Executive brief
Uniswap Universal Router is a smart contract that enables decentralized token swaps and liquidity management. A reentrancy vulnerability in versions before 1.1.0 could allow an attacker to exploit improper authorization checks during contract execution, potentially enabling theft of user funds from the router.
Technical details
The vulnerability is a reentrancy flaw (CWE-667, CWE-863) in Uniswap Universal Router's authorization logic. The issue stems from improper handling of reentrancy protection, allowing attackers to bypass authorization checks by making recursive calls into the contract before state is properly updated. The attack requires network access to interact with the smart contract on the blockchain; no authentication is needed as the contract is publicly accessible. An attacker can exploit this to steal funds by repeatedly calling vulnerable functions before the contract's internal state is locked. The vulnerability was patched in version 1.1.0 with proper reentrancy locks.
Affected products
- Uniswap Universal Router before 1.1.0
Timeline
- 2023-01-04: disclosed: Advisory published
- 2022-11-28: patched: Fix merged in version 1.1.0