Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

uniswap/v1-contracts

              master @ c10c08d
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Slippage/Price Manipulation: 3 prior fixes. Scrutinize any change in this area.

contracts/uniswap_exchange.vy: most-fixed (4 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Slippage/Price Manipulation: Lack of strict slippage constraints during exchange operations allows attackers to front-run and manipulate token reserves, causing severe economic loss to liquidity providers and traders. Fixes introduced parameters such as max_tokens, max_eth_sold, and min_eth_bought to guarantee transaction limits are strictly respected.

Slippage / Price Manipulation: Delayed execution of orders can subject users to highly unfavorable execution prices. Introducing minimum output assertions and transaction deadline checks ensures trade requests expire safely if delayed by miners or congested networks.

Access Control: Unprotected initialization allows malicious actors to front-run factory registration on newly deployed exchanges, hijacking the contract's ownership and state variables.