Security Firm Dedaub Discloses Reentrancy Vulnerability in Uniswap's New Universal Router, Receives Bug Bounty

The team of security firm Dedaub announced that it has received a security vulnerability report bounty from Uniswap Labs for disclosing a serious Uniswap vulnerability that has the possibility of reentry and drains users' funds. However, the funds are safe and the Uniswap team has resolved the vulnerability and redeployed the Universal Router smart contract on all chains. Uniswap will release the universal router "Universal Router" smart contract in November 2022, which can unify ERC20 and NFT exchanges into one exchange router, and users can perform heterogeneous operations, such as exchanging multiple tokens and NFTs in one transaction . Dedaub said, “The router embeds scripting language for various token operations, such commands may include transmissions to third-party (possibly untrusted) recipients. If third-party code is invoked at any point during the transmission, This code can re-enter the UniversalRouter and temporarily claim any tokens in the contract. Dedaub suggested that Uniswap add a reentrancy lock to the core execution of the new router and redeploy.”