Uniswap
The largest decentralized exchange protocol enabling permissionless token swaps on Ethereum and multiple L2 networks.
https://uniswap.orgMax Reward
$500,000
Total Paid
$3,200,000
Resolved
156
Avg Response
3 days
In-Scope Assets
app.uniswap.org
Web trading interface and swap router
Uniswap Smart Contracts
V3/V4 pool contracts and periphery
Uniswap Wallet
Mobile wallet and swap interface
Uniswap API/SDK
Developer SDK and routing API
Out of Scope
- ✕ Governance proposals
- ✕ Third-party frontends
- ✕ Token listings
Severity Levels & Rewards
RCE, authentication bypass, privilege escalation, fund extraction
Stored XSS, CSRF with impact, API abuse, data manipulation
Reflected XSS, data leakage, logic flaws, information disclosure
Verbose errors, minor config issues, low-impact info disclosure
Active Bounties (2)
| ID | Title | Severity | Status | Reward | Submissions |
|---|---|---|---|---|---|
| UNI-001 | Smart contract reentrancy in V3 flash loan callback | Critical | Open | $100,000–$500,000 | 0 |
| UNI-002 | Frontend price display manipulation via crafted token metadata | Medium | In Review | $2,000–$5,000 | 2 |
Rules of Engagement
• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or automated scanning at high volume.
• Report vulnerabilities promptly and provide sufficient detail to reproduce.
• Allow reasonable time for fix before public disclosure (90 days).
• Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.