Uniswap Labs announces $2.35 million auditing competition, the ‘largest in DeFi history’

Uniswap Labs, the main development company behind the popular Ethereum-based decentralized exchange, is launching a $2.35 million security competition prize pool for its upcoming “v4,” or fourth iteration, release.

“At Uniswap Labs, we’re focused on ensuring v4 is the most audited set of contracts ever deployed onchain,” the Uniswap team said in a statement. The non-profit Uniswap Foundation and web3 auditor network Cantina also support the effort.

The $2.35 million prize pool is said to be the largest in DeFi history. It will go towards funding independent reviews of Uniswap v4’s smart contracts and novel Universal Router system, which enables swaps between ERC-20 tokens and NFTs.

Audit competitions are a common way for teams to discover and patch code vulnerabilities that could be exploited by attackers, and are especially important in crypto given that once launched, smart contracts cannot be updated.

Uniswap v4 marks something of a departure for the pioneering decentralized exchange, which was the first to launch a working “automated market maker” that linked buyers and sellers together to swap Ethereum-based tokens. V4 is slated to go live in the third quarter.

The team is introducing “hooks,” or smart contract “plugins” that enable customization in Uniswap’s liquidity pools like the ability to set dynamic fees, onchain limit orders and purpose-build oracles (also known as data feeds). The last major Uniswap upgrade, v3, launched in 2021.

V4 also hopes to save users and liquidity providers on fees by holding all liquidity pools in a single contract to reduce the transaction costs associated with creating new pools and executing trades.

While the upgrade is much-awaited, it has also drawn controversy. Similar to the v3 protocol, v4 will launch under a four-year Business Source License, limiting what others can do with the code, which some see as a violation of the open-source ethos of crypto.

Uniswap Labs published the draft code for v4 in mid-2023. The auditing competition will kick off on Sept. 4 and run until the end of the month.

“Anyone can submit vulnerabilities in the v4 codebase. Rewards will be allocated based on the severity of the bug disclosed and quality of the documentation in submissions,” the team wrote.