GHSA-7m37-cx35-qgmr
Uniswap Universal Router Incorrect Authorization vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @uniswap/universal-router | < 1.1.0 | 1.1.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-48216
- https://github.com/Uniswap/universal-router/pull/189
- https://github.com/Uniswap/universal-router/commit/d82c6685ef566d9b280651c99f4b93a8454c08a8
- https://github.com/Uniswap/universal-router
- https://github.com/Uniswap/universal-router/compare/v1.0.1...v1.1.0
- https://media.dedaub.com/uniswap-bug-bounty-1625d8ff04ae
- https://twitter.com/dedaub/status/1610058814094450694