7 FullRange hook & interface files in packages/contracts/src/fullrange plus 5 consumer/deployment integration contracts (Launchpad, Periphery, OperationsPeriphery, FundController, FullRangeDeployment).
uniswap-ai-google.md
Loading report…
6 findings (1 Medium, 3 Low, 2 Informational), 3/33 Low Risk permission score, 12/12 vulnerability catalog checks and 10/10 live Hardhat v4 PoolManager checks passed; pending pre-launch triage and remediation.
GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with Uniswap AI · v4-security-foundations + v4-hook-generator.
Uniswap v4 hook security and delta accounting. Official Uniswap v4 security skills check hook permission bitmasks, PoolManager callback access control, delta settlement invariants and AMM edge cases. GlazeCorp runs the skills; this is not a commissioned Uniswap Labs audit.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
7 FullRange hook & interface files in packages/contracts/src/fullrange plus 5 consumer/deployment integration contracts (Launchpad, Periphery, OperationsPeriphery, FundController, FullRangeDeployment).
uniswap-ai-google.md
6 findings (1 Medium, 3 Low, 2 Informational), 3/33 Low Risk permission score, 12/12 vulnerability catalog checks and 10/10 live Hardhat v4 PoolManager checks passed; pending pre-launch triage and remediation.
GlazeCorp reviewed using Google gemini-4-argon at high reasoning effort with Uniswap AI · v4-security-foundations + v4-hook-generator.
Uniswap v4 hook security and delta accounting. Official Uniswap v4 security skills check hook permission bitmasks, PoolManager callback access control, delta settlement invariants and AMM edge cases. GlazeCorp runs the skills; this is not a commissioned Uniswap Labs audit.
Google gemini-4-argon supplies the code reasoning within this workflow. Different model runs provide additional perspectives; findings still require validation.
Project responses updated October 15, 2026. All 6 findings (UNI-01 through UNI-06) from the October 15, 2026 Uniswap AI Skills × Google (gemini-4-argon) review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 are currently pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active. Prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Each observation retains its review date, source revision, model and project decision.
UNI-01 — Sibling-Wrapper Shared PoolId Price Hijack in FullRange.initializeAndSeed and quoteSeed (VULN-10)
Review: Uniswap AI Skills × Gemini 4 Argon · October 15 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: Multiple FullRangeERC20 wrappers created for the same (currency0, currency1, swapFee) tuple share the same underlying Uniswap v4 PoolId while isolating LP positions via positionSalt. When initializeAndSeed calls quoteSeed, it reads poolManager.getSlot0(id) and, if sqrtPriceX96 != 0, silently adopts the existing V4 market price instead of FullRangeMath.seedPrice(amount0Max, amount1Max). While Launchpad.launch() deploys and seeds Coin atomically in a single transaction (and FullRange.create rejects code.length == 0), a standalone caller invoking FullRange.create and FullRange.initializeAndSeed across separate transactions without tight amount0Min / amount1Min bounds can have their shared V4 PoolId initialized first by a sibling wrapper at an extreme sqrtPriceX96.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
UNI-02 — Missing address(poolManager) Validation on Fee Recipient Setters Permanently Strands ERC-6909 Fee Claims on claim()
Review: Uniswap AI Skills × Gemini 4 Argon · October 15 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:FullRange._checkRecipient rejects recipient == address(poolManager) (along with address(0), address(this), and address(token)) for LP share minting and liquidity withdrawals, but FullRangeERC20.setCreatorRecipients and FullRange.setProtocolFeeRecipient do not reject address(poolManager). If a fee recipient is configured to address(poolManager), calling FullRange.claim burns FullRange's ERC-6909 claims and calls poolManager.take(currency, address(poolManager), amount), executing an ERC-20 self-transfer inside PoolManager that permanently strands the claimed fees.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
UNI-03 — FullRangeMath.seedPrice High-Ratio Branch Truncates Lower 32 Bits of Q96 Precision, and FullRangeMath.liquidity Reverts on Non-Binding Cap Overflow
Review: Uniswap AI Skills × Gemini 4 Argon · October 15 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description: When amount1 / amount0 >= 1 << 64, FullRangeMath.seedPrice computes Math.sqrt(Math.mulDiv(amount1, 1 << 128, amount0)) << 32, zeroing the bottom 32 bits of Q96sqrtPriceX96 precision. Additionally, FullRangeMath.liquidity delegates directly to Uniswap LiquidityAmounts.getLiquidityForAmounts, which casts both single-sided getLiquidityForAmount0 and getLiquidityForAmount1 to uint128 via .toUint128() before taking min(L0, L1); at asymmetric prices, passing a large non-binding ceiling (<= MAX_AMOUNT) on one token reverts with SafeCastOverflow even when min(L0, L1) fits in uint128.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
UNI-04 — Unclaimed Realized Fees Are Tracked by Role Rather Than Snapshot Recipient, Allowing Retroactive Redirection via setCreatorRecipients
Review: Uniswap AI Skills × Gemini 4 Argon · October 15 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:FullRange._credit stores realized fees by role (creatorClaimable[pool][token] and protocolClaimable[pool][token]) and resolves recipient0 / recipient1 or protocolFeeRecipient only when claim() is called. Consequently, calling setCreatorRecipients redirects already-realized, unclaimed fees to the updated recipient, which matches FullRange.sol:19-20 and docs/architecture.md but contradicts the summary statement in packages/contracts/src/core/README.md:103.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
UNI-05 — Sub-Unit Fee Checkpointing on Asymmetric-Decimal Pairs via OR-Based _hasCollectibleFees and Micro-LP Modifications
Review: Uniswap AI Skills × Gemini 4 Argon · October 15 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:FullRange._hasCollectibleFees returns true whenever either currency0 or currency1 has accrued at least 1 raw unit of fees (||), and addLiquidity / removeLiquidity call _modifyLiquidity unconditionally. Because Uniswap v4 Pool.modifyLiquidity always checkpoints both feeGrowthInside0LastX128 and feeGrowthInside1LastX128 simultaneously, frequent collect() calls or micro-LP modifications when an 18-decimal token has >= 1 wei of fee reset sub-unit (< 1 raw unit) fee growth on a paired low-decimal token.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
UNI-06 — Unused PoolKey calldata key Parameter Warning in beforeInitialize, Single-Step Ownable on FullRangeERC20, and V4 int128.max Single-Realization Boundary
Review: Uniswap AI Skills × Gemini 4 Argon · October 15 audit. Reviewed source:c435fa3dbfa179aa9083134ba8729c2ac2d34dc0. Model:gemini-4-argon.
Description:FullRange.beforeInitialize(address sender, PoolKey calldata key, uint160) emits a compiler and solhint unused-parameter warning on key; FullRangeERC20 uses single-step Ownable (for atomic Launchpad and FundController handoff) while FullRange uses Ownable2Step; and Periphery._claimFundFees calls FullRange.claim once per currency/role (uint128(type(int128).max) batch cap), requiring direct FullRange.claim calls first if accumulated claims ever exceed type(int128).max.
Disposition: PENDING_REMEDIATION.
Response: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Original review summary
Uniswap AI Skills × Google
This file collects the recorded reviews for this harness and company. Each section identifies the reviewed source and model; partial reviews and coverage limits are preserved.
Current project response
Project responses updated October 15, 2026. All 6 findings (UNI-01 through UNI-06: 1 Medium, 3 Low, 2 Informational) from the October 15, 2026 review of frozen commit c435fa3dbfa179aa9083134ba8729c2ac2d34dc0 are currently pending pre-launch triage and remediation while the October 12, 2026 smart-contract audit freeze remains active. Prior to mainnet launch, every finding will be resolved and updated with a final project response in this report.
Uniswap AI Skills × Gemini 4 Argon · October 15 audit
Owner review: Pending pre-launch triage and remediation. Recorded under the October 12, 2026 contract audit freeze (c435fa3dbfa179aa9083134ba8729c2ac2d34dc0); not yet addressed. All findings will be resolved and updated with a final project response prior to mainnet launch.
Original executable evidence and full report (docs/audits/uniswap-ai-gemini-4-argon.md) are retained in the repository. This is a source-specific public summary, not a complete-coverage certificate or professional audit by the harness author.
