Uniswap (v2 + v3)
Two-version AMM assessment. V2: constant-product AMM, fully immutable, no governance. V3: concentrated-liquidity AMM, immutable core, Compound Bravo DAO governs fee switch and treasury only. Both are original Uniswap Labs designs. Combined TVL ~$2.74B across 10+ chains per version.
DeploymentsEthereum · $1.1B
01
Risk profile at a glance
0 red · 1 yellow · 10 green 02
Categories & evidence
184 factors · 13 categoriesCode & audits Green 6 25 of 25
RD-F-002 yellow Audit recency V2: dapp.org.uk audit dated 2020 (~72 months ago). V3: ToB + ABDK audits dated March 2021 (~50 months ago). Both are fully immutable — audit recency is structurally less critical than for upgradeable systems; no code can change post-deploy. Governance contracts (GovernorBravoDelegator, Timelock) have no dedicated recent audit — the most meaningful recency gap. Cantina live bounty ($2.25M) provides ongoing coverage incentive. Scored yellow: V2 (72 months) is the worse version. RD-F-009 yellow Formal verification coverage V3: ToB applied Manticore to BitMath and LiquidityMath properties — all verified. Certora independent FV research archived. V2: dapp.org.uk performed formal verification of v2-core. No comprehensive invariant list with full FV coverage for either version. Math primitives verified; economic invariants not fully covered. Combined: yellow. RD-F-010 yellow Static-analyzer high-severity count No published Slither/Mythril/Semgrep high-severity report on deployed V2 or V3 core bytecode found. ToB used Manticore; ABDK used mathematical review. V3-core CI mentions MythX. 5-6 year exploit-free record provides corroborating evidence. Marked [?] needs tool run for strict compliance. RD-F-024 yellow Code complexity vs audit coverage V3: ToB 3 engineers 10 person-weeks; ABDK comprehensive (159 issues). Manticore + Echidna + manual review provides multi-method tick-math coverage. V2: dapp.org.uk review + formal verification. AMM code well-covered. Governance contracts (GovernorBravoDelegator, Timelock) outside audit scope — main complexity-coverage gap. Scored yellow for governance audit gap. RD-F-021 n/a UUPS _authorizeUpgrade correctly permissioned V2 and V3 core contracts are immutable (not UUPS proxies). No _authorizeUpgrade function exists. UniversalRouter and Permit2 are also non-upgradeable. GovernorBravoDelegator uses EIP-897 delegate proxy for governance logic, not UUPS upgradeable AMM contracts. Not applicable. RD-F-023 n/a Constructor calls _disableInitializers() V2 and V3 core contracts are not OZ-proxy implementation contracts. _disableInitializers() is an OZ UUPS/Transparent proxy pattern irrelevant to directly-deployed immutable contracts. Not applicable to either version.
RD-F-001 green Audit scope mismatch V2: dapp.org.uk (2020) report commit consistent with deployed immutable V2 bytecode; Etherscan source verified. V3: Etherscan Exact Match on Factory (0x1F98431c8aD98523631AE4a59f267346ea31F984) with v1.0.0 tag commit e3589b1 (May 4 2021). ToB high-severity findings (TOB-UNI-005, TOB-UNI-009) confirmed resolved before v1.0.0 tag. Post-v1.0.0 commits are network config only. Governance contracts not in ToB/ABDK scope — gap, not mismatch. Combined: green.
RD-F-003 green Resolved-without-proof findings V3: ToB 2 high-severity findings (TOB-UNI-005, TOB-UNI-009) confirmed resolved pre-launch via DeFiSafety and V3 launch blog. ABDK 159 minor findings described as all resolved; Etherscan Exact Match corroborates. V2: dapp.org.uk 2 medium + 1 low issues; report states all addressed pre-launch. No evidence of high/critical findings marked resolved without verifiable on-chain fix. Combined: green.
RD-F-004 green Audit count V2: dapp.org.uk (1 firm, formal verification). V3 core: Trail of Bits + ABDK (2 firms). V3 periphery: ABDK (v3-periphery), OZ + Spearbit + ABDK (UniversalRouter), ABDK + Chainsecurity (Permit2). System-wide: 5 distinct firms. Combined >=2 distinct firms with Tier-1 representation. Green.
RD-F-005 green Audit firm tier Trail of Bits (Tier-1), ABDK Consulting (Tier-1/2), OpenZeppelin (Tier-1), Spearbit (Tier-1 boutique), Chainsecurity (Tier-2, formal methods), dapp.org.uk (Tier-2 with formal verification). At least 2 Tier-1 firms (ToB, OZ) audited deployed code. Green.
RD-F-006 green Audit-to-deploy gap V3: ToB signed off March 12 2021; ABDK core approximately March 23 2021; launch May 5 2021. Audit-to-deploy: ~43 days (ABDK) to 54 days (ToB) — both under 60-day threshold. V2: dapp.org.uk review completed April 2020; launch May 18 2020 — within 60 days. Both versions: green.
RD-F-007 green Bug bounty presence & max payout Cantina bug bounty active: $2,250,000 maximum payout. Covers V2, V3, UniswapX, Universal Router, Permit2, web interface, and other Uniswap Labs-deployed contracts where user funds are at risk. One of the largest DeFi bug bounties. Contact: security@uniswap.org. Green.
RD-F-008 green Ignored bounty disclosure V2: zero direct protocol exploits in 6+ years; no documented ignored disclosures. V3: zero protocol-level exploits; 2022 phishing was social engineering not a protocol vulnerability. V2 oracle consumer failures (Visor, Inverse) are consumer protocol failures not V2 failures. Green.
RD-F-011 green SELFDESTRUCT reachable from non-admin path V3: UniswapV3Pool.sol and UniswapV3Factory.sol — no selfdestruct or suicide calls. Pool deployer uses CREATE2 via `new UniswapV3Pool{salt:...}()` — not a selfdestruct factory. V2: UniswapV2Pair.sol and Factory — fully immutable, no admin paths, no selfdestruct. Green.
RD-F-012 green delegatecall with user-controlled target V3: Pool inherits NoDelegateCall; noDelegateCall modifier on key functions and Factory createPool(). No user-controlled delegatecall. V2: No delegatecall patterns in UniswapV2Pair (Solidity 0.5.x, constant-product AMM). Green.
RD-F-013 green Arbitrary call with user-controlled target V3: Pool uses typed callback interfaces (IUniswapV3MintCallback, IUniswapV3SwapCallback, IUniswapV3FlashCallback) — no generic call(target, data) with user-controlled target. Callback target is msg.sender. V2: Flash swap calls IUniswapV2Callee(to).uniswapV2Call() on transaction-supplied `to` — intentional by design, same address that initiated the swap. Green.
RD-F-014 green Reentrancy guard on external-calling functions V3: Custom lock modifier (slot0.unlocked flag) applied to mint, burn, swap, flash, setFeeProtocol. Equivalent to nonReentrant. V2: Custom lock modifier (unlocked uint) applied to mint, burn, swap, skim. Both versions protected. Green.
RD-F-015 green ERC-777/1155/721 hook without reentrancy guard V3: Core pool accepts ERC-20 via standard transfer() only; pool-level lock protects against ERC-777 callbacks. NFT (NFPM periphery) not in core. V2: ERC-20 only. Neither version integrates ERC-777/1155/721 hooks without reentrancy guards. Green.
RD-F-016 green Divide-before-multiply pattern V3: Custom fixed-point math (FullMath, FixedPoint96, SqrtPriceMath, TickMath) uses 256-bit intermediates to avoid precision loss. ABDK mathematical audit (159 issues) found no divide-before-multiply high severity. V2: Constant-product formula uses simple arithmetic with no complex division ordering. 5-6 year exploit-free record. No tool run available — confidence medium.
RD-F-017 green Mixed-decimals math without explicit scaling V3: sqrtPriceX96 (Q64.96 fixed-point) and raw token amounts — decimal normalization is integrator responsibility. V2: Constant-product invariant uses raw token amounts; no cross-decimal arithmetic. No known mixed-decimals exploit in V2 or V3 core. Green.
RD-F-018 green Signed/unsigned arithmetic confusion V3: ToB Manticore verified BitMath and LiquidityMath properties; ABDK mathematical review included invariant checking. int24 ticks, uint160 sqrtPrice — carefully typed. No signed/unsigned confusion finding in any audit across V2/V3. 5-6 year exploit-free record. Confidence medium (no direct tool run).
RD-F-019 green ecrecover zero-address return unchecked V3: UniswapV3Pool.sol has no ecrecover calls in core pool. Permit2 implements ecrecover, audited by ABDK + Chainsecurity. V2: No ecrecover in core pair. No unchecked ecrecover return in core contracts. Green.
RD-F-020 green EIP-712 domain separator missing chainId V3: UniswapV3Pool.sol has no EIP-712 domain separator — no signed-message patterns in core pool. Permit2 implements EIP-712 with chainId, audited by ABDK + Chainsecurity. V2: No EIP-712 in core pool. Green.
RD-F-022 green Public initialize() without initializer modifier V2: UniswapV2Pair initialize() protected by `require(msg.sender == factory)` — only factory can call, in same deployment transaction. V3: UniswapV3Pool initialize() protected by `require(slot0.sqrtPriceX96 == 0, 'AI')` — cannot be re-initialized. Factory calls initialize() atomically. 5+ years, thousands of pools, zero exploit. Combined: green.
RD-F-183 green Bug bounty scope gap on highest-TVL contracts Cantina bug bounty ($2.25M max) explicitly covers V2 and V3 smart contracts, Universal Router, Permit2, and other Uniswap Labs-deployed contracts where user funds are at risk. Highest-TVL contracts (V2 ~$968M, V3 ~$1.78B) are in scope. No bounty scope gap on highest-TVL contracts. Combined: green.
Governance & admin Green 7 24 of 24
RD-F-034 yellow Guardian/pause-keeper distinct from upgrader V2: not applicable (immutable, no governance). V3: no guardian/pause-keeper role exists on V3 core contracts or governance. GovernorBravo cancel() is proposer-vote-based (not a guardian veto). No emergency fast-response capability. Combined: yellow (absence of guardian on V3 governance). RD-F-039 yellow delegatecall/call in proposal execution without allowlist V2: not applicable (no governance). V3: Timelock.executeTransaction() uses target.call() with no target allowlist. Any passed proposal can call any contract. Mitigated by .call() (not delegatecall — cannot corrupt Timelock storage), 7-day vote, 40M UNI quorum, 2-day delay, and Seatbelt transparency. Combined: yellow (not red — .call() without allowlist is material but less severe than delegatecall pattern). RD-F-040 yellow Emergency-veto multisig present V2: not applicable (no governance). V3: no guardian or emergency-veto multisig exists. GovernorBravo cancel() is proposer-vote-based (not a guardian veto). No fast circuit-breaker. The 2-day Timelock window is the only post-vote defense. Combined: yellow. RD-F-047 yellow Governance token concentration (Gini) V2: no governance token. V3: UNI has known concentration — a16z holds ~55M UNI (~5.5% supply), sufficient for independent quorum (40M). Binance delegated 13.2M (second-largest voter). Top-5 holders control substantial share. Gini likely >0.80. Combined: yellow. RD-F-026 n/a Upgrade multisig signer configuration (M/N) V2: Immutable (display='Immutable'). V3: DAO model — no fixed signer set (display='DAO'). No Safe multisig in either governance chain. Data cache: safe_multisigs=[]. Combined: not_applicable. RD-F-029 n/a Multisig signers co-hosted No multisig in admin chain for either version. Factor requires a multisig with fixed signers to evaluate co-hosting risk. Not applicable for DAO governance with no fixed signer set, and not applicable for immutable V2. RD-F-030 n/a Hot-wallet signer flag No multisig in admin chain for either version. Factor requires a multisig to evaluate hot-wallet signer risk. Not applicable. RD-F-031 n/a Signer rotation recency No multisig in admin chain for either version. Factor requires a multisig to evaluate signer rotation recency. V2: immutable, no governance. V3: DAO model with no fixed signer set to rotate. Not applicable.
RD-F-025 green Admin key custody type V2: Immutable (feeToSetter=address(0), no admin). V3: Full DAO+Timelock — GovernorBravo → 2-day Timelock controls limited fee/treasury surface. Combined: green (both versions at top tier of admin custody classification).
RD-F-027 green Single admin EOA V2: no admin (immutable, feeToSetter=address(0)). V3: GovernorBravoDelegator admin = Timelock contract 0x1a9C8182 (not an EOA). No single EOA holds any upgrade/owner/rescue role on either version. Combined: green.
RD-F-028 green Low-threshold multisig vs TVL V2: no governance (not applicable for threshold comparison). V3: no multisig in admin chain; governance bar is 40,000,000 UNI (4% of total supply) — far exceeds any peer-norm multisig threshold. Combined: green.
RD-F-032 green Timelock duration on upgrades V2: not applicable (immutable). V3: Timelock delay = 172,800 seconds (48 hours / 2 days). Maximum delay = 2,592,000 seconds (30 days). Above the 48h green threshold. Combined: green.
RD-F-033 green Timelock on sensitive actions V2: no sensitive actions exist (immutable). V3: all sensitive actions route through Timelock. No bypass path exists for mint, fee switch, or enableFeeAmount. Core pools are immutable — no pause or upgrade action exists. Combined: green.
RD-F-035 green Role separation: upgrade ≠ fee ≠ oracle V2: no roles (immutable). V3: upgrade path = immutable (no upgrader role on core). Fee enablement = Timelock. Oracle config = N/A (V3 does not consume external oracle). V3FeeAdapter.feeSetter = Timelock. Two-of-applicable-three roles are Timelock — acceptable for a DEX with no oracle role. Combined: green.
RD-F-036 green Flash-loanable voting weight V2: not applicable (no governance). V3: UNI uses checkpoint-based voting via getPriorVotes() at proposal.startBlock. Flash-loan-acquired UNI cannot influence a vote as checkpoint block precedes any flash loan. Beanstalk-class risk does not apply. Combined: green.
RD-F-037 green Quorum achievable via single-entity flash loan V2: not applicable (no governance). V3: quorum of 40M UNI is not achievable via flash loan (checkpoint system prevents this). Even without checkpoints, 40M UNI at reference DEX depth is not available in a single flash loan. Combined: green.
RD-F-038 green Proposal execution delay < 24h V2: not applicable (no governance). V3: voting period = 40,320 blocks (~7d) + voting delay = 13,140 blocks (~2.3d) + Timelock delay = 2 days. Total minimum from proposal creation to execution = ~11 days. No sub-24h path exists. Combined: green.
RD-F-041 green Rescue/emergencyWithdraw without timelock V2: not applicable (no admin, no rescue function). V3: no rescue or emergencyWithdraw on any contract — Factory, Pools, NFPM, UniversalRouter, Permit2. All core contracts are immutable with no token recovery function. Combined: green.
RD-F-042 green Admin has mint() with unlimited max V2: no mintable token under admin control. V3: UNI token mint capped at 2%/year with 365-day minimum gap (mintCap=2, minimumTimeBetweenMints=31,536,000s). No V3 pool or factory contract has a protocol-token mint function. Combined: green.
RD-F-043 green Admin = deployer EOA after 7 days V2: feeToSetter renounced to address(0) at/shortly after launch — no admin retained. V3: GovernorBravoDelegator admin=Timelock since deployment in 2021; original deployer ('Uniswap V3: Old Deployer') holds no current admin. Combined: green.
RD-F-044 green Admin wallet interacts with flagged addresses V2: no admin wallet (immutable). V3: Timelock and GovernorBravo are contract addresses, not EOA wallets — they interact only with governance-submitted transactions. Legacy minter EOA (0x41653c7d, 'Uniswap Protocol deployer') shows no mixer/OFAC interactions. Combined: green.
RD-F-045 green Constructor args match governance proposal V2: no governance proposal for direct launch; feeToSetter later renounced as designed — no silent deviation. V3: governance docs confirm Timelock as factory owner at deployment; GovernorBravo upgrade was governance-approved. UNI token constructor args verified via Etherscan. Combined: green.
RD-F-046 green Contract unverified on Etherscan/Sourcify V2: UniswapV2Factory and UniswapV2Router02 verified on Etherscan at launch. V3: all core contracts verified at or near launch — Factory, GovernorBravoDelegator and implementation, Timelock, UNI Token, NonfungiblePositionManager. V3FeeAdapter (Dec 2025) verified with Solidity 0.8.29. Combined: green.
RD-F-167 green Deprecated contract paused but pause reversible by live admin V2: no admin over any V2 contract (immutable). V3: SwapRouter v1 and SwapRouter02 remain deployed but both are immutable with no admin/pause. V3 governance does not retain a reversible pause over any deprecated surface. Combined: green.
Oracle & external dependencies Green 0 17 of 17
RD-F-048 n/a Oracle providers used No external oracle providers consumed by V2 or V3 core contracts. V2 uses constant-product AMM invariant (x*y=k), reading internal _reserve0/_reserve1. V3 uses concentrated-liquidity invariant, reading slot0.sqrtPriceX96. Both EXPOSE TWAP oracles outbound (V2 via cumulative price accumulators; V3 via Oracle.sol observe()) but consume none. 19 Chainlink feeds in data cache cleared as false positives — not called by any V2 or V3 contract. RD-F-049 n/a Oracle role per asset No oracle consumed by V2 or V3; no per-asset oracle role classification applicable. Both versions are AMM price-discovery mechanisms, not oracle consumers. V2 swap pricing uses getReserves(); V3 swap pricing uses sqrtPriceX96 from slot0. RD-F-051 n/a Fallback behavior on oracle failure No oracle dependency; fallback concept N/A. V3 TickMath bounds (MIN_SQRT_RATIO/MAX_SQRT_RATIO) are internal AMM invariant limits preventing invalid states — not oracle fallback logic. V2 MINIMUM_LIQUIDITY constant is an internal safety invariant. Neither version has a primary oracle to fall back from. RD-F-053 n/a Oracle source = spot DEX pool (no TWAP) [CRITICAL — not_applicable] Neither V2 nor V3 consumes any external oracle for swap pricing. V2 swap pricing uses on-chain _reserve0/_reserve1 (constant-product invariant). V3 swap pricing uses slot0.sqrtPriceX96 (concentrated-liquidity invariant). V2 EXPOSES a TWAP via cumulative price accumulators; V3 EXPOSES a TWAP via Oracle.sol observe(). Neither reads from any external DEX oracle or push oracle. Zero external oracle imports in V2 or V3 core confirmed by source inspection. Data-cache Chainlink feeds are false positives. RD-F-054 n/a TWAP window duration No TWAP consumed by V2 or V3. V3 exposes TWAP via Oracle.sol observe() with caller-defined secondsAgos[] parameter — the window is consumer-defined, not V3-defined. V2 TWAP window is defined by the consuming protocol when computing cumulative price deltas. Factor asks about consumed TWAP windows; N/A by construction. RD-F-055 n/a Oracle pool depth (USD) No upstream DEX-TWAP oracle consumed by V2 or V3. V2 and V3 ARE the pools that downstream TWAP consumers read. No upstream pool depth to measure for V2 or V3's own risk. RD-F-056 n/a Single-pool oracle (no medianization) No external oracle venue used by V2 or V3; single-pool vs medianized oracle distinction is N/A. Neither version reads from any oracle venue. RD-F-057 n/a Circuit breaker on price deviation No external oracle consumed; no circuit breaker against external price reference needed or implemented. V3 TickMath bounds on sqrtPriceX96 are internal AMM invariants preventing invalid states — not circuit breakers against an external oracle. V2 has no equivalent circuit breaker concept in its AMM design. RD-F-058 n/a Max-deviation threshold (bps) No circuit breaker against external oracle; no deviation threshold configured or applicable. N/A by same basis as F057 — no oracle price comparison surface exists in V2 or V3. RD-F-059 n/a Oracle staleness check present No external oracle feed consumed; no staleness check applicable. V2 blockTimestampLast is updated on every swap/sync in the same block. V3 sqrtPriceX96 is written on every swap() call in the same transaction — always current by construction. No external feed updatedAt timestamp to check. RD-F-060 n/a Chainlink aggregator min/max bound misconfig No Chainlink feeds consumed by V2 or V3 core or periphery. 19 Chainlink feeds in data cache confirmed false positives — not called by any V2 or V3 contract. Zero IChainlinkAggregator or AggregatorV3Interface imports in UniswapV2Pair.sol, UniswapV2Router02.sol, UniswapV3Pool.sol, or SwapRouter.sol. RD-F-180 n/a Immutable oracle address [CRITICAL-CANDIDATE — not_applicable per T-12 PD-017 hold] No oracle address exists in any V2 or V3 contract (immutable or configurable). UniswapV2Factory.sol, UniswapV2Pair.sol, UniswapV3Factory.sol, UniswapV3Pool.sol: zero oracle state variable declarations, zero immutable oracle address fields, no setOracle() function, no oracle adapter wrapper. The immutability risk of F180 requires an oracle address to exist — structurally inapplicable. Flagged for orchestrator tracking per PD-017. NOT counted in the 19 critical total. RD-F-181 n/a Permissionless-pool lending oracle Factor applies to lending protocols that accept spot prices from permissionlessly-created DEX pools as collateral oracle input. Uniswap V2 and V3 are DEX protocols — no lending surface, no collateral, no borrow functionality. N/A by factor definition and protocol type per DEX template.
RD-F-050 green Dependency graph (protocols depended upon) V2 core: zero external protocol dependencies. V3 core: zero external protocol dependencies. V2 and V3 periphery: WETH9 for ETH-path swaps only. WETH9 failure degrades ETH-path routing only; ERC-20/ERC-20 swaps unaffected; no TVL loss. No third-party DeFi protocol (Aave, Curve, Chainlink) in any core call graph.
RD-F-052 green Breakage analysis per dependency Only material external dependency is WETH9 for ETH-path periphery swaps in both V2 and V3. WETH9 freeze disables native-ETH input/output routing only; ERC-20/ERC-20 pool swaps entirely unaffected; no TVL loss vector; no oracle failure mode. Breakage analysis complete and bounded.
RD-F-061 green LP token balanceOf used for pricing Neither V2 nor V3 uses LP token balanceOf for pricing. V2 pricing uses internal _reserve0/_reserve1 state vars (updated only via mint/burn/swap/sync — donation does NOT change reserves until next sync). V3 pricing uses sqrtPriceX96 from AMM invariant. Both read token balanceOf post-swap only for transfer validation, not price determination. Neither version is vulnerable to donation-manipulation of its own pricing.
RD-F-062 green External keeper/relayer not redundant No keeper or relayer dependency in V2 or V3 core. All operations (swap, mint, burn, liquidity management, collect) are fully permissionless synchronous user operations. No Chainlink Automation, Gelato, or custom keeper required for core protocol function. V3Staker is an optional peripheral incentive contract whose failure does not impair core pool swapping.
Economic risk Yellow 22 13 of 13
RD-F-064 yellow TVL concentration (top-10 wallet share) Chain-level: Ethereum holds 68.7% of combined $2.74B TVL. Multi-chain spread across Base (14.5%), Arbitrum (8.3%), BSC (3.7%) mitigates. Wallet-level top-10 share not determinable (Dune 403, NonfungiblePositionManager enumeration not performed). AMM LP structure structurally disperses depositor concentration. Yellow for Ethereum majority concentration. RD-F-065 yellow Liquidity depth per major asset V3 ETH/USDC 0.05% historically $500M-$1B TVL on Ethereum; academic research confirms 3-6x CEX depth for major pairs near mid-price. Long-tail permissionless pools are thin by design. Bimodal distribution: excellent for majors, minimal for long-tail. Precise 2%-slippage depth not computed (Dune 403). Yellow reflects bimodal structure. RD-F-066 n/a Utilization rate (lending protocols) Lending-only factor (taxonomy PD-024). Uniswap V2 and V3 are DEX/AMM protocols with no borrow/supply mechanics in either version. No utilization rate concept exists. Data cache borrow.present=false. RD-F-067 n/a Historical bad-debt events Lending-only factor (taxonomy PD-024). No lending mechanism, collateral system, or socialized loss structure in V2 or V3. Zero protocol-level exploits in 6+ years combined. V2 oracle consumer failures (Visor, Inverse Finance) were downstream protocol failures — not V2 bad-debt events. RD-F-068 n/a Collateralization under stress Lending-only factor (taxonomy PD-024). Neither V2 nor V3 has a collateralization model. Pool reserves are LP-owned assets, not collateral backing borrowed positions. Stress simulation is structurally inapplicable to an AMM. RD-F-069 n/a Algorithmic / under-collateralized stablecoin Lending-only factor (taxonomy PD-024). Uniswap V2 and V3 do not issue any stablecoin. Neither version is a CDP, algorithmic, or partially-collateralized stablecoin design. RD-F-070 n/a Empty cToken-style market (zero supply/borrow) [★ CRITICAL — NOT APPLICABLE] V2 is a constant-product AMM; V3 is a concentrated-liquidity AMM. Neither is a Compound V2 fork. No cToken-style markets, no totalSupply/totalBorrow lending mechanics, no borrow-enable lifecycle, no donation-attack surface. V2 is forked BY SushiSwap/PancakeSwap/QuickSwap — it is NOT a fork of any lending protocol. ★ flag does not fire. RD-F-071 n/a Seed-deposit requirement for new market listing Lending-only factor (taxonomy PD-024). No market-listing lifecycle in V2 or V3. Pool creation for both versions is fully permissionless — any address calls factory createPool() (V3) or createPair() (V2) with no seed deposit requirement. RD-F-072 n/a Market-listing governance threshold Lending-only factor (taxonomy PD-024). DEX-analogue note: V2 pool creation fully permissionless (no governance). V3 pool creation permissionless for enabled fee tiers; new fee tiers require UNI governance enableFeeAmount(). This permissionless listing creates long-tail pool exposure — yellow-class DEX observation flagged for v1.1 factor consideration. RD-F-073 n/a Oracle-manipulation-proof borrow cap Lending-only factor (taxonomy PD-024). No borrow caps in V2 or V3. Neither version consumes any external oracle for swap pricing — both are price discovery mechanisms. Data cache oracle_feeds entries are false positives (feeds reading V2/V3 pool prices, not consumed by core contracts). RD-F-074 n/a ERC-4626 virtual-share offset (OZ ≥4.9) Lending-only factor (taxonomy PD-024). V3 LP positions are ERC-721 NFTs (NonfungiblePositionManager: 0xC36442b4a4522E871399CD717aBDD847Ab11FE88). V2 LP positions are ERC-20 pool tokens using paired-reserve formula. Neither version is an ERC-4626 vault. Share-inflation via virtual offset is structurally inapplicable to both. RD-F-075 n/a First-depositor / share-inflation guard Lending-only factor (taxonomy PD-024). V3 NFT-per-position accounting has no shared exchange rate susceptible to first-depositor inflation. V2 has structural protection: MINIMUM_LIQUIDITY (1000 wei) permanently burned to address(0) on first mint, preventing zero-totalSupply donation attack. Neither version requires an ERC-4626-style guard.
RD-F-063 green TVL (current + 30d trend) Combined TVL $2,744M as of 2026-05-12 (V2: $968M + V3: $1,776M). Both versions individually exceed $100M green threshold. V3 90-day trend declining from ~$2.0-2.5B toward $1.78B; V2 flat. $16.3B/month combined volume. Not at red threshold (<$10M or >50% 30d decline).
Operational history Green 11 15 of 15
RD-F-089 red Insurance coverage active No active protocol-level insurance coverage identified for V2 or V3. Nexus Mutual offers user-level LP cover, not a protocol-level policy. Sherlock does not list Uniswap V2 or V3. No Unslashed or equivalent found. Green threshold (≥5% of $2.74B TVL = ≥$137M) is not met. Contextual note: immutable design + zero exploit record materially reduces practical risk of this gap. Combined: red. RD-F-081 gray Post-exploit response score No prior protocol-level exploits on V2 or V3. Methodology: gray = no prior exploits (N/A). July 2022 phishing was social engineering — no protocol exploit response to score. V2: gray. V3: gray. Combined: gray. RD-F-082 gray Post-mortem published within 30 days No prior protocol-level exploits on V2 or V3. Methodology: gray = no prior incidents (N/A). V2: gray. V3: gray. Combined: gray. RD-F-083 gray Auditor re-engaged after last exploit No prior protocol-level exploits on V2 or V3. Methodology: gray = no prior exploits (N/A). Ongoing preventive audits (Trail of Bits 2021, ABDK 2021, Cantina ongoing) are not post-exploit re-engagements. V2: gray. V3: gray. Combined: gray. RD-F-085 gray Incident response time (minutes) No prior protocol-level exploits on V2 or V3. Methodology: gray = no prior incidents (N/A). V2: gray. V3: gray. Combined: gray. RD-F-086 gray Pause activations (trailing 12 months) V2 core contracts are fully immutable — no pause mechanism by design. V3 core contracts (Pool, Factory) are immutable — no pause mechanism. Methodology: gray = protocol has no pause mechanism (structural N/A). Combined: gray. RD-F-087 gray Pause > 7 consecutive days No pause mechanism on V2 or V3 core contracts. No pause events possible. Methodology: gray = no pause events in last 12 months (structural N/A due to immutable design). Combined: gray.
RD-F-076 green Protocol age (days) V2: live since 2020-05-18 (~1,820 days, ~72 months). V3: live since 2021-05-05 (~1,468 days, ~60 months). Both exceed the ≥365-day green threshold. Among the longest-running TVL-weighted DeFi protocols. Combined: green.
RD-F-077 green Prior exploit count V2: 0 direct protocol exploits in 72 months. V3: 0 direct protocol exploits in 60 months. July 2022 phishing targeted user wallets via social engineering — protocol not exploited. V2 oracle consumer failures (Visor Finance, Inverse Finance) are consumer protocol failures, NOT V2 exploits — V2 TWAP worked as designed. Combined: green (0 direct protocol exploits).
RD-F-078 green Chronic-exploit flag (≥3 incidents) Derived from F077 count = 0 direct protocol exploits. The ≥3 incident threshold for the chronic flag is not met. V2 oracle consumer events are not V2 protocol failures per the scoping instruction and PD-022. Combined: green.
RD-F-079 green Same-root-cause repeat exploit Zero direct protocol exploits. Same-root-cause repeat is structurally impossible at 0 incidents. The V2 TWAP consumer pattern (multiple downstream protocols misusing V2 TWAP) does not constitute a V2 protocol failure repeat per the scoping instruction. Combined: green.
RD-F-080 green Days since last exploit No direct protocol exploits have ever occurred on V2 or V3. Methodology green state: >365 days OR no incidents. No-incident case: unambiguously green. V2: green. V3: green. Combined: green.
RD-F-084 green TVL stability (CoV over 90d) Data cache null for combined slug (pipeline gap — requires separate pulls for uniswap-v2 and uniswap-v3). Qualitative: V2 ~flat ($968M per profile); V3 declining ~10–11% over 90d from ~$2.0–2.5B to ~$1.78B — implies CoV well below 0.15 green threshold. No TVL collapse event observed. V3 prior 30d change: +8.64%. Combined: green.
RD-F-088 green Re-deployed to new addresses in last year V2 core (Factory, Pair implementations) deployed 2020-05-18: immutable, redeployment impossible by design. V3 core deployed 2021-05-05: immutable. No full redeployment to new addresses in trailing 12 months (May 2025–May 2026). Ethereum deployment addresses unchanged since original launch dates. V2: green. V3: green. Combined: green.
RD-F-166 green Deprecated contracts still holding value No contracts formally deprecated by protocol announcement hold >$100K. SwapRouter v1 is engineering-superseded but not formally deprecated — remains on official deployments page. V2 and V3 are both live with $2.74B combined TVL. V2 feeToSetter renouncement is a hardening action, not a deprecation. Combined: green.
Real-time signals Green 14 22 of 22
RD-F-090 yellow Mixer withdrawal → protocol interaction V2+V3 combined: Bybit hack Feb-Mar 2025 — Lazarus Group routed ~$39M through Uniswap pools as a public DEX venue during laundering (Allium confirmed). This is adversarial venue use, NOT protocol exploitation or admin-surface interaction. Outside 30-day assessment window (>12 months elapsed). No current mixer-to-Uniswap precursor pattern identified in 30-day window. Yellow: immutable AMM cannot block mixer-funded swappers; signal permanently applicable as venue but not fireable against admin surface. RD-F-105 yellow DNS/CDN/frontend hash drift V2+V3 combined: Highly applicable — app.uniswap.org and uniswap.org serve one of the highest-TVL DEX frontends globally (~$2.74B combined). No current DNS/frontend compromise detected (2026-05-12). No TLS cert anomaly identified. CRITICAL GAP: No JS bundle hash baseline established — static assessment cannot definitively clear without active monitoring. 2022 phishing was fake LP airdrop token, NOT DNS/frontend compromise of main interface. Yellow: high-brand-recognition elevates attack probability; monitoring infrastructure not yet live. RD-F-109 yellow Social-media impersonation scam spike V2+V3 combined: Uniswap is one of the highest-brand-recognition DeFi protocols globally — impersonation is endemic and documented. Blockaid token warning integration deployed as defensive measure. 2022 phishing attack ($4.7-8M fake LP airdrop) demonstrates established adversarial brand exploitation. No coordinated spike >=5 accounts confirmed in current 30-day window from public sources. Yellow: sustained structural impersonation risk above baseline for any high-TVL DEX; signal infrastructure not configured. RD-F-091 n/a Partial-drain test transactions V2+V3 combined: V2 and V3 core contracts are immutable — no protocol-level admin-key drain is structurally possible. Neither version has a 5-year protocol-level exploit history. Signal deferred per T-09 methodology (v1 deferred set). Static dry run cannot establish a drain-precursor baseline without live mempool monitoring. RD-F-092 gray Unusual mempool pattern from deployer wallet V2+V3 combined: Data cache deployer.address = null (pipeline gap). V3 operative deployer = Uniswap Labs (corporate entity); V3 core contracts are immutable post-deploy — deployer has no live privileged role. V2 deployer feeToSetter renounced — also no live privileged role. Signal not actionable for immutable protocol deployers with no live admin role; mempool monitoring not configured. RD-F-093 gray Abnormal gas-price willingness from attacker wallet V2+V3 combined: V2 and V3 are not oracle-reading protocols — MEV attack races (gas-price willingness) targeting oracle manipulation are structurally inapplicable to the core AMM. MEV arbitrage bots routinely pay elevated gas for Uniswap swaps; this is expected normal operation, not an attack signal. Requires live mempool monitoring not available in static assessment. RD-F-094 gray New contract with similar bytecode to exploit template V2+V3 combined: No V2 or V3 core exploit template exists in published form (zero direct protocol-level exploits in 6+ years of combined operation). SIR.trading (March 2025) used V3 callbacks against a downstream protocol — not a V3 core exploit. No exploit-template deployment detected. Requires bytecode-similarity index not available in static assessment. RD-F-095 gray Known-exploit function-selector replay V2+V3 combined: No known V2 or V3 core exploit function-selector pattern exists (zero protocol-level exploits in history). V2 TWAP consumer failures exploited downstream logic, not V2 selectors. Requires exploit-template DB and selector-pattern index not available in static assessment. Gray per methodology. RD-F-096 gray New ERC-20 approval to unverified contract from whale V2+V3 combined: User-level signal, not protocol-level. Permit2 (0x000000000022D473030F116dDEE9F6B43aC78BA3) is the canonical V3 approval management contract — approvals to it are expected and benign. No approvals from high-TVL V3 LPs to unverified contracts detected from public sources. Signal infrastructure (user-level approval monitoring) not configured in static assessment. Gray per methodology. RD-F-097 gray Sybil surge of identical-pattern transactions V2+V3 combined: V2 and V3 are permissionless AMMs — high transaction volumes from many addresses are expected normal operation. Sybil-surge attacks are applicable to protocols with permissionless-pool oracle surfaces (Rhea Finance class); V2/V3 AMM model does not accept oracle inputs from permissionless pools. Signal not fireable against this architecture in static assessment. Gray per methodology. RD-F-099 n/a Oracle price deviation >X% from secondary V2+V3 combined structural N/A. V2 core uses constant-product invariant (x*y=k) — no external oracle consumed for swap pricing. V3 core uses constant-product invariant within tick ranges — no external oracle consumed. Both V2 and V3 EXPOSE TWAP oracles outbound but do not CONSUME any oracle. 19 Chainlink feeds in data cache are false positives (feeds reading V3 TWAP output or interface artifacts, not feeds consumed by V2/V3 core). Signal structurally inapplicable. RD-F-102 n/a Admin/upgrade transaction in mempool V2+V3 combined structural N/A. V2 Factory (0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f): feeToSetter = address(0) — fully immutable, no admin tx possible. V3 Factory (0x1F98431c8aD98523631AE4a59f267346ea31F984): no owner, no admin, no proxy, no upgrade path. V3 GovernorBravoDelegator governance txs go through 2-day timelock after DAO vote — expected governance process, not surprise admin pattern. No admin/upgrade tx structurally possible for V2 or V3 core. RD-F-103 n/a Bridge signer-set change proposed/executed V2+V3 combined structural N/A. Uniswap V2 and V3 do not operate any cross-chain bridge. Multi-chain deployments are independent factory/router deployments on each chain with no cross-chain message-passing. LayerZero: not present (data cache: layerzero.present: false). UNI token canonical bridges are operated by L2 networks, not Uniswap. No signer set to monitor. RD-F-104 n/a Stablecoin depeg >2% on shared-LP venue V2+V3 combined structural N/A. V2 and V3 core swap pricing uses constant-product invariant — no external stablecoin dependency for protocol solvency or swap execution. No lending market (data cache: borrow.present: false). Stablecoin depegs affect LP economic positions but not V2/V3 protocol solvency or swap function. Signal threshold condition (protocol exposure >=5% TVL in a way affecting solvency) is structurally inapplicable for AMMs. RD-F-106 n/a Cross-chain bridge unverified mint pattern V2+V3 combined structural N/A. Uniswap V2 and V3 do not operate a cross-chain bridge. No deposit-source / mint-destination pattern is possible. LayerZero: not present (data cache: layerzero.present: false). N/A confirmed. RD-F-107 gray Admin EOA signing from new geography/device V2+V3 combined: Off-chain signing telemetry not available in static assessment. V3 governance uses on-chain DAO (not a multisig EOA set) — geographic/device anomaly monitoring is inapplicable to a DAO where votes are cast by thousands of UNI holders. V2 has no governance. Gray per methodology — structural signal mismatch for DAO governance; always gray in static assessment. RD-F-110 gray Unusual pending/executed proposal ratio V2+V3 combined: Signal requires on-chain ProposalCreated/ProposalExecuted event ratio monitoring from GovernorBravoDelegator (0x408ED6354d4973f66138C91495F2f2FCbd8724C3). V2 has no governor. V3 governance activity in 2026: UNIfication/tokenomics proposals — coordinated and purposeful, not anomalous. Signal infrastructure (governance baseline analytics) not configured in static assessment. Gray: ratio cannot be computed without continuous tracking baseline. RD-F-182 n/a Security-Council threshold reduction (RT) V2+V3 combined structural N/A. F182 monitors Security Council multisig threshold reductions (Drift Protocol pattern: 3/5 to 2/5 + timelock removal 6 days before $285M DPRK exploit). V2 has no governance and no multisig. V3 has no Security Council multisig — governance is a full DAO (GovernorBravoDelegator + 2-day Timelock) with no fixed signer set. V3 core contracts are immutable with no admin. No threshold-reduction event is possible in V2/V3 governance architecture.
RD-F-098 green TVL anomaly — % drop in <1h V2+V3 combined: V2 TVL ~$968M, V3 TVL ~$1,776M, combined ~$2.744B (DefiLlama, 2026-05-12). 30d trend: V3 declining from ~$2.0-2.5B toward current ~$1.78B; V2 approximately flat. No acute drop event in assessment window. Threshold: >30% drop in <1h vs 30d baseline. Delta: materially unbreached. Zero combined protocol-level exploit history in 6+ years. Signal would NOT fire today.
RD-F-100 green Flash loan >$10M targeting protocol tokens V2+V3 combined: V3 is itself a flash-loan provider (Pool.flash()). Signal fires when flash loan >=10M interacts with protocol oracle, lending market, or governor. V3 has no oracle consumed and no lending market. V3 governance uses checkpoint-based UNI voting — flash-loan governance manipulation structurally impossible. V2 has no governance. No flash-loan governance attack detected. Signal effectively non-fireable for V2/V3 given their architecture.
RD-F-101 green Large governance proposal queued V2+V3 combined: V2 has no governance. V3: GovernorBravoDelegator (0x408ED6354d4973f66138C91495F2f2FCbd8724C3) is live and active. UNIfication/tokenomics proposals executed March 2026 — healthy governance activity. No malicious-pattern indicators: no new-wallet proposer, no admin-role-change calldata (V3 core immutable so such calls impossible anyway), no flash-loanable quorum (checkpoint voting design), no delegatecall to non-allowlisted targets. 2-day Timelock (172,800s delay) intact. Signal would NOT fire today.
RD-F-108 green GitHub force-push to sensitive branch V2+V3 combined: V3 core (github.com/Uniswap/v3-core) last commit 2026-04-30 per data cache. V2 core (github.com/Uniswap/v2-core) stable, minimal activity expected (fully mature immutable codebase). No public reports of unauthorized force-push to main/production branches in assessment window. V2 and V3 are fully immutable post-deploy — repo changes cannot affect deployed bytecode. Signal would NOT fire today.
Dev identity & insider risk Green 2 16 of 16
RD-F-117 yellow ENS/NameStone identity bound to deployer V3 deployer 0x6c9fc64a53c1b71fb3f9af64d1ae3a4931a5f4e9 does not display a bound ENS name per Etherscan ENS lookup. Address carries Etherscan exchange-validated name tag 'Uniswap V3: Old Deployer' providing equivalent public identity binding. Absence of ENS for a corporate deployer wallet is a minor gap, not a risk signal. Yellow per factor definition. RD-F-184 n/a Real-capital social-engineering persona No curator-verified evidence of any 'team contributor' or 'external integrator' persona using >=1M real-capital deposits to build credibility ahead of a social-engineering attack against Uniswap Labs. The Drift Protocol (Apr 2026, UNC4736) was the motivating in-sample event; Uniswap shows none of the precursor patterns. Uniswap Labs is a US C-corp with fully doxxed leadership — inconsistent with persona-building profile. M-only factor per taxonomy; not_assessed is correct disposition absent positive curator signal per PD-019.
RD-F-111 green Team doxx status Real-name doxxed team at all leadership levels. Hayden Adams (CEO, Founder, Stony Brook University, V3 whitepaper co-author), Mary-Catherine Lader (COO, Harvard Law/Business, Goldman Sachs 2010-2017, BlackRock 2017-2021), Noah Zinsmeister (whitepaper co-author, ZK FM ep 185), Moody Salem (whitepaper co-author). Uniswap Labs is a Delaware C-corp, Brooklyn NY. Highest doxx tier in DeFi.
RD-F-112 green Team public accountability surface Extremely high accountability surface. Hayden Adams: 200k+ X followers, Bloomberg TV, Devcon/ETHDenver/Permissionless/podcast speaker appearances. Mary-Catherine Lader: full Goldman Sachs and BlackRock career history on LinkedIn. Noah Zinsmeister: ZK FM ep 185 co-guest, Semantic Scholar-indexed whitepaper co-author. All core principals score 4-5/5 on OSINT depth.
RD-F-113 green Team other-protocol involvement history No prior rug or exit-scam affiliations for any team member. Hayden Adams' only protocol is Uniswap (founded 2018 with V1). VC-backed by a16z, Paradigm, USV — all conducted standard diligence. 2022 class action about third-party token issuers dismissed with prejudice 2026-03-03. No REKT.news entries attributing any Uniswap Labs principal to prior exploits.
RD-F-114 green Deployer address prior on-chain history V3 operative deployer 0x6c9fc64a53c1b71fb3f9af64d1ae3a4931a5f4e9 has 31 total transactions exclusively comprising V3 protocol deployment and transfer transactions from May 2021 onward. Etherscan-labeled 'Uniswap V3: Old Deployer' on Ethereum and Arbitrum. No prior rug deployment history. Classification: normal-dev-history (clean). V2 deployer is historical only with contracts now fully immutable.
RD-F-115 green Prior rug/exit-scam affiliation No team member linked to a prior rug or exit-scam protocol. The 2022 class action was about third-party token issuers using Uniswap's platform as infrastructure, not Uniswap team members creating rug tokens. Case dismissed with prejudice 2026-03-03. No Chainalysis or REKT.news report attributing any Uniswap Labs principal to a rug event.
RD-F-116 green Contributor tenure at admin-permissioned PR V3 core contracts are fully immutable — no admin-permissioned code changes possible post-deploy. All core contributors (Adams since 2018, Zinsmeister since ~2018-2019, Salem since ~2019-2020) are long-tenured (5-7+ years). V2 contracts also fully immutable. Governance changes require full 7-day on-chain vote plus 2-day timelock before execution. No short-tenure contributor with privileged access identified.
RD-F-118 green Handle reuse across failed/rugged projects No evidence of handle reuse across failed or rugged projects. Twitter/X @haydenzadams active since 2018 with consistent Uniswap identity. Noah Zinsmeister's GitHub handle (NoahZinsmeister) consistent and associated only with Uniswap work. No alter-ego aliases detected via OSINT.
RD-F-119 green Commit timezone consistent with stated geography Uniswap Labs is headquartered in New York, NY (EST/EDT timezone). No anomalous UTC+9/UTC+8 commit clustering (DPRK implant indicator) reported by any threat-intelligence source. Data cache shows GitHub v3-core last commit 2026-04-30. Full commit-hour distribution analysis not performed (requires GitHub API); OSINT-negative basis with medium confidence.
RD-F-120 green Video-off/voice-consistency flag Hayden Adams is extensively video-on in public appearances: Bloomberg TV, Devcon, ETHDenver, Permissionless, Twitter Spaces, multiple YouTube-recorded conference talks. Mary-Catherine Lader similarly video-on across LinkedIn posts and public events. No voice or geography inconsistency flagged by any journalist, researcher, or curator.
RD-F-121 green Contributor OSINT depth score OSINT depth score 5/5 for core team. Hayden Adams: LinkedIn with full employment history (Stony Brook University, Mechanical Engineering), Blockworks speaker profile, Semantic Scholar-indexed whitepaper co-authorship, multi-year consistent X presence, Bloomberg TV appearances. Mary-Catherine Lader: Harvard Law/Business School, Goldman Sachs (Special Situations, 2010-2017), BlackRock (Global Head Digital Sustainability + COO Digital Wealth, 2017-2021), full LinkedIn history. All named principals have deep multi-source corroboration.
RD-F-122 green Contributor paid to DPRK-cluster wallet No evidence of contributor payment routing within 3 hops to DPRK cluster. Uniswap Labs is a VC-funded Delaware C-corp paying salaries in USD fiat. On-chain protocol payments transit Compound Bravo governance Timelock and Foundation multisig — not direct deployer-to-contributor paths. No OFAC SDN entry for any Uniswap Labs contributor. DPRK adversarial DEX use (Bybit 2025) is categorically different from contributor payment proximity.
RD-F-123 green Sudden admin-rescue/ACL change without discussion [CRITICAL — GREEN] V3 core contracts (Factory 0x1F98431c8aD98523631AE4a59f267346ea31F984, Pool implementations) are fully immutable: no owner, no admin key, no upgrade proxy. Admin-rescue events are structurally impossible on core. All governance/periphery changes require complete Compound Bravo process: Temperature Check -> Consensus Check -> On-chain Proposal -> 7-day voting -> 2-day Timelock -> execution. No undiscussed admin change found in 2024-2025. V2 also fully immutable (feeToSetter = address(0)).
RD-F-124 green Deployer wallet mixer-funded within 30 days [CRITICAL — GREEN] V3 operative deployer 0x6c9fc64a53c1b71fb3f9af64d1ae3a4931a5f4e9 funded by Coinbase 33 (US-regulated CEX, Etherscan-labeled) approximately at V3 launch ca. May 2021. Coinbase is definitively not a mixer. Deployer has 31 total visible transactions; none involve Tornado Cash, Railgun, or any other mixer. 30-day pre-deploy window clean with zero mixer interaction. V2 deployer not analyzed per combined-slug operative-version rule.
RD-F-125 green Deployer linked within 3 hops to DPRK/Lazarus [CRITICAL — GREEN] 1-hop from V3 deployer is Coinbase 33 (US-regulated, OFAC-compliant entity). No OFAC SDN hits on deployer or any 1-hop counterparty. No Chainalysis-labeled DPRK/Lazarus address in visible transaction graph. DPRK adversarial laundering through Uniswap V3 pools (Bybit hack 2025) is permissionless third-party DEX usage — does not constitute 3-hop deployer proximity. No rubric-level F-trigger. No escalation required.
Fork / dependency lineage Gray 0 10 of 10
RD-F-126 n/a Is-a-fork-of Both V2 and V3 are original Uniswap Labs protocols, not forks of any upstream. V2 redesigned from V1 by the same team. V3 is an entirely new concentrated-liquidity design independent of V2. No upstream fork relationship in either GitHub repo. Pre-marked per profile flag `cat_8_not_applicable_both_versions: true`. RD-F-127 n/a Upstream patch not merged No upstream exists for V2 or V3. Factor not applicable by construction. RD-F-128 n/a Upstream vulnerability disclosure (last 90d) No upstream exists. V2 and V3 ARE the canonical originals that others fork. Factor not applicable. RD-F-129 n/a Code divergence from upstream (%) No upstream to diff against. Code divergence from upstream is not measurable — there is no upstream. Original protocol. RD-F-130 n/a Fork depth (generations from original audit) V2 and V3 are at fork depth 0 — they ARE the canonical originals. Both have their own direct audits (not inherited audits). Factor not applicable. RD-F-131 n/a Fork retains upstream audit coverage Not a fork — upstream audit retention question is moot. All audits are original direct engagements. RD-F-132 n/a Fork has different economic parameters than upstream Not a fork — no upstream economic parameters to deviate from. V2 and V3 define their own original economic parameters. Factor not applicable. RD-F-133 n/a Dependency manifest uses unpinned versions Pre-marked not_applicable per combined-slug Cat 8 rule. For record: V3-core package.json has empty production dependencies. UniversalRouter uses unpinned solmate (no commit SHA in .gitmodules) — mitigated by multi-firm audit coverage of UniversalRouter. V2-core: no security-critical npm deps. RD-F-134 n/a Dependency had malicious-release incident (last 90d) Pre-marked not_applicable. V3-core has no npm production dependencies. UniversalRouter uses solmate — no flagged malicious release for solmate in last 90 days as of 2026-05-12. Factor not applicable per pre-mark. RD-F-135 n/a Shared-library version with known-vuln status Pre-marked not_applicable. V3-core has no OZ or Solady dependency. UniversalRouter uses solmate; no current high/critical GHSA advisory for solmate. Permit2 uses its own implementation, audited. Factor not applicable per pre-mark.
Post-deploy hygiene & change mgmt Green 3 13 of 13
RD-F-168 yellow Stale-approval exposure on deprecated router SwapRouter v1 (0xE592427A) and SwapRouter02 (0x68b34658) remain deployed with active user ERC-20 approvals outstanding. No formal revoke-notice issued by Uniswap Labs. Both old routers are immutable and audited, substantially limiting exploit risk. Yellow: known hygiene issue in low-risk immutable context. RD-F-142 n/a Storage-layout collision risk across upgrades V2: not applicable (direct deployment, not upgradeable). V3: not applicable (no proxy pattern on core contracts; GovernorBravoDelegator has not been re-deployed). No storage layout changes possible by design for either version. Combined: not_applicable. RD-F-143 n/a Reinitializable implementation (no _disableInitializers) V2: not applicable (direct constructors, no proxy-initializer pattern). V3: not applicable (Factory/Pool use direct constructors; GovernorBravoDelegator uses EIP-897 delegation to immutable GovernorBravoDelegate; Permit2 and UniversalRouter are immutable stateless contracts). Combined: not_applicable. RD-F-185 n/a Bridge rate-limiter / chain-pause as positive mitigant Not applicable. Uniswap V2 and V3 are DEX protocols, not bridges. No outflow rate-limiter and no chain-pause mechanism is applicable. Profile meta: has_bridge_surface=false, is_a_bridge=false. Data cache: layerzero.present=false.
RD-F-136 green Deployed bytecode matches signed release tag V2: deployed 2020-05-18; source verified on Etherscan; audited bytecode = deployed bytecode by construction (no proxy). V3: Factory and Pool contracts deployed May 2021; Etherscan 'Exact Match' verification; audited from specific pre-launch commits. Both versions match audited source.
RD-F-137 green Upgrade frequency (per 90 days) V2: zero upgrades possible (immutable). V3: zero upgrades in trailing 90 days on core contracts. GovernorBravoDelegator implementation unchanged. V3FeeAdapter deployed ~132 days ago as a new contract (outside 90d window). Combined: green.
RD-F-138 green Hot-patch deploys without timelock (last 30 days) V2: not possible (immutable). V3: zero hot-patches in last 30 days. No V3 core contract modified. All governance actions route through the 2-day Timelock. No direct deployment outside governance process detected. Combined: green.
RD-F-139 green Post-audit code changes without re-audit V2: not applicable (immutable). dapp.org (2020) audited bytecode = deployed bytecode by construction. V3: not applicable (immutable). Trail of Bits (Mar 2021) and ABDK (Mar-Apr 2021) audited bytecode = deployed bytecode. GovernorBravo implementation stable post-upgrade. Combined: green.
RD-F-140 green Fix-merged-but-not-deployed gap V2: immutable; no deployment possible for fixes even if needed. V3 core: immutable. GitHub v3-core shows no open security-critical PRs awaiting deployment. Zero exploits in 5+ combined years confirm no known unaddressed vulnerabilities. Combined: green.
RD-F-141 green Test-mode parameters in deploy V2: no test-mode artifacts; dapp.org audit confirmed production readiness; feeToSetter renounced as designed. V3: no test-mode parameters; Factory deployed with Timelock as owner; ABDK audit confirmed production readiness (159 minor issues all resolved pre-launch). Combined: green.
RD-F-144 green CREATE2 factory permits same-address redeploy V3 Factory uses CREATE2 with salt=keccak256(token0,token1,fee); requires pool==address(0) before creating — prevents same-address redeploy with different bytecode. V2 uses CREATE for pair deployment — same pool address re-use is minimal risk (pair already exists). Combined: green.
RD-F-145 green Deployed bytecode reproducibility V2: source verified on Etherscan; Solidity 0.5.16; public GitHub repo (v2-core). V3: source verified on Etherscan (Exact Match); Solidity 0.7.6; hardhat config present; audited from specific pre-launch commits. Build reproducibility well-established for both versions. Combined: green.
RD-F-146 green New contract deploys in last 30 days V2: no new core deployments on Ethereum mainnet in last 30 days. V3: no new V3 core contracts deployed on Ethereum mainnet in last 30 days. V3FeeAdapter was deployed ~132 days ago (outside 30d window). Combined: green.
Cross-chain & bridge Gray 0 12 of 12
RD-F-147 n/a Protocol has bridge surface Protocol has no bridge surface. V2 and V3 multi-chain deployments are independent per-chain factory/router sets with no cross-chain message-passing. Profile §7: has_bridge_surface: false, is_a_bridge: false. Data cache: layerzero.present: false, coverage_flags.layerzero_bridge: false. Multi-chain deployment is via per-chain fork-redeployments (independent immutable factories), not via cross-chain message protocol. RD-F-148 n/a Bridge validator count (M) No bridge; no validator set. N/A by same basis as F147. RD-F-149 n/a Bridge validator threshold (k-of-M) No bridge; no signature threshold. N/A by same basis as F147. RD-F-150 n/a Bridge validator co-hosting No bridge; no validator set; co-hosting question inapplicable. N/A by same basis as F147. RD-F-151 n/a Bridge ecrecover checks result ≠ address(0) [CRITICAL — not_applicable] No bridge signature verification in any V2 or V3 contract. No ecrecover in a bridge message validation context. Permit2 uses EIP-712 ecrecover for token approvals — this is a token-approval flow, not a bridge message verification pattern. No cross-chain message acceptance surface exists in V2 or V3. RD-F-152 n/a Bridge binds message to srcChainId No cross-chain messages sent or received; no srcChainId binding needed. N/A by same basis as F147. RD-F-153 n/a Bridge tracks nonce-consumed mapping No bridge replay protection needed; no cross-chain messages. Nonce-consumed mapping concept N/A. Same basis as F147. RD-F-154 n/a Default bytes32(0) acceptable as valid root [CRITICAL — not_applicable] No Merkle root acceptance in any V2 or V3 contract. No bridge inbox. bytes32(0) default root acceptance is structurally impossible with no bridge. Nomad-class vulnerability surface does not exist. RD-F-155 n/a Bridge validator-set rotation recency No bridge; no validator set rotation. N/A by same basis as F147. RD-F-156 n/a Bridge uses same key custody for >30% validators No bridge; key custodian question inapplicable. N/A by same basis as F147. RD-F-157 n/a Bridge TVL per validator ratio No bridge; no validator count; TVL-per-validator ratio inapplicable. N/A by same basis as F147. RD-F-179 n/a LayerZero OFT DVN config (count, threshold, diversity) No LayerZero OFT integration in V2 or V3. Data cache: layerzero.present: false, oapp_address: null, dvn_addresses: [], dvn_threshold: null, send_lib: null, receive_lib: null. Coverage flag: layerzero_bridge: false. V2 and V3 do not use LayerZero for any cross-chain function.
Threat intelligence & recon Green 8 8 of 8
RD-F-158 yellow Known-threat-actor cluster has touched protocol V2+V3 combined: Allium confirmed ~$39M routed through Uniswap pools during Bybit hack laundering (Feb-Mar 2025, Lazarus Group/DPRK). Adversarial venue use — Lazarus swapping stolen tokens via the public DEX. NOT protocol exploitation, NOT admin-key compromise, NOT reconnaissance against V2/V3 attack surface. Outside 30-day assessment window. No active threat-actor interaction with V2/V3 contracts in current 30-day window. Yellow: documented adversarial venue use (not red: no core-contract attack interaction). RD-F-161 yellow Protocol-impersonator domain registered (typosquat) V2+V3 combined: Official domains: uniswap.org, app.uniswap.org, developers.uniswap.org. Uniswap is among the most-impersonated DeFi brand names globally. 'Unisswap'-style variants confirmed in prior security research. 2022 phishing attack ($4.7-8M) demonstrates adversarial brand exploitation history. 90-day registration window data requires DomainTools API not available in static assessment. Yellow: high-brand-recognition makes elevated typosquat activity highly probable; cannot definitively clear without domain monitoring feed.
RD-F-159 green Attacker wallet pre-strike probe (low-gas failing txs) V2+V3 combined: No low-gas failing transactions from CTI-flagged wallets on V2 or V3 core contracts identified in public-source review in the 30-day assessment window. V2Factory (0x5C69bEe701ef814a2B6a3EDD4B1652CB9cc5aA6f) and V3Factory (0x1F98431c8aD98523631AE4a59f267346ea31F984) show no anomalous failed transaction spikes in available data. Requires live mempool CTI feed for definitive coverage. Green based on available public sources.
RD-F-160 green GitHub malicious-dependency incident touching protocol deps V2+V3 combined: No GHSA advisory flagging a malicious release in a dependency consumed by V2 or V3 in the trailing 90 days identified. V2 core uses Solidity 0.5.16 (immutable deployed bytecode — supply-chain risk only affects new builds, not live deployed contracts). V3 core: GitHub last commit 2026-04-30 (data cache). No npm/PyPI/crates.io advisory found for Uniswap V2 or V3 dependencies. Signal would NOT fire today.
RD-F-162 green Known-exploit-template selector deployed by any address V2+V3 combined: No confirmed exploit-template contract deployment targeting V2 or V3 core contracts identified in the 30-day assessment window. V2 and V3 have zero protocol-level direct exploit history in 6+ years of combined operation — no exploit template for these specific protocols exists in published form. SIR.trading (March 2025) exploited V3 callbacks against a downstream protocol (not V3 core). Requires bytecode-similarity monitoring not configured. Green based on available public sources.
RD-F-163 green Avg attacker reconnaissance time for peer-class protocols V2+V3 combined: Immutable DEX/AMM class. V2 and V3 core contracts have no admin surface for reconnaissance-driven exploitation. V3 governance checkpoint voting blocks flash-loan governance attacks. Zero direct V2/V3 core exploits in 6+ years — no successful attacks from which to measure a reconnaissance window for direct exploitation of V2/V3. Bybit/Lazarus 'reconnaissance' was identifying Uniswap as a liquid public DEX (public knowledge), not targeted exploit reconnaissance. Green for the protocol's own attack surface.
RD-F-164 green Leaked credential on paste/sentry site V2+V3 combined: No paste-site, Sentry.io, or GitHub secret scanner reports referencing Uniswap Labs infrastructure endpoints, API keys, or admin credentials identified from public-source OSINT. Uniswap GitHub org is fully public — no credentials visible in public repos. V2 and V3 core contracts are immutable — even a credential leak for Uniswap Labs servers does not enable protocol-level compromise. Uniswap Labs is a mature corporate entity with established security practices (Cantina $2.25M max bounty). Green based on available public sources.
RD-F-165 green Protocol social channel has scam-coordinator flag V2+V3 combined: Official Discord (discord.gg/uniswap) and governance forum (gov.uniswap.org). No flagged scam-coordinator identified as admin of official Uniswap Discord or governance forum in public-source review. 2022 phishing attack operated via external channels (mass token airdrop), not compromised official channels. Blockaid integration provides defensive detection against token-level scam vectors. Green based on available public sources.
Tooling / compiler / AI Green 17 5 of 5
RD-F-170 yellow Solc version used (known-bug versions flagged) V2-core: Solidity 0.5.16 (EOL). V3-core: Solidity 0.7.6 confirmed (Etherscan: v0.7.6+commit.7338295f, 800 runs). 0.7.6 known bugs: DynamicArrayCleanup (medium), EmptyByteArrayCopy (medium) — neither applies to pool pattern (fixed-layout structs). UniversalRouter: 0.8.26 (no known high/critical bugs). Both V2 and V3 deployed immutably — no recompilation possible. Scored yellow for older compiler versions on known-bug lists. V2 (0.5.16): yellow; V3 (0.7.6): yellow. Combined: yellow. RD-F-174 yellow Dependency tree uses EOL Solidity version V2-core: Solidity 0.5.16 — very old (EOL; 0.5.x series ended ~2020). V3-core: Solidity 0.7.6 — not actively maintained (0.7.x reached legacy status Sept 2020 when 0.8.0 launched). Both contracts immutably deployed — permanently on EOL versions with no upgrade path. UniversalRouter: 0.8.26 (actively supported). V2: yellow (0.5.16 very old/EOL); V3: yellow (0.7.6 EOL/legacy). Combined: yellow. RD-F-171 n/a Bytecode similarity to audited upstream with behavior deviation V2 and V3 are original protocols. No audited upstream exists to compare against for bytecode similarity / behavior deviation (AI-copy risk). This factor applies to AI-generated forks mimicking an audited protocol while deviating in behavior. Not applicable.
RD-F-172 green Repo shows AI-tool co-authorship in critical files No AI co-authorship metadata found in v2-core or v3-core commit history. V2 designed in 2020 (pre-GitHub Copilot GA). V3 designed in 2021 (pre-Copilot GA, June 2022). Last meaningful V3 contract commit was March 2023 (network config). Uniswap/uniswap-ai is developer tooling, not AI-authored protocol code. Green.
RD-F-173 green Team self-disclosure of AI-generated Solidity No public disclosure by Uniswap Labs of AI-generated Solidity in security-critical production contract paths. Uniswap/uniswap-ai is developer tooling, not AI-authored protocol code. Both versions designed 2020-2021, pre-LLM code generation era. Green.
Response & disclosure hygiene Green 17 4 of 4
RD-F-176 yellow Disclosure SLA public No acknowledgment-time SLA published by Uniswap Labs in Cantina program description, v3-core bug-bounty.md, or bug-bounty update blog. 24-hour window in bug-bounty.md is a researcher obligation, not a team response SLA. Practical response quality is good but no formal commitment exists. V2: yellow. V3: yellow. Combined: yellow. RD-F-178 yellow CVE/GHSA advisory issued against protocol GHSA-7m37-cx35-qgmr (CVE-2022-48216) exists for @uniswap/universal-router <1.1.0 (High, CVSS 7.5). Patched pre-deployment — no user funds at risk. Covers V3 periphery (Universal Router), not V3 core or V2 core. V2 core: green (no advisory). V3 core: green (no advisory). V3 periphery: yellow (advisory exists, fully patched). Combined: yellow.
RD-F-175 green Disclosure channel exists Active Cantina bug bounty ($2.25M max, all Uniswap Labs contracts in scope including V2 and V3 core). SIRT contact: security@uniswap.org. Dedaub Universal Router disclosure (2022) was received and fixed pre-deployment — channel is demonstrably functional. V2: green. V3: green. Combined: green.
RD-F-177 green Prior known-ignored disclosure No post-mortem or third-party analysis documents a Uniswap Labs disclosure received and not actioned before any incident. Dedaub Universal Router disclosure was received and fixed pre-deployment (no exploit occurred). V2 oracle consumer events involved no Uniswap Labs disclosure loop. Combined: green.
rubric_version v1.7.0 graded_at 2026-05-12 10:36:13 factors 184 protocol uniswap