Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix broken V2 bug bounty link + add security and glossary pages for V3 and V4. #840

Open
wants to merge 7 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ The report also has a "Design Comments" section that we highly recommend for gai

# Bug Bounty

Uniswap has an open and ongoing bug [bounty program](https://uniswap.org/bug-bounty/).
Uniswap has an open and ongoing bug [bounty program](https://cantina.xyz/bounties/f9df94db-c7b1-434b-bb06-d1360abdd1be) on Cantina.

# Considerations when building on Uniswap

Expand Down
64 changes: 64 additions & 0 deletions docs/contracts/v3/concepts/01-protocol-overview/01-glossary.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
---
id: glossary
title: Glossary
---

### Automated market maker

An automated market maker is a smart contract on Ethereum that holds on-chain liquidity reserves. Users can trade against these reserves at prices set by an automated market making formula.

### Concentrated liquidity

A key concept of Uniswap V3, this is liquidity that is allocated within a custom price range as opposed to being uniformly spread across the entire price interval (0, ∞).

### ERC20

ERC20 tokens are fungible tokens on Ethereum. Uniswap supports all standard ERC20 implementations.

### Flash swap

A trade that uses the tokens being purchased before paying for them.

### Liquidity provider / LP

A liquidity provider is someone who deposits ERC20 tokens into a given liquidity pool. Liquidity providers take on price risk and are compensated with trading fees.

### Mid price

The price between the available buy and sell prices. In V3, this is the ratio of the two ERC20 token reserves available within the current active tick.

### Pair

A smart contract deployed from the Uniswap V3 Factory that enables trading between two ERC20 tokens. Pair contracts are now called Pools in V3.

### Pool

A contract deployed by the V3 factory that pairs two ERC-20 assets. Different pools may have different fees despite containing the same token pair. Pools were previously called Pairs before the introduction of multiple fee options.

### Price impact

The difference between the mid-price and the execution price of a trade.

### Slippage

The amount the price moves in a trading pair between when a transaction is submitted and when it is executed.

### Tick interval

The area of price space between two nearest active ticks.

### Ticks

Ticks are the boundaries between discrete price ranges. A change of 1 Tick always represents a price change of 0.01% from the current price.

### Core

Smart contracts that are essential for Uniswap to exist. Upgrading to a new version of core would require a liquidity migration.

### Factory

A smart contract that deploys a unique smart contract for any ERC20/ERC20 trading pair.

### Periphery

External smart contracts that are useful, but not required for Uniswap to exist. New periphery contracts can always be deployed without migrating liquidity.
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"label": "Protocol Overview",
"position": 1
}
23 changes: 23 additions & 0 deletions docs/contracts/v3/concepts/02-advanced-topics/01-security.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
---
id: security
title: Security
---

# Audits

In early 2021, ABDK Consulting performed a general security review and thereafter published an audit report for the Uniswap V3 core contracts in March 2021 prior to its release.

> [Read the report](https://github.com/Uniswap/v3-core/blob/main/audits/abdk/audit.pdf)

In April 2021, ABDK Consulting also published an audit report for the Uniswap V3 Periphery contracts.

> [Read the report](https://github.com/Uniswap/v3-periphery/blob/main/audits/abdk/audit.pdf)


During the week of January 4th, 2021 and from February 15th to March 12th, three engineers from Trail of Bits conducted a security review on the Uniswap V3 core contracts and subsequently published an audit report including results from [Echidna end-to-end tests](https://github.com/Uniswap/v3-core/tree/main/audits/tob#end-to-end-testing-with-echidna) and [verification](https://github.com/Uniswap/v3-core/tree/main/audits/tob#verification-with-manticore) from the symbolic execution tool Manticore.

> [Read the report](https://github.com/Uniswap/v3-core/blob/main/audits/tob/audit.pdf)

# Bug Bounty

Uniswap has an open and ongoing bug [bounty program](https://cantina.xyz/bounties/f9df94db-c7b1-434b-bb06-d1360abdd1be) on Cantina.
4 changes: 4 additions & 0 deletions docs/contracts/v3/concepts/02-advanced-topics/_category_.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"label": "Advanced Topics",
"position": 2
}
5 changes: 5 additions & 0 deletions docs/contracts/v3/concepts/_category_.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
{
"label": "Concepts",
"position": 2,
"collapsed": false
}
80 changes: 80 additions & 0 deletions docs/contracts/v4/concepts/01-protocol-overview/01-glossary.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,80 @@
---
id: glossary
title: Glossary
---

### Automated market maker

An automated market maker is a smart contract on Ethereum that holds on-chain liquidity reserves. Users can trade against these reserves at prices set by an automated market making formula.

### Concentrated liquidity

This is liquidity that is allocated within a custom price range as opposed to being uniformly spread across the entire price interval (0, ∞).

### Dynamic fees

Uniswap V4 supports dynamic fees, allowing pools to adjust their fees up or down. While other AMMs may have hard-coded logic for dynamic fees, V4 provides no opinionated calculation of the fee.

### ERC20

ERC20 tokens are fungible tokens on Ethereum. Uniswap supports all standard ERC20 implementations.

### Flash accounting

An optimization introduced in V4 that leverages EIP-1153's Transient Storage to reduce gas costs by consolidating balance changes into a single net update, eliminating intermediate balance transfers.

### Flash swap

A trade that uses the tokens being purchased before paying for them.

### Liquidity provider / LP

A liquidity provider is someone who deposits ERC20 tokens into a given liquidity pool. Liquidity providers take on price risk and are compensated with trading fees.

### Mid price

The price between the available buy and sell prices. This is the ratio of the two ERC20 token reserves available within the current active tick.

### Native ETH

Uniswap V4 supports native tokens, allowing ETH swappers and liquidity providers to benefit from cheaper transfers and the removal of wrapping costs.

### Pool

In Uniswap V4, pools are initialized as unique poolKey structs and managed entirely within the singleton contract, reducing gas costs by eliminating separate deployments for each pool.

### Pool key

A crucial struct in Uniswap V4 that uniquely identifies a liquidity pool. It encapsulates all the essential parameters that define a pool's characteristics.

### Pool manager

The single entry point for every liquidity pool, all pool state and logic are contained within this contract.

### Price impact

The difference between the mid-price and the execution price of a trade.

### Slippage

The amount the price moves in a trading pair between when a transaction is submitted and when it is executed.

### Singleton Design

Uniswap V4 introduces a single-contract architecture for managing pools, eliminating individual deployments, which drastically reduces gas costs for pool creation and multi-token swaps.

### Tick interval

The area of price space between two nearest active ticks.

### Ticks

Ticks are the boundaries between discrete price ranges. A change of 1 Tick always represents a price change of 0.01% from the current price.

### Core

Smart contracts that are essential for Uniswap to exist. Upgrading to a new version of core would require a liquidity migration.

### Periphery

External smart contracts that are useful, but not required for Uniswap to exist. New periphery contracts can always be deployed without migrating liquidity.
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"label": "Protocol Overview",
"position": 1
}
4 changes: 4 additions & 0 deletions docs/contracts/v4/concepts/02-core-concepts/_category_.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"label": "Core Concepts",
"position": 2
}
31 changes: 31 additions & 0 deletions docs/contracts/v4/concepts/03-advanced-topics/01-security.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
---
id: security
title: Security
---

# Audits

Uniswap's V4 core contracts have undergone a handful of extensive security reviews by multiple providers, with some reviews still ongoing. Below is a list of completed and draft reports. The full list can be found in the respective repositories' [audits directory](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits):

> [Open Zeppelin report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/OpenZeppelin_audit_core.pdf) from July 17th 2024.

> [Certora draft report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/DRAFT_Certora_audit_core.pdf) from July 2024.

> [Trail of Bits report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/TrailOfBits_audit_core.pdf) from September 5th 2024.

> [Spearbit draft report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/DRAFT_Spearbit_audit_core.pdf) from September 5th 2024.

> [ABDK draft report](https://github.com/Uniswap/v4-core/blob/main/docs/security/audits/DRAFT_ABDK_audit_core.pdf) from September 5th 2024.


Similarly, the V4 periphery contracts have been reviewed by various audit providers, and the full list is inside the periphery repository's [audits directory](https://github.com/Uniswap/v4-periphery/tree/main/audits):

> [Open Zeppelin report](https://github.com/Uniswap/v4-periphery/blob/main/audits/OpenZeppelin_audit_periphery_universal_router.pdf) from September 5th 2024.

> [Spearbit draft report](https://github.com/Uniswap/v4-periphery/blob/main/audits/DRAFT_Spearbit_audit_periphery.pdf) from September 5th 2024.

> [ABDK draft report](https://github.com/Uniswap/v4-periphery/blob/main/audits/DRAFT_ABDK_audit_periphery_universal_router.pdf) from September 5th 2024.

# Bug Bounty

In November 2024 Uniswap announced a [$15.5 million dollar bug bounty](https://blog.uniswap.org/v4-bug-bounty) for their V4 contracts. You can view the full [bounty page](https://cantina.xyz/bounties/f9df94db-c7b1-434b-bb06-d1360abdd1be) on Cantina.
4 changes: 4 additions & 0 deletions docs/contracts/v4/concepts/03-advanced-topics/_category_.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
{
"label": "Advanced Topics",
"position": 3
}