Uniswap Detected Bug Doesn’t Refund Unspent ETH In Partial Swaps
A developer found a bug in the Uniswap core contract SwapRouter, and the unspent ETH in the transaction will remain in the SwapRouter contract and will not be refunded. The developer said the vulnerability was discovered in December last year but was rejected by Uniswap security. The developer said the vulnerability was discovered but was rejected by Uniswap security researchers after submitting a bug report. The bug allows users to lose funds while interacting with the contract in the standard way. Additionally, SwapRouter allows anyone to withdraw ETH from the contract; it could be an MEV bot or anyone calling for refunds after the transaction. This bug was established due to Uniswap’s decision to introduce the Universal Router, which combines NFTs and ERC-20 tokens into a single swap router.
@Uniswap_PancakeSwap
