OpenZeppelin audits Uniswap SwapProxy and Periphery: 17 findings, two Medium

OpenZeppelin published a new differential audit of Uniswap router components on October 8, 2026 (report page). It covers three in-flight PRs: Universal Router #469 (the proxy-based swap flow, "SwapProxy") at commit 7181245, Universal Router #470 (v2.1.1) at c908caf, and v4-periphery #516 (per-hop slippage, output/input ratio flip) at d6d0656. Seventeen issues: 0 Critical, 0 High, 2 Medium, 7 Low, 8 Notes. Nine were resolved on Uniswap's side across the fix commits cc89977, b0162a9, 22ee596, 74ff047, 0296654, 0f447d0, d20dca1, ef061d4, e7f31a6, a262eb8; eight were acknowledged without changes.

This is a separate audit from the OpenZeppelin review that landed on the same day covering Universal Router #457 (cross-chain via Across) and v4-periphery #497 (per-hop slippage). Different PRs, different scope, different numbers.

Scope

• Universal Router #469 — SwapProxy. Introduces a proxy that executes swaps on behalf of the caller, so interactions with hook-equipped pools and Permit2 flows run under a known-safe context. OpenZeppelin audited the proxy itself and its interaction with existing router commands.
• Universal Router #470 — v2.1.1. A point release wrapping the SwapProxy changes with miscellaneous additions.
• v4-periphery #516 — per-hop slippage, output/input ratio flip. The v4 Position Manager and single-swap paths were extended with per-hop slippage checks and the slippage expression was flipped from (input/output) to (output/input), bringing it in line with the quoter.

The two Medium findings

Resolved — cc89977. Incorrect Bounds Check in toLengthOffset May Disable Per-Hop Slippage Protection. OpenZeppelin flagged that the slippage-array decoder's length check allowed trailing array elements to be omitted. Missing elements would decode as zero, which > comparisons against zero never fail — silently disabling the per-hop slippage check for the affected hops. The fix adds an explicit minimum-length guard.

This is the finding that matters. Per-hop slippage is one of v4's few native defenses against intra-route sandwich manipulation. A silent fallback to no-protection on short arrays is a classic "safe by default is actually unsafe here" bug, and it would not have surfaced in happy-path tests.

Acknowledged, not resolved. Division by Zero in Exact-Output Swaps Panics on Hook-Subsidized Pools. OpenZeppelin flagged that an exact-output swap through a pool where a hook subsidises or injects liquidity could land on a zero denominator in a ratio step and panic. Uniswap's response, quoted in the report: "this is not a Medium severity issue." The team's position is that hook-subsidised exact-output flows are an opt-in corner case and a panic is an acceptable outcome.

The gap matters because the panic terminates the swap, which from the caller's perspective is a soft DoS on specific liquidity configurations. It is not a loss-of-funds bug.

Notable Low and Note findings

• Low (resolved, 74ff047). Non-Mint Action Streams Allowed in V4_POSITION_MANAGER_CALL. The position-manager action router accepted non-mint action streams in a path where it should have required mint. Fix adds INCREASE_LIQUIDITY_FROM_DELTAS to the allowed set.
• Low (resolved, 22ee596). Solmate SafeTransferLib silently succeeds on non-contract token addresses. The library's documented behavior is to return true on EOA call targets. Documented as a known footgun in the fix commit.
• Low (acknowledged). Possible Division-by-Zero Panic When Per-Hop Slippage Is Enabled for Uniswap V2 Swaps. V2 path, no fix.
• Note (acknowledged). Fee-on-transfer tokens incur a double fee through SwapProxy. Team response: "continue to encourage all integrators to use Permit2." FoT handling via the proxy is an integrator choice, not a protocol guarantee.
• Note (acknowledged). Malicious token hooks can interact with the router during SwapProxy execution. Hook authors have access to the proxy during a swap; isolation is left to integrators.
• Note (acknowledged). Missing tests for SwapProxy. OpenZeppelin otherwise described the codebase as "well-structured and well-tested."

Numbers

• Total findings: 17
• Critical: 0 · High: 0 · Medium: 2 · Low: 7 · Notes & Additional Information: 8
• Resolved: 9 (Medium 1, Low 6, Notes 2)
• Acknowledged, not resolved: 8 (Medium 1, Low 1, Notes 6)
• Audit date: October 8, 2026
• Fix commits: cc89977, b0162a9, 22ee596, 74ff047, 0296654, 0f447d0, d20dca1, ef061d4, e7f31a6, a262eb8

For integrators

1. Pin to a post-fix router commit. cc89977 is the one that re-enables per-hop slippage protection on short arrays. Any front end or aggregator building against SwapProxy that pins an earlier commit should rebase before mainnet rollout.
2. FoT token flows via SwapProxy need an integrator-side wrapper. Permit2 is the recommended path per Uniswap. Routing FoT through SwapProxy is a double-fee footgun.
3. Hook-pool exact-output paths can panic. Treat the panic as an expected failure mode and surface it to users; do not retry blindly.
4. Test coverage for SwapProxy is light on Uniswap's side at the time of audit. Integrators building production flows should contribute harness tests.

Context

Uniswap's current audit cadence runs two parallel review streams: one on the cross-chain intent surface (the Across-bridged ChainedActions flow in #457, reviewed in the sibling report) and one on the proxy-based swap flow and v4 periphery (this report). The pattern is a short-cycle differential review per PR cluster at a specific commit, with Uniswap landing fix commits before the audit is published. That is a materially different posture from the pre-v4 cadence of one annual full-code audit, and it is the posture that has produced the clean count of zero Critical and zero High findings here.