delegatecall with user-controlled target
Uniswap (v2 + v3)'s assessment for RD-F-012 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
V3: Pool inherits NoDelegateCall; noDelegateCall modifier on key functions and Factory createPool(). No user-controlled delegatecall. V2: No delegatecall patterns in UniswapV2Pair (Solidity 0.5.x, constant-product AMM). Green.
Detail #
UniswapV3Pool.sol and UniswapV3Factory.sol both inherit from NoDelegateCall abstract contract, applying the noDelegateCall modifier to critical functions. This is an explicit defensive measure against delegatecall attacks. UniswapV2Pair.sol was written in Solidity 0.5.x and does not use delegatecall in any form.
Sources #
- GitHubUniswapV3Pool.sol — NoDelegateCall inherited, modifier appliedUniswapV3Pool.sol — noDelegateCall modifier patternretrieved 2026-05-12
Methodology #
Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.
See the full factor methodology and distribution across all protocols →