Stale-approval exposure on deprecated router
Uniswap (v2 + v3)'s assessment for RD-F-168 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
SwapRouter v1 (0xE592427A) and SwapRouter02 (0x68b34658) remain deployed with active user ERC-20 approvals outstanding. No formal revoke-notice issued by Uniswap Labs. Both old routers are immutable and audited, substantially limiting exploit risk. Yellow: known hygiene issue in low-risk immutable context.
Detail #
SwapRouter v1 (0xE592427A) and SwapRouter02 (0x68b34658) are both immutable contracts that remain deployed. Users who granted token approvals to these routers for swapping have not received a protocol-side notification to revoke. The practical exploit risk is low since: (1) both contracts are immutable and audited; (2) neither has a malicious function that could drain approvals arbitrarily; (3) any exploit would require a previously-unknown vulnerability in the router logic. However, outstanding approvals to superseded routers represent residual attack surface if a zero-day were found. Approximate stale-approval count not available without allowance scanner. Quantitative assessment is limited.
Sources #
- DocsUniswap V3 Ethereum deploymentsProfile §3: SwapRouter v1 and v2 listed as deployed but superseded by UniversalRouterretrieved 2026-05-12
- SwapRouter v1 on EtherscanSwapRouter v1 (0xE592427A): still deployed, active; no deprecation noticeretrieved 2026-05-12
Methodology #
Count the number of active user approvals (ERC-20 `allowance`) to deprecated router or protocol contracts.
See the full factor methodology and distribution across all protocols →