Shadow Arena #021: KyberSwap Elastic

You built Uniswap V3's swap loop from scratch: one `liquidity` value, tick crossings that update it, rounding directions chosen so the invariant never breaks in the protocol's favor. KyberSwap Elastic re-authored that engine to fold swap fees straight back into active liquidity, so the swap step now tracks TWO components (baseL + reinvestL) instead of V3's single `liquidity`. That re-authoring is exactly where a ~$48M rounding-direction bug lived in the tick-crossing math. This is the capstone: a Sherlock competitive audit ran on this exact code in July 2023 and found a dependency bug and a router address collision, but the swap-loop rounding bug went unreported and was exploited in November 2023. 3 representative findings (1 C + 2 M) — the real exploit as C-01, plus the two Mediums the contest actually caught.

Scope (1360 SLOC)

File	SLOC	Description
contracts/libraries/SwapMath.sol	320	Re-authored SwapMath. computeSwapStep tracks baseL + reinvestL; estimateIncrementalLiquidity/calcFinalPrice compute deltaL (fee folded into reinvestment liquidity) and the resulting sqrtP when a tick is NOT crossed
contracts/Pool.sol	310	The swap loop. Calls computeSwapStep per step, decides tick crossing from the returned nextSqrtP, and updates baseL / reinvestL via _updateLiquidityAndCrossTick
contracts/PoolTicksState.sol	180	Tick bookkeeping and the cross-tick liquidity delta update invoked when the swap loop concludes a tick was reached
contracts/oracle/PoolOracle.sol	250	UUPS-upgradeable pool oracle used for TWAP-style observations
contracts/periphery/TokenPositionDescriptor.sol	60	UUPS-upgradeable NFT position metadata descriptor
contracts/periphery/Router.sol	240	User-facing swap router; validates the pool via computed address inside the swap callback

Documentation

Source Code Protocol Docs

Part of the Uniswap V3 Path

This shadow audit connects to the Uniswap V3 Build module. Students who built the concentrated-liquidity pool have an advantage because they understand tick accounting, the swap loop, fee growth, the observation oracle, and callback-based payment.

View Build Module

Duration10 days

Total Findings3

Scope1360 SLOC

PriceFree