRouter fork tests

e6add02

feat: add swapRouter bscmainnet deployment

9f06257

feat: updating deployment files

de928dd

feat: add swapNativeAndRepayFull function

4487e12

feat: L-01

594b4ff

feat: L-05

aeb20e1

refactor: consolidate slippage check in repayFull

f042ecd

feat: I-01

0f8abbe

feat: add SwapRouter audits

50a4993

Merge pull request #45 from VenusProtocol/fix/VPD-458

f949020

[VPD-458]: Cyfrin Audit Fixes for SwapRouter

Merge pull request #43 from VenusProtocol/fix/vpd-440

6b3774d

[VPD-440]: Pashov Audit Fixes for SwapRouter

feat: add deployments

d1d28c0

feat: updating deployment files

41bb9e0

Debugger022 changed the title ~~Swap Router~~ [VPD-479]: Swap Router Jan 21, 2026

Debugger022 added invalid This doesn't seem right Ready and removed invalid This doesn't seem right labels Jan 30, 2026

Debugger022 and others added 4 commits February 23, 2026 15:16

Merge branch 'develop' into feat/swapRouter

ec44ad8

feat: add barrel Interfaces.sol to re-export split interface files

1db1685

Prevents duplicate artifact errors (HH701) by making Interfaces.sol a re-export file pointing to contracts/Interfaces/*.sol, preserving the import path used by SwapRouter without requiring redeployment.

feat: updating deployment files

8de1ccf

chore: clean up .gitignore duplicates and organize sections

65165ef

fred-venus merged commit c4a7e6b into develop Feb 24, 2026
4 checks passed

claude bot added the claude-code-assisted label Feb 25, 2026

		if (vToken == NATIVE_VTOKEN) {
		return address(wrappedNative);

		IERC20Upgradeable(token).safeApprove(vToken, 0);
		IERC20Upgradeable(token).safeApprove(vToken, amount);

		uint256 debtAmount = IVToken(vToken).borrowBalanceCurrent(msg.sender);
		if (debtAmount == 0) revert ZeroAmount();

Conversation

Debugger022 commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fred-venus Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

fred-venus Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Debugger022 commented Oct 17, 2025 •

edited

Loading

fred-venus Nov 20, 2025 •

edited

Loading

fred-venus Nov 20, 2025 •

edited

Loading