Quantum Audit Logo

Is Uniswap Safe?

On-chain security analysis — is it a scam or legit?

Is this your token? Publish your own audit on this page →

Uniswap UNI
0x1f98…f984
Ethereum Not verifiedLast checked 3d ago 1 audit on record
DexScreener ↗
How is this score calculated? → High Risk
Executive SummaryAI Copilot

The Uni contract implements an ERC-20 token with governance delegation and a controlled minting mechanism. The contract correctly utilizes OpenZeppelin's SafeMath library to prevent integer overflows/underflows, which is appropriate for its Solidity version. A key centralization risk exists with the `minter` role, which has significant control over token supply, albeit with defined limits. The contract is not upgradeable, ensuring immutability.

1 High1 Low1 Informational
Volume 24h
$11.75M
Liquidity
$18.12M
Price
$6.3200
Token Age
5y
Top 10 Holders
52.3%

Security Findings

1 High1 Low1 Info
High

Centralized Minter Role

H-01The `minter` address has the sole authority to mint new tokens, subject to `mintCap` and time constraints. This represents a significant centralization risk (7.3 Access Control, 7.4 Economic). If the `minter`'s private key is compromised, an attacker could inflate the token supply up to the `mintCap` per year, devaluing existing tokens. The `setMinter` function allows the current minter to transfer this critical role, which is also a high-privilege operation.
IssueThe `minter` address has the sole authority to mint new tokens, subject to `mintCap` and time constraints. This represents a significant centralization risk (7.3 Access Control, 7.4 Economic). If the `minter`'s private key is compromised, an attacker could inflate the token supply up to the `mintCap` per year, devaluing existing tokens. The `setMinter` function allows the current minter to transfer this critical role, which is also a high-privilege operation.
FixConsider decentralizing the `minter` role by assigning it to a robust multi-signature wallet (e.g., Gnosis Safe) or a community-governed smart contract. This would require multiple approvals for minting operations or role transfers, significantly reducing the risk of a single point of failure.
StatusUnresolved
Low

Potential High Gas Costs for Checkpoints

L-01The `_writeCheckpoint` function stores historical vote data for each account. While necessary for the governance delegation mechanism, if an account frequently delegates or transfers tokens, the `numCheckpoints` for that address could grow very large. This could lead to increased gas costs for subsequent `_writeCheckpoint` operations or for reading historical vote data (7.8 Operations).
IssueThe `_writeCheckpoint` function stores historical vote data for each account. While necessary for the governance delegation mechanism, if an account frequently delegates or transfers tokens, the `numCheckpoints` for that address could grow very large. This could lead to increased gas costs for subsequent `_writeCheckpoint` operations or for reading historical vote data (7.8 Operations).
FixWhile this is an inherent design choice for Compound-style governance, consider monitoring the growth of `numCheckpoints` for highly active addresses. For future iterations, explore alternative checkpointing strategies or gas optimization techniques if this becomes a significant operational burden.
StatusUnresolved
Info

Older Solidity Compiler Version

I-01The contract is compiled with Solidity version `^0.5.16`. While `SafeMath` is correctly used to prevent integer overflows/underflows, newer Solidity versions (e.g., 0.8.x) include built-in overflow/underflow checks by default, making external libraries like `SafeMath` largely redundant and potentially saving gas (7.2 Code Security). Newer compilers also offer additional language features and security improvements.
IssueThe contract is compiled with Solidity version `^0.5.16`. While `SafeMath` is correctly used to prevent integer overflows/underflows, newer Solidity versions (e.g., 0.8.x) include built-in overflow/underflow checks by default, making external libraries like `SafeMath` largely redundant and potentially saving gas (7.2 Code Security). Newer compilers also offer additional language features and security improvements.
FixFor future contract deployments or upgrades, consider migrating to a more recent Solidity compiler version (e.g., 0.8.x). This would allow for the removal of `SafeMath` library calls, simplifying the code and potentially reducing gas costs, while benefiting from the latest compiler optimizations and security features.
StatusUnresolved

Category Ratings

TechnicalLow7/10

The contract demonstrates good code security practices by using OpenZeppelin's `SafeMath` library to prevent arithmetic overflows/underflows (7.2 Code Security). The implementation of ERC-20, EIP-712 signatures for `permit` and `delegateBySig`, and the Compound-style delegation mechanism are standard and well-understood (7.1 Architecture). However, the use of an older Solidity compiler version (`^0.5.16`) means reliance on `SafeMath` is necessary, whereas newer versions offer built-in checks, and the gas cost for updating vote checkpoints could become substantial for accounts with many historical delegations (7.8 Operations).

GovernanceHigh1/10

The contract incorporates a robust governance delegation system, allowing token holders to delegate their voting power, which is a strength for decentralized decision-making (7.5 Governance). Economically, the `minter` role holds significant power to inflate the token supply, albeit constrained by a `mintCap` of 2% and a `minimumTimeBetweenMints` of one year (7.4 Economic). The centralization of the `minter` role presents a single point of failure for token supply control (7.3 Access Control).

UpgradesMedium4/10

The contract is not designed with an upgrade mechanism (e.g., proxy pattern), meaning its logic is immutable once deployed (7.7 Upgrades). This eliminates upgrade-related risks such as proxy misconfigurations or malicious upgrade implementations. However, it also means that any future bug fixes or feature enhancements would require a new contract deployment and migration of assets.

Security Checklist

2/5 checks passed
Contract VerifiedPass
Ownership RenouncedFail
No Mint FunctionFail
Liquidity LockedFail
Not a ProxyPass

Holder Composition

52.3% in top 10
24.4% in wallets28.0% in contracts
Effective Concentration35.6%

Share held by contracts — treasury, vesting, bridge or staking — is discounted against share held by wallets when the score is computed: a contract cannot decide to sell the way an anonymous holder can, though it can still be drained or voted to sell. Effective concentration is the figure the risk score is actually calculated from.

Liquidity Depth

$42.89M across 22 pairs
Uniswap v3WETHanalysed$18.12M42.2%Uniswap v4ETH$4.50M10.5%Uniswap v3WETH$3.91M9.1%Uniswap v4USDC$3.79M8.8%Uniswap v2WETH$3.62M8.4%Uniswap v4AAVE$3.19M7.4%
Show 4 more pairsShow less
Uniswap v3USDT$2.00M4.7%Uniswap v3USDC$1.85M4.3%Uniswap v3WETH$412.8K1.0%Uniswap v3WBTC$408.2K1.0%

The 12 remaining pairs hold $1.09M between them and are not listed.

The risk score reads depth across every pair. The volume figure and the volume-to-liquidity ratio elsewhere on this page describe only the pair this audit analysed, so the two are not directly comparable.

Key Addresses

1 addresses
Deployer
0x4165…2cfb

What Raised This Score

6 factors
  • Ownership NOT renounced (admin/mint authority retained)
  • Mintable supply, but capped at 2.0%/year
  • Top-10 concentration > 30% (52.3% total → 35.6% effective; 24.4% in EOAs, 28.0% in contracts — moderate)
  • Liquidity NOT locked (owner can withdraw — rug-pull risk)
  • 1 High finding(s) from audit
  • 1 Low finding(s) from audit

Each factor is an on-chain fact recorded at the time of this analysis. The score is computed from them by a deterministic function, so the same contract returns the same score for anyone who runs the audit. How scores are computed

Frequently Asked Questions

Is Uniswap a scam?

Based on the data, Uniswap (UNI) does not exhibit typical scam characteristics; its contract is verified, and no mint function exists, preventing arbitrary supply inflation. However, non-renounced ownership and significant token concentration (52.3% by top 10 holders) introduce centralization risks. While these contribute to its 'High Risk' score of 68/100 and warrant caution, they do not inherently categorize Uniswap as a scam.

Is Uniswap safe to buy?

UNI carries a 'High Risk' score (68/100) due to several factors. Contract ownership is not renounced, and liquidity is unlocked, raising concerns about administrative control over token parameters or market stability. Additionally, 52.3% of the supply is concentrated among the top 10 holders. These factors suggest potential for centralized influence, meaning investors should exercise elevated caution and conduct thorough due diligence.

Has Uniswap been audited?

The Uniswap (UNI) contract is verified, meaning its deployed bytecode matches the publicly available source code. This offers transparency for community review. However, contract verification differs from a comprehensive security audit, which involves expert analysis to identify vulnerabilities and logic flaws. The provided data confirms verification but does not explicitly indicate a full security audit has been performed.

Related Audits

6 more on the record
RelicsHigh RiskBIOHigh RiskVirtuals Protocol (VIRTUAL)High RiskDerive (DRV)High RiskLido DAO (LDO)High RiskFOXHigh Risk

Would You Like a More Detailed Audit of Uniswap?

Our AI-powered scanner gives you a deeper, real-time smart contract analysis — free, with every scoring factor shown.

Get Detailed Audit