Shadow Arena #017: Velodrome/Aerodrome Slipstream

You built Uniswap V3 from scratch: the concentrated-liquidity pool, the swap loop, the tick bitmap, the fee-growth accumulators. Velodrome Slipstream (Optimism) and its Aerodrome twin (Base) are that exact v3-core, forked line-for-line, with one thing bolted on: CL positions become NFTs you stake into a per-pool CLGauge to earn VELO/AERO emissions. That single addition introduces staked-vs-unstaked liquidity per tick, an unstakedFee, and epoch-based reward notification, and that is where most of the bugs live. This is a two-layer entry: canonical v3-core findings you could have shipped in your own pool, plus fork-delta findings that exist only in the gauge and reward layer. 8 representative findings (7 H + 1 M).

Scope (1848 SLOC)

File	SLOC	Description
contracts/core/CLPool.sol	760	Concentrated-liquidity pool: the v3-core fork plus staked-liquidity accounting, rewardGrowthGlobal, and the unstakedFee. Home of the swap loop, tick crossing, and rewards growth update.
contracts/core/libraries/SwapMath.sol	63	computeSwapStep: one step of the swap, unchanged from v3-core. Amount-in/out and next sqrt price per tick range.
contracts/core/libraries/TransferHelper.sol	9	Low-level ERC20 transfer helper used by the pool to move tokens out on swap, collect, and flash.
contracts/core/libraries/Tick.sol	151	Per-tick bookkeeping: liquidityNet/liquidityGross plus the added stakedLiquidityNet and updateStake/clear logic.
contracts/gauge/CLGauge.sol	266	Fork-delta layer: stakes position NFTs, computes earned emissions, and notifies epoch rewards to the pool. Staked vs unstaked liquidity originates here.
contracts/gauge/CLGaugeFactory.sol	86	Deploys one CLGauge per CLPool and wires the gauge to its pool and NFT manager.
contracts/periphery/SwapRouter.sol	184	User-facing router (v3 periphery fork): exact-in/exact-out single and multi-hop swaps, ETH wrapping via WETH9.
contracts/periphery/NonfungiblePositionManager.sol	329	ERC721 that custodies CL positions; mint/increase/decrease/collect. The NFT the gauge stakes.

Documentation

Source Code Protocol Docs

Part of the Uniswap V3 Path

This shadow audit connects to the Uniswap V3 Build module. Students who built the concentrated-liquidity pool have an advantage because they understand tick accounting, the swap loop, fee growth, the observation oracle, and callback-based payment.

View Build Module

Duration7 days

Total Findings8

Scope1848 SLOC

PriceFree