KaratumUniswap v3 (SwapRouter02)
B80/100
Base fork at block 52676196 (2026-10-16 09:08:59 UTC) · 2/2 flows executed · 34 cases · 1 high3 medium6 low1 info
Agent Readiness Score
| Component | Points | Basis |
|---|---|---|
| Task completion | 30 / 30 | 2 of 2 executed flows completed by the careful agent |
| Safety for a naive agent | 15 / 25 | price moved 125 bps / 124 bps against the trade: a careful agent's bound made the call revert (nothing lost); a bound-less agent lost up to 125 bps (60% for the bound working, 40% for loss below the move) |
| Input hardening | 11.9 / 15 | 5 of 24 weighted probe points were accepted unsafely |
| Error legibility | 5.3 / 10 | mean revert legibility 0.53 over 6 reverts raised by the protocol (7 raised by tokens not counted) |
| Approval surface | 10 / 10 | exact approvals suffice; spender is the entry contract |
| Interface clarity | 7.5 / 10 | 5 static interface finding(s) |
Findings
high Output can be sent to the zero address · dynamic
Swap 1000 USDC for WETH on SwapRouter02: with recipient = 0x0 the call succeeded and the result did not reach the agent (checks failed: WETH balance increases; funds left the agent and the expected result did not arrive). A single wrong argument burns the agent's funds.
Fix. Revert when the recipient is address(0) with a named error such as `InvalidRecipient()`.
Where: SwapRouter02 (swap-usdc-weth) · Evidence: swap-usdc-weth.prober.zero-recipient
medium Reverts are hard for an agent to act on · dynamic
6 reverts were observed across the battery; mean legibility 0.53 (1 = named custom error with parameters; 7 more reverts raised by token contracts are not counted). 2 were empty, panics or errors missing from the published ABI; the rest were short string codes. Examples: Error("Too little received"); (empty revert).
Fix. Use named custom errors with parameters (`error InsufficientAllowance(uint256 have, uint256 need)`) and include them in the verified ABI; avoid numeric string codes.
Evidence: swap-usdc-weth.careful.mevswap-usdc-weth.prober.zero-amountswap-usdc-weth.prober.no-approval
medium Agents without an output bound lose ~125 bps when the price moves 125 bps (swap-usdc-weth) · dynamic
Swap 1000 USDC for WETH on SwapRouter02: after an attacker moved the pool price about 125 bps against the trade, the naive, slippage-insensitive, sandwich-prone agent(s) executed 125 bps below the careful baseline, while the careful agent's output bound made its own call revert instead (nothing lost). In this model the attacker's front-run and unwind netted +7.2655 USDC.
Fix. Make the output bound impossible to skip in agent-facing docs, SDKs and tool descriptions (default to quote minus 0.5%), and consider rejecting a zero minimum output for calls that come from registered agent wallets.
Where: SwapRouter02 · Evidence: swap-usdc-weth.naive.mevswap-usdc-weth.slippage-insensitive.mevswap-usdc-weth.sandwich-prone.mev
medium Agents without an output bound lose ~124 bps when the price moves 124 bps (swap-weth-usdc) · dynamic
Swap 1 WETH for USDC on SwapRouter02: after an attacker moved the pool price about 124 bps against the trade, the naive, slippage-insensitive, sandwich-prone agent(s) executed 124 bps below the careful baseline, while the careful agent's output bound made its own call revert instead (nothing lost). In this model the attacker's front-run and unwind netted -0.1292 WETH (unprofitable at this trade size and pool depth: the agent's loss is the price move, not necessarily extractable value).
Fix. Make the output bound impossible to skip in agent-facing docs, SDKs and tool descriptions (default to quote minus 0.5%), and consider rejecting a zero minimum output for calls that come from registered agent wallets.
Where: SwapRouter02 · Evidence: swap-weth-usdc.naive.mevswap-weth-usdc.slippage-insensitive.mevswap-weth-usdc.sandwich-prone.mev
low A 1-unit amount is accepted and returns nothing · dynamic
Swap 1000 USDC for WETH on SwapRouter02: an amount of 1 base unit was taken and nothing came back, yet the call succeeded. The loss is only the dust, but an agent that trusts the transaction status will report success. Swap 1 WETH for USDC on SwapRouter02: an amount of 1 base unit was taken and nothing came back, yet the call succeeded. The loss is only the dust, but an agent that trusts the transaction status will report success.
Fix. Revert on amounts that round to zero shares or zero output (`ZeroShares()`), instead of taking the funds.
Where: SwapRouter02 (swap-usdc-weth, swap-weth-usdc) · Evidence: swap-usdc-weth.prober.dust-amountswap-weth-usdc.prober.dust-amount
low 6 swap functions cannot expire · static
exactInput, exactInputSingle, exactOutput, exactOutputSingle, swapExactTokensForTokens, swapTokensForExactTokens take no deadline; one exists only through the `multicall(uint256 deadline, bytes[] data)` wrapper, which an agent must know to use. A transaction left in the mempool can execute at a much later, worse price.
Fix. Add a `deadline` parameter that reverts with a named `Expired(uint256 deadline, uint256 timestamp)` error, or make the multicall-with-deadline path the documented default for agents.
Where: SwapRouter02.exactInput, exactInputSingle, exactOutput, exactOutputSingle, swapExactTokensForTokens, swapTokensForExactTokens ·
low No custom errors in the ABI · static
SwapRouter02 publishes no `error` definitions: failures reach an agent as strings, panics or empty reverts that it cannot decode against the ABI.
Fix. Use named custom errors with parameters (`error InsufficientOutput(uint256 received, uint256 minimum)`) and include them in the published ABI.
Where: SwapRouter02 ·
low No event definitions in the published ABI · static
The published ABI of SwapRouter02 contains no events, so a tool that decodes receipts from the ABI sees raw logs only. (The battery checks below whether the contract emits events anyway.)
Fix. Include every emitted event (including those defined in libraries) in the verified ABI, or emit them from the entry contract.
Where: SwapRouter02 ·
low 2 function(s) take parameters that must stay at a sentinel value · static
exactInputSingle, exactOutputSingle take `sqrtPriceLimitX96`: in the common case these must be 0 or empty, and a non-sentinel value silently changes behaviour (a price limit that partially fills, a referral id, a callback into the caller) instead of reverting.
Fix. Document the neutral value in the NatSpec and the SDK, validate unexpected values with a named error, or offer an overload without the parameter.
Where: SwapRouter02.exactInputSingle, exactOutputSingle ·
low 3 function(s) take wide structs · static
exactInputSingle, exactOutputSingle, mint pack five or more fields (addresses, amounts and limits mixed) into one struct; positional mistakes (swapping two amounts or two addresses) are easy for an agent and invisible to the type checker.
Fix. Publish a field-order table with units in the docs, and add a typed SDK helper; where possible give amount and limit fields distinct, self-describing names.
Where: SwapRouter02.exactInputSingle, exactOutputSingle, mint ·
info The entry contract emits no event for swap-usdc-weth, swap-weth-usdc · dynamic
The successful transactions of swap-usdc-weth, swap-weth-usdc carried no event from the configured contract(s); an agent can only confirm them from token transfer logs or by re-reading state.
Fix. Emit an event from the entry contract with the account, tokens and amounts.
Evidence: swap-usdc-weth.careful.baselineswap-weth-usdc.careful.baseline
What held
- Swap 1000 USDC for WETH on SwapRouter02: the careful agent's output bound turned a 125 bps price move into a safe revert (0 bps lost).
- Swap 1 WETH for USDC on SwapRouter02: the careful agent's output bound turned a 124 bps price move into a safe revert (0 bps lost).
- No protocol contract called into the agent's wallet during 2 traced flow(s) (call trees checked).
- A careful agent completed 2/2 flows (exact approval, simulation, bounded output, on-chain verification).
Agents
| Agent | Completed | Refused / reverted | Approval left | Gas (total) | Worst loss under a price move |
|---|---|---|---|---|---|
| Careful Approves exactly the amount, simulates before sending, bounds output at the quote minus 0.5%, sets a 20-minute deadline, verifies the result on chain and revokes leftover allowance. | 2/2 | 0/0 | none | 385,592 | 0 bps |
| Naive Approves the maximum, accepts any output, sets a far-future deadline, never simulates, trusts the transaction status. | 2/2 | 0/0 | unlimited | 392,272 | 125 bps (12.5 USDC, ~$12.5) |
| Max-approve Careful in everything except approving the maximum and never revoking: isolates the approval surface. | 2/2 | 0/0 | unlimited | 392,416 | n/a |
| Slippage-insensitive Careful in everything except accepting any output: isolates slippage exposure. | 2/2 | 0/0 | none | 385,424 | 125 bps (12.5 USDC, ~$12.5) |
| Re-entrancy probe Careful, with the transaction's call tree analysed for calls from protocol contracts back into the agent's wallet. It does not deploy attacker contracts. | 2/2 | 0/0 | none | 385,592 | n/a |
| Sandwich-prone Bound-less, no simulation, far deadline; run after an attacker moved the pool price, then unwound by the attacker to measure extractable value. | 2/2 | 0/0 | none | 385,448 | 125 bps (12.5 USDC, ~$12.5) |
Under a price move
An attacker moves the pool price against the trade after the agent has quoted and before its transaction lands. The careful agent's output bound reverts; agents without one execute at the worse price.
| Flow | Price moved | careful | slippage-insensitive | naive | sandwich-prone |
|---|---|---|---|---|---|
| swap-usdc-weth | 125 bps | reverted, 0 bps | 125 bps lost | 125 bps lost | 125 bps lost attacker net +7.2655 USDC |
| swap-weth-usdc | 124 bps | reverted, 0 bps | 124 bps lost | 124 bps lost | 124 bps lost attacker net -0.1292 WETH |
Careless and hostile inputs
| Flow | Input | Protocol response | Revert |
|---|---|---|---|
| swap-usdc-weth | zero-amount | rejected | Error("AS") |
| swap-usdc-weth | dust-amount | accepted unsafe | — |
| swap-usdc-weth | zero-recipient | accepted unsafe | — |
| swap-usdc-weth | no-approval | rejected | Error("STF") |
| swap-usdc-weth | overspend | rejected | Error("STF") |
| swap-usdc-weth | impossible-min-out | rejected | Error("Too little received") |
| swap-usdc-weth | non-contract-token | rejected | (empty revert) |
| swap-weth-usdc | zero-amount | rejected | Error("AS") |
| swap-weth-usdc | dust-amount | accepted unsafe | — |
| swap-weth-usdc | zero-recipient | rejected | Error("TF") |
| swap-weth-usdc | no-approval | rejected | Error("STF") |
| swap-weth-usdc | overspend | rejected | Error("STF") |
| swap-weth-usdc | impossible-min-out | rejected | Error("Too little received") |
| swap-weth-usdc | non-contract-token | rejected | (empty revert) |
6 protocol reverts observed (and 7 raised by token contracts, not counted), mean legibility 0.53 (1 = named custom error with parameters). Examples: Error("Too little received") · (empty revert)
Generated tasks
Task specs are generated from the ABI by deterministic templates (no language model). Each lists the exact call, the approvals and the on-chain checks that define success.
swap-usdc-weth · Swap 1000 USDC for WETH on SwapRouter02
Swap 1000 USDC for WETH using Uniswap v3 (SwapRouter02) (SwapRouter02 at 0x2626664c2603336E57B271c5C0b26F421741e481 on Base). Receive the WETH in your own wallet and do not lose more than 0.5% to price movement. Done when your WETH balance has increased and your USDC balance has decreased by 1000.
Call exactInputSingle((address,address,uint24,address,uint256,uint256,uint160)) on SwapRouter02 (0x2626664c2603336E57B271c5C0b26F421741e481). Approvals: 0x833589… → 0x262666…. Success is read from chain state: WETH balance increases; USDC balance decreases.
Generated by uniswap-v3 exactInputSingle (fee 100). fee tier 100 chosen by simulated output on the fork (0.407714084602727315 WETH for 1000 USDC)
swap-weth-usdc · Swap 1 WETH for USDC on SwapRouter02
Swap 1 WETH for USDC using Uniswap v3 (SwapRouter02) (SwapRouter02 at 0x2626664c2603336E57B271c5C0b26F421741e481 on Base). Receive the USDC in your own wallet and do not lose more than 0.5% to price movement. Done when your USDC balance has increased and your WETH balance has decreased by 1.
Call exactInputSingle((address,address,uint24,address,uint256,uint256,uint160)) on SwapRouter02 (0x2626664c2603336E57B271c5C0b26F421741e481). Approvals: 0x420000… → 0x262666…. Success is read from chain state: USDC balance increases; WETH balance decreases.
Generated by uniswap-v3 exactInputSingle (fee 500). fee tier 500 chosen by simulated output on the fork (2451.341055 USDC for 1 WETH)
Contracts and ABIs
| Contract | Address | ABI | Proxy |
|---|---|---|---|
| SwapRouter02 | 0x2626664c2603336E57B271c5C0b26F421741e481 | sourcify (match) · 39 functions | no |
Reproducible traces
Every case with calldata, selectors, gas, revert data and decoded reason. Re-run the whole battery with karatum-protocol-audit run on an Anvil fork at the same block: the config hash and report hash below let you check you got the same result.
swap-usdc-weth.careful.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0x35c995cc…4c0a0734 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | harness | expected output expected output 407714084602727315 | ok | |
| 4 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 5 | agent | exactInputSingle minOut 405675514179713678, deadline 1792142951 | success | 0x04e45aaf 0x0015afcd…01bb372a 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.careful.mev reverted
reverted: Error("Too little received") (pool moved 125 bps against the agent before its swap)
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0x35c995cc…4c0a0734 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | harness | expected output expected output 407714084602727315 | ok | |
| 4 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 5 | attacker | front-run exactInputSingle size 1000000000, quote moved 2 bps | success | 0x04e45aaf 0xa7b182ed…07b5762e |
| 6 | attacker | front-run exactInputSingle size 1500000000, quote moved 7 bps | success | 0x04e45aaf 0xf564954e…3e6210cf |
| 7 | attacker | front-run exactInputSingle size 2250000000, quote moved 15 bps | success | 0x04e45aaf 0x30b4048a…d94dd296 |
| 8 | attacker | front-run exactInputSingle size 3375000000, quote moved 29 bps | success | 0x04e45aaf 0x3553c20a…c898deee |
| 9 | attacker | front-run exactInputSingle size 5062500000, quote moved 56 bps | success | 0x04e45aaf 0x90a47fd3…0c1fce9b |
| 10 | attacker | front-run exactInputSingle size 7593750000, quote moved 96 bps | success | 0x04e45aaf 0x9cac380e…c15598fe |
| 11 | attacker | front-run exactInputSingle size 5695312500, quote moved 125 bps | success | 0x04e45aaf 0x75ce7fcf…071ca2b3 |
| 12 | agent | exactInputSingle minOut 405675514179713678, deadline 1792142951 | reverted Error("Too little received") | 0x04e45aaf 0x0015afcd…01bb372a 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
| 13 | agent | revoke USDC allowance cleanup | success | 0x095ea7b3 0x197f8f3c…5b636bce 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000000000000000000 |
swap-usdc-weth.max-approve.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender max approval | success | 0x095ea7b3 0x150106c9…d2e973bb 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff |
| 3 | harness | expected output expected output 407714084602727315 | ok | |
| 4 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 5 | agent | exactInputSingle minOut 405675514179713678, deadline 1792142951 | success | 0x04e45aaf 0x4fbea2d8…e972d12d 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.naive.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender max approval | success | 0x095ea7b3 0xebd9192e…bce328e8 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x9d4d590d…f8d75363 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.naive.mev success
all on-chain checks passed (pool moved 125 bps against the agent before its swap)
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender max approval | success | 0x095ea7b3 0xebd9192e…bce328e8 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff |
| 3 | attacker | front-run exactInputSingle size 1000000000, quote moved 2 bps | success | 0x04e45aaf 0xa7b182ed…07b5762e |
| 4 | attacker | front-run exactInputSingle size 1500000000, quote moved 7 bps | success | 0x04e45aaf 0xf564954e…3e6210cf |
| 5 | attacker | front-run exactInputSingle size 2250000000, quote moved 15 bps | success | 0x04e45aaf 0x30b4048a…d94dd296 |
| 6 | attacker | front-run exactInputSingle size 3375000000, quote moved 29 bps | success | 0x04e45aaf 0x3553c20a…c898deee |
| 7 | attacker | front-run exactInputSingle size 5062500000, quote moved 56 bps | success | 0x04e45aaf 0x90a47fd3…0c1fce9b |
| 8 | attacker | front-run exactInputSingle size 7593750000, quote moved 96 bps | success | 0x04e45aaf 0x9cac380e…c15598fe |
| 9 | attacker | front-run exactInputSingle size 5695312500, quote moved 125 bps | success | 0x04e45aaf 0x75ce7fcf…071ca2b3 |
| 10 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x9d4d590d…f8d75363 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.prober.dust-amount check failedaccepted unsafe
checks failed: WETH balance increases; funds left the agent and the expected result did not arrive
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0x61dc59cb…6620ddbd 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000000000000000001 |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x64bbc615…28e5a275 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.prober.impossible-min-out revertedrejected
reverted: Error("Too little received"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0x71c055b2…3fad8325 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | harness | expected output expected output 407714084602727315 | ok | |
| 4 | agent | exactInputSingle minOut 4077140846027273150, deadline 4102444800 | reverted Error("Too little received") | 0x04e45aaf 0x11493fd9…f040dd7f 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.prober.no-approval revertedrejected
reverted: Error("STF"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted Error("STF") | 0x04e45aaf 0x2cef8542…315afeb0 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.prober.non-contract-token revertedrejected
reverted: (empty revert); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted (empty revert) | 0x04e45aaf 0x86d0928f…93cf8713 0x04e45aaf000000000000000000000000000000000000000000000000000000000000dead000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.prober.overspend revertedrejected
reverted: Error("STF"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0x28903757…80da2ac2 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e48100000000000000000000000000000000000000000000000000000000b2d05e01 |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted Error("STF") | 0x04e45aaf 0xc783e608…e9a4be4c 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.prober.zero-amount revertedrejected
reverted: Error("AS"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted Error("AS") | 0x04e45aaf 0x2025191f…2b81eb2e 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.prober.zero-recipient check failedaccepted unsafe
checks failed: WETH balance increases; funds left the agent and the expected result did not arrive
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0xaf4ca33f…f669adc8 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0xd410cc69…b0b4e061 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.reentrancy-probe.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0x6653e288…9129c4d3 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | harness | expected output expected output 407714084602727315 | ok | |
| 4 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 5 | agent | exactInputSingle minOut 405675514179713678, deadline 1792142951 | success | 0x04e45aaf 0x76887706…7fd3e8a8 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.sandwich-prone.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0xe86a0971…5f0d5e1a 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x79039562…73f626f1 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.sandwich-prone.mev success
all on-chain checks passed (pool moved 125 bps against the agent before its swap)
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0xe86a0971…5f0d5e1a 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | attacker | front-run exactInputSingle size 1000000000, quote moved 2 bps | success | 0x04e45aaf 0xa7b182ed…07b5762e |
| 4 | attacker | front-run exactInputSingle size 1500000000, quote moved 7 bps | success | 0x04e45aaf 0xf564954e…3e6210cf |
| 5 | attacker | front-run exactInputSingle size 2250000000, quote moved 15 bps | success | 0x04e45aaf 0x30b4048a…d94dd296 |
| 6 | attacker | front-run exactInputSingle size 3375000000, quote moved 29 bps | success | 0x04e45aaf 0x3553c20a…c898deee |
| 7 | attacker | front-run exactInputSingle size 5062500000, quote moved 56 bps | success | 0x04e45aaf 0x90a47fd3…0c1fce9b |
| 8 | attacker | front-run exactInputSingle size 7593750000, quote moved 96 bps | success | 0x04e45aaf 0x9cac380e…c15598fe |
| 9 | attacker | front-run exactInputSingle size 5695312500, quote moved 125 bps | success | 0x04e45aaf 0x75ce7fcf…071ca2b3 |
| 10 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x79039562…73f626f1 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
| 11 | attacker | back-run exactInputSingle sells 10734656566726644017 WETH | success | 0x04e45aaf 0x160fcd86…d47e3ce5 |
swap-usdc-weth.slippage-insensitive.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0xfc58a208…6ef83bc9 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 4 | agent | exactInputSingle minOut 0, deadline 1792142951 | success | 0x04e45aaf 0xf5868e0d…20f93e48 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-usdc-weth.slippage-insensitive.mev success
all on-chain checks passed (pool moved 125 bps against the agent before its swap)
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances USDC balance 3000000000 | ok | |
| 2 | agent | approve USDC to spender exact approval | success | 0x095ea7b3 0xfc58a208…6ef83bc9 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481000000000000000000000000000000000000000000000000000000003b9aca00 |
| 3 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 4 | attacker | front-run exactInputSingle size 1000000000, quote moved 2 bps | success | 0x04e45aaf 0xa7b182ed…07b5762e |
| 5 | attacker | front-run exactInputSingle size 1500000000, quote moved 7 bps | success | 0x04e45aaf 0xf564954e…3e6210cf |
| 6 | attacker | front-run exactInputSingle size 2250000000, quote moved 15 bps | success | 0x04e45aaf 0x30b4048a…d94dd296 |
| 7 | attacker | front-run exactInputSingle size 3375000000, quote moved 29 bps | success | 0x04e45aaf 0x3553c20a…c898deee |
| 8 | attacker | front-run exactInputSingle size 5062500000, quote moved 56 bps | success | 0x04e45aaf 0x90a47fd3…0c1fce9b |
| 9 | attacker | front-run exactInputSingle size 7593750000, quote moved 96 bps | success | 0x04e45aaf 0x9cac380e…c15598fe |
| 10 | attacker | front-run exactInputSingle size 5695312500, quote moved 125 bps | success | 0x04e45aaf 0x75ce7fcf…071ca2b3 |
| 11 | agent | exactInputSingle minOut 0, deadline 1792142951 | success | 0x04e45aaf 0xf5868e0d…20f93e48 0x04e45aaf000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda02913000000000000000000000000420000000000000000000000000000000000000600… |
swap-weth-usdc.careful.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0xd8a261f1…bc2df3cc 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | harness | expected output expected output 2451341055 | ok | |
| 4 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 5 | agent | exactInputSingle minOut 2439084349, deadline 1792142951 | success | 0x04e45aaf 0x75d2bc67…5454fd51 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.careful.mev reverted
reverted: Error("Too little received") (pool moved 124 bps against the agent before its swap)
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0xd8a261f1…bc2df3cc 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | harness | expected output expected output 2451341055 | ok | |
| 4 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 5 | attacker | front-run exactInputSingle size 1000000000000000000, quote moved 0 bps | success | 0x04e45aaf 0xe6c637fc…275c7188 |
| 6 | attacker | front-run exactInputSingle size 1500000000000000000, quote moved 2 bps | success | 0x04e45aaf 0x474e98f7…b4a1b895 |
| 7 | attacker | front-run exactInputSingle size 2250000000000000000, quote moved 4 bps | success | 0x04e45aaf 0x088fbeeb…c1d9acff |
| 8 | attacker | front-run exactInputSingle size 3375000000000000000, quote moved 7 bps | success | 0x04e45aaf 0x034de6d9…1a30cf2c |
| 9 | attacker | front-run exactInputSingle size 5062500000000000000, quote moved 11 bps | success | 0x04e45aaf 0xbfd60ac7…d4efd811 |
| 10 | attacker | front-run exactInputSingle size 7593750000000000000, quote moved 18 bps | success | 0x04e45aaf 0xc03a0185…a38d753c |
| 11 | attacker | front-run exactInputSingle size 11390625000000000000, quote moved 28 bps | success | 0x04e45aaf 0x24f516f2…cd4600e8 |
| 12 | attacker | front-run exactInputSingle size 17085937500000000000, quote moved 44 bps | success | 0x04e45aaf 0x50fa79b1…b650e0b6 |
| 13 | attacker | front-run exactInputSingle size 25628906250000000000, quote moved 66 bps | success | 0x04e45aaf 0x85dd39e5…47bd8552 |
| 14 | attacker | front-run exactInputSingle size 38443359375000000000, quote moved 99 bps | success | 0x04e45aaf 0x2556c167…fcfe7c5a |
| 15 | attacker | front-run exactInputSingle size 28832519531250000000, quote moved 124 bps | success | 0x04e45aaf 0x98e80af9…3cb00a58 |
| 16 | agent | exactInputSingle minOut 2439084349, deadline 1792142951 | reverted Error("Too little received") | 0x04e45aaf 0x75d2bc67…5454fd51 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
| 17 | agent | revoke WETH allowance cleanup | success | 0x095ea7b3 0x1c936448…2de53f9e 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000000000000000000 |
swap-weth-usdc.max-approve.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender max approval | success | 0x095ea7b3 0x4e40c8eb…55690f4f 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff |
| 3 | harness | expected output expected output 2451341055 | ok | |
| 4 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 5 | agent | exactInputSingle minOut 2439084349, deadline 1792142951 | success | 0x04e45aaf 0xcdf12b31…38341e22 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.naive.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender max approval | success | 0x095ea7b3 0x76150332…0a381859 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x885f5cd2…2e8472f6 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.naive.mev success
all on-chain checks passed (pool moved 124 bps against the agent before its swap)
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender max approval | success | 0x095ea7b3 0x76150332…0a381859 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e481ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff |
| 3 | attacker | front-run exactInputSingle size 1000000000000000000, quote moved 0 bps | success | 0x04e45aaf 0xe6c637fc…275c7188 |
| 4 | attacker | front-run exactInputSingle size 1500000000000000000, quote moved 2 bps | success | 0x04e45aaf 0x474e98f7…b4a1b895 |
| 5 | attacker | front-run exactInputSingle size 2250000000000000000, quote moved 4 bps | success | 0x04e45aaf 0x088fbeeb…c1d9acff |
| 6 | attacker | front-run exactInputSingle size 3375000000000000000, quote moved 7 bps | success | 0x04e45aaf 0x034de6d9…1a30cf2c |
| 7 | attacker | front-run exactInputSingle size 5062500000000000000, quote moved 11 bps | success | 0x04e45aaf 0xbfd60ac7…d4efd811 |
| 8 | attacker | front-run exactInputSingle size 7593750000000000000, quote moved 18 bps | success | 0x04e45aaf 0xc03a0185…a38d753c |
| 9 | attacker | front-run exactInputSingle size 11390625000000000000, quote moved 28 bps | success | 0x04e45aaf 0x24f516f2…cd4600e8 |
| 10 | attacker | front-run exactInputSingle size 17085937500000000000, quote moved 44 bps | success | 0x04e45aaf 0x50fa79b1…b650e0b6 |
| 11 | attacker | front-run exactInputSingle size 25628906250000000000, quote moved 66 bps | success | 0x04e45aaf 0x85dd39e5…47bd8552 |
| 12 | attacker | front-run exactInputSingle size 38443359375000000000, quote moved 99 bps | success | 0x04e45aaf 0x2556c167…fcfe7c5a |
| 13 | attacker | front-run exactInputSingle size 28832519531250000000, quote moved 124 bps | success | 0x04e45aaf 0x98e80af9…3cb00a58 |
| 14 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x885f5cd2…2e8472f6 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.prober.dust-amount check failedaccepted unsafe
checks failed: USDC balance increases; funds left the agent and the expected result did not arrive
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0x8ec5ea24…9d1a63a7 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000000000000000001 |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x65b555a1…ad0d0cc0 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.prober.impossible-min-out revertedrejected
reverted: Error("Too little received"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0x81e95dcc…8e00d28b 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | harness | expected output expected output 2451341055 | ok | |
| 4 | agent | exactInputSingle minOut 24513410550, deadline 4102444800 | reverted Error("Too little received") | 0x04e45aaf 0x05a21350…8f96d894 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.prober.no-approval revertedrejected
reverted: Error("STF"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted Error("STF") | 0x04e45aaf 0xeca9fae3…a80c6aee 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.prober.non-contract-token revertedrejected
reverted: (empty revert); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted (empty revert) | 0x04e45aaf 0x2e518fdb…3e6adcc9 0x04e45aaf000000000000000000000000000000000000000000000000000000000000dead000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.prober.overspend revertedrejected
reverted: Error("STF"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0x4b0f0278…0f59edfe 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e48100000000000000000000000000000000000000000000000029a2241af62c0001 |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted Error("STF") | 0x04e45aaf 0x52258ddb…c9721871 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.prober.zero-amount revertedrejected
reverted: Error("AS"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted Error("AS") | 0x04e45aaf 0x416c3cdb…2429b638 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.prober.zero-recipient revertedrejected
reverted: Error("TF"); the protocol rejected it
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0x5d7b41cc…32a6415e 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | reverted Error("TF") | 0x04e45aaf 0x870fbae6…70ce4080 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.reentrancy-probe.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0xe2a7b3a7…22f13ebc 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | harness | expected output expected output 2451341055 | ok | |
| 4 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 5 | agent | exactInputSingle minOut 2439084349, deadline 1792142951 | success | 0x04e45aaf 0xee46c111…a4316281 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.sandwich-prone.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0x309a8b72…44941808 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x7dfc5c06…d96df8d1 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.sandwich-prone.mev success
all on-chain checks passed (pool moved 124 bps against the agent before its swap)
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0x309a8b72…44941808 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | attacker | front-run exactInputSingle size 1000000000000000000, quote moved 0 bps | success | 0x04e45aaf 0xe6c637fc…275c7188 |
| 4 | attacker | front-run exactInputSingle size 1500000000000000000, quote moved 2 bps | success | 0x04e45aaf 0x474e98f7…b4a1b895 |
| 5 | attacker | front-run exactInputSingle size 2250000000000000000, quote moved 4 bps | success | 0x04e45aaf 0x088fbeeb…c1d9acff |
| 6 | attacker | front-run exactInputSingle size 3375000000000000000, quote moved 7 bps | success | 0x04e45aaf 0x034de6d9…1a30cf2c |
| 7 | attacker | front-run exactInputSingle size 5062500000000000000, quote moved 11 bps | success | 0x04e45aaf 0xbfd60ac7…d4efd811 |
| 8 | attacker | front-run exactInputSingle size 7593750000000000000, quote moved 18 bps | success | 0x04e45aaf 0xc03a0185…a38d753c |
| 9 | attacker | front-run exactInputSingle size 11390625000000000000, quote moved 28 bps | success | 0x04e45aaf 0x24f516f2…cd4600e8 |
| 10 | attacker | front-run exactInputSingle size 17085937500000000000, quote moved 44 bps | success | 0x04e45aaf 0x50fa79b1…b650e0b6 |
| 11 | attacker | front-run exactInputSingle size 25628906250000000000, quote moved 66 bps | success | 0x04e45aaf 0x85dd39e5…47bd8552 |
| 12 | attacker | front-run exactInputSingle size 38443359375000000000, quote moved 99 bps | success | 0x04e45aaf 0x2556c167…fcfe7c5a |
| 13 | attacker | front-run exactInputSingle size 28832519531250000000, quote moved 124 bps | success | 0x04e45aaf 0x98e80af9…3cb00a58 |
| 14 | agent | exactInputSingle minOut 0, deadline 4102444800 | success | 0x04e45aaf 0x7dfc5c06…d96df8d1 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
| 15 | attacker | back-run exactInputSingle sells 346317334749 USDC | success | 0x04e45aaf 0x5bc9f6d4…48d4512a |
swap-weth-usdc.slippage-insensitive.baseline success
all on-chain checks passed
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0xc81034e9…7d5c74f5 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 4 | agent | exactInputSingle minOut 0, deadline 1792142951 | success | 0x04e45aaf 0x4df02491…6cf02848 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
swap-weth-usdc.slippage-insensitive.mev success
all on-chain checks passed (pool moved 124 bps against the agent before its swap)
| # | Who | Step | Result | Selector / tx |
|---|---|---|---|---|
| 1 | harness | balances WETH balance 3000000000000000000 | ok | |
| 2 | agent | approve WETH to spender exact approval | success | 0x095ea7b3 0xc81034e9…7d5c74f5 0x095ea7b30000000000000000000000002626664c2603336e57b271c5c0b26f421741e4810000000000000000000000000000000000000000000000000de0b6b3a7640000 |
| 3 | agent | simulate exactInputSingle simulation succeeded | ok | 0x04e45aaf |
| 4 | attacker | front-run exactInputSingle size 1000000000000000000, quote moved 0 bps | success | 0x04e45aaf 0xe6c637fc…275c7188 |
| 5 | attacker | front-run exactInputSingle size 1500000000000000000, quote moved 2 bps | success | 0x04e45aaf 0x474e98f7…b4a1b895 |
| 6 | attacker | front-run exactInputSingle size 2250000000000000000, quote moved 4 bps | success | 0x04e45aaf 0x088fbeeb…c1d9acff |
| 7 | attacker | front-run exactInputSingle size 3375000000000000000, quote moved 7 bps | success | 0x04e45aaf 0x034de6d9…1a30cf2c |
| 8 | attacker | front-run exactInputSingle size 5062500000000000000, quote moved 11 bps | success | 0x04e45aaf 0xbfd60ac7…d4efd811 |
| 9 | attacker | front-run exactInputSingle size 7593750000000000000, quote moved 18 bps | success | 0x04e45aaf 0xc03a0185…a38d753c |
| 10 | attacker | front-run exactInputSingle size 11390625000000000000, quote moved 28 bps | success | 0x04e45aaf 0x24f516f2…cd4600e8 |
| 11 | attacker | front-run exactInputSingle size 17085937500000000000, quote moved 44 bps | success | 0x04e45aaf 0x50fa79b1…b650e0b6 |
| 12 | attacker | front-run exactInputSingle size 25628906250000000000, quote moved 66 bps | success | 0x04e45aaf 0x85dd39e5…47bd8552 |
| 13 | attacker | front-run exactInputSingle size 38443359375000000000, quote moved 99 bps | success | 0x04e45aaf 0x2556c167…fcfe7c5a |
| 14 | attacker | front-run exactInputSingle size 28832519531250000000, quote moved 124 bps | success | 0x04e45aaf 0x98e80af9…3cb00a58 |
| 15 | agent | exactInputSingle minOut 0, deadline 1792142951 | success | 0x04e45aaf 0x4df02491…6cf02848 0x04e45aaf0000000000000000000000004200000000000000000000000000000000000006000000000000000000000000833589fcd6edb6e08f4c7c32d4f71b54bda0291300… |
Proof and reproduction
Report hash 0x93c0cddaad688cb58c225e9311129d7214a48798f1085a67c36c7cd0332df5c9
Config hash 0x8884cc3795008fe45475f4939bc722af74cf94f36ec3e38434e92cb0760d1686
Attested on Ethereum Sepolia (EAS): 0x18f656ee…249205f1
Reproduce: anvil --fork-url <archive RPC for chain 8453> --fork-block-number 52676196 --chain-id 8453 --port 8545 && karatum-protocol-audit run --config audit.json --rpc http://127.0.0.1:8545 --block 52676196
Caveats
- This is a measurement of how scripted agents behave on a fork of the chain at one block, not a security audit and not a guarantee. It says nothing about contract bugs outside the tested flows.
- The agents are deterministic scripts, not language models. Language-model agents can behave differently; an optional LLM follow-up is queued separately when requested and is not part of this score.
- Everything ran on a local Anvil fork. No transaction was sent to any real network, and no real funds were used; balances on the fork are set by writing token storage.
- The price-move test pushes the pool price by same-direction swaps of the agent's own trade shape until a target move is reached. It is not a mempool or builder simulation: private order flow, bundles and priority fees are not modelled.
- The re-entrancy probe analyses the call tree of the agent's transaction for calls from protocol contracts into the agent's wallet. It does not deploy attacker contracts, so absence of a finding is not proof of safety.
- Flows are generated from the ABI by recognising common interface shapes. Flows that could not be generated are listed under coverage and excluded from the score; a low coverage caps the grade.
- ABIs come from Sourcify or Blockscout at the time of the run, not at the fork block; a registry change after the run changes the ABI hash in a re-run (the report records it).
- Fork state depends on the chosen block. Reproduction needs an archive-capable RPC for that block; liquidity, rates and contract upgrades after the block are not reflected.
- The Agent Readiness Score is a fixed weighting of six components (see the methodology). It orders protocols by agent-facing interface quality under this battery; it is not a risk rating of the protocol.