Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
Uniswap/v4-core
main @ 46c6834
15
Fixes
0
CVEs
CRITICAL
Peak severity
57.1%
Coverage
Highlights
Input Validation: 4 prior fixes. Scrutinize any change in this area.
contracts/PoolManager.sol: most-fixed (3 issues). Treat as high-risk during review.
9 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Double Spend: A critical flaw allowed settling the same asset twice and draining reserves; the fix enforces strict sync/send/settle rules and resets currency state after ERC20 settle. This is the highest-impact risk and must not regress.
Authorization Bypass: The settle function lacked a recipient restriction, allowing unauthorized settlement on behalf of others. The fix added a recipient argument and settleFor restriction; any alternate settlement path must enforce the same.
Reentrancy: Lock mechanism was index-based, enabling reentrancy via multiple locks by the same address. Fixed to address-based single-lock tracking; any new callback or lock path must preserve this invariant.