Unipilot Final Audit Report

Table Of Content



BlockApex (Auditor) was contracted by Voirstudio (Client) for the purpose of conducting a Smart Contract Audit/Code Review. This document presents the findings of our analysis which took place on 19th August 2021. 

Audit Log

Entry #1
Date: 11th October 2021
In the first week, we developed a deeper understanding of the protocol and its workings. We started by reviewing the five main contracts against common solidity flaws and did a static analysis using Slither. In the second week, we wrote unit-test cases to ensure that the functions are performing their intended behaviour. In the 3rd week, we began with the line-by-line manual code review.

Note: We haven’t fuzzed the end-to-end smart contracts behaviour in this auditing round. So this is the version of the report with the issues that were found in all the steps we performed before the above mentioned date. We are now engaged again by Unipilot to further test and fuzz properties. A detailed analysis will be shared later in an updated version of the report which will be published later.

Entry #2
Date: 1st November 2021
We were tasked with an additional review of the protocol by Voirstudio to verify the mathematics and economics of Unipilot. We fuzzed the smart contracts to test properties of the protocol and found some issues which are reported below. We have tested and discussed a few bullets in the grey area regarding the economics of the protocol and worked out contingency plans around it.

Note: We worked closely with the developers and the fixes were incrementally applied. The team was very supportive and was open to suggestions and discussion. They even provided a few pointers as to where we would find potential vulnerabilities. 

Project Details

Name: Unipilot
Auditor: Moazzam Arif | Kaif Ahmed | Muhammad Jarir Uddin
Platform: Ethereum/Solidity
Type of review: Mathematics, Tokenomics, Liquidity Management, Index Fund
Methods: Architecture Review, Functional Testing, Computer-Aided Verification, Manual Review
Git repository: First review: https://github.com/VoirStudio/unipilot-protocol-contract-v2/tree/update-structure
Git repository: Second review: https://github.com/VoirStudio/unipilot-protocol-contract-v2/tree/update-getSharesAndAmounts
White paper/ Documentation: https://unipilot.medium.com/
Document log: 1st review: Initial Audit (19th August 2021) | Final Audit (11th October 2021) 2nd review: Initial Audit (20th October 2021) | Final Audit (26th October 2021)


The git-repository shared was checked for common code violations along with vulnerability-specific probing to detect major issues/vulnerabilities. Some specific checks are as follows:

Code reviewFunctional review
Reentrancy Unchecked external callBusiness Logics Review
Ownership TakeoverERC20 API violationFunctionality Checks
Timestamp DependenceUnchecked mathAccess Control & Authorization
Gas Limit and LoopsUnsafe type inferenceEscrow manipulation
DoS with (Unexpected) ThrowImplicit visibility levelToken Supply manipulation
DoS with Block Gas LimitDeployment ConsistencyAsset’s integrity
Transaction-Ordering DependenceRepository ConsistencyUser Balances manipulation
Style guide violationData ConsistencyKill-Switch Mechanism
Costly LoopOperation Trails & Event Generation

Project Overview

Unipilot is an auto-liquidity management protocol built on top of Uniswap v3. It simplifies the liquidity management by rebasing the liquidity of the pool, when prices get out of range.

To readjust the liquidity of the pool, Captains (independent nodes) are compensated for the gas fee plus some bonus in $PILOT.

It also has a governing token i.e., $PILOT. When a protocol earns a fee from Uniswap v3, users have the option to claim a fee in equivalent $PILOT (price is fetched from $FEE_TOKEN/$WETH -> $PILOT/$WETH price oracles).

System Architecture

The protocol is built to support multiple dexes (decentralized exchanges) for liquidity management. Currently it supports only Uniswap v3’s liquidity. In future, the protocol will support other decentralized exchanges like Sushiswap (Trident). So the architecture is designed to keep in mind the future releases.

The protocol has 5 main smart contracts and their dependent libraries.

Unipilot.sol: The smart contact is the entry point in the protocol. It allows users to deposit, withdraw and collect fees on liquidity. It mints an NFT to it’s users representing their individual shares.

V3Oracle.sol: It is a wrapper around Uniswap oracles. It also has helper functions to calculate TWAP (time-weighted average price) and other prices relevant data.

UniswapLiquidityManager.sol: The heart of the protocol that allows users to add, withdraw, collectFee and readjust the liquidity on Uniswap v3. This smart contract interacts with Uniswap v3Pool and v3Factory to add and remove liquidity. It maintains 2 positions on Uniswap i.e., base position and range position (leftover tokens are added as range orders).

UniStrategy.sol: The smart contract to fetch and process ticks’ data from Uniswap. It also decides the bandwidth of the ticks to supply liquidity (on the basis of governance).

ULMState.sol: This smart contract fetches the updated prices and tick ranges from Uniswap’s v3 pools.

Steps to Add Liquidity:

1-User will give approval of both tokens to Unipilot.sol

2-User will call the deposit method of Unipilot.sol 

3-Unipilot.sol’s deposit method will call the deposit method of UniswapLiquidityManager.sol and transfer both the tokens to UniswapLiquidityManager.sol

4-UniswapLiquditymanager.sol will add the liquidity on Uniswap. This will:
a. Mint an NFT denoting the user’s shares in the liquidity provided
b. 2-Alter the existing liquidity by increasing the user’s share


Executive Summary

In our first iteration, we found 1 critical-risk issue, 4 high-risk issues, 1 medium-risk, 1 low-risk issue and 1 informatory issue. All these issues were refactored and fixes have been made. A detailed report on the first review can be found here.

The second iteration was performed recently, with the updated codebase. We found a few more issues that were promptly fixed by the team. Our analysis indicates that the contracts are now secure.


Our team found:

# of issues Severity of the risk
1Critical Risk issue(s)
0High Risk issue(s)
3Medium Risk issue(s)
0Low Risk issue(s)
2Informatory issue(s)


Critical-risk issues

1.  Ether balance of contract can be withdrawn

File: PeripheryPayments.sol

Unipilot conducted a testnet bug bounty. In that some users reported they were unable to collect their fees. By investigating that with the dev team, they founded that ERC20/WETH pool was misbehaving due to the following code snippet:

if (balanceWETH9 > 0) {
IWETH9(WETH).withdraw(balanceWETH9); // contract balance is transferred 
TransferHelper.safeTransferETH(recipient, balanceWETH9);} 

The dev team suggested to remove this method and pass proper amount to be withdrawn


High-risk issues

No high-risk issues were found.

Medium-risk issues

1. Math Precision issues

File: UniswapLiquidityManger.sol & ULMState.sol

Unipilot uses 1e18 precision for calculating the Liquidity shares and feeGrowth when adding liquidity and fees. This causes some small amounts to be locked forever in the UniswapLiquiditymanager.

See the following code snippet:

       position.feeGrowthGlobal0 += FullMath.mulDiv(
collect0Base + collect0Range,
           1e18, // precision


We suggest using FixedPoint128.Q128 from Uniswap. We fuzzed against this precision and we got more precise results


2. Safe cast and Safe Math


There are many instances in the contract which use unsafe math operations. This might lead to overflow/underflow. The contract also uses unsafe type casting.
See the following code snippet of unsafe cast:

 (int256 amount0Delta, int256 amount1Delta) = 
     int256(b.amountIn), // unsafe casting, use safeCast
     abi.encode((SwapCallbackData({ token0: token0, token1: token1,
fee: fee })));

We suggest to use safe math and safe cast libraries
Fixes in progress

3. Economic Attacks

a. Price Oracle manipulation
Unipilot relies on TWAP when minting new $PILOT tokens, either in fees or in readjustment of the pool. Tokens are priced w.r.t to ether and then from etherAmount the pilotAmount is calculated.

Attack Scenario:
Consider users who want to get $PILOT in fees instead of underlying tokens. Users can create a pool with $WETH, do some swaps, and inflate the tokens against $WETH. Unipilot will get the etherAmount of tokens from the pool and convert ethers to pilot. Hence the user gets the $PILOT at a manipulated price.

To mitigate this attack, devs already have implemented whitelisting of pools when distributing fees. But they had not implemented whitelisting during readjustments.

Add whitelisting to readjustment


b. Put a limit on tx.gasPrice

File: UniswapLiquidityManger.sol

When a user readjust the pool, his transaction fees is compensated plus a
Premium is given to the user in $PILOT.

b.gasUsed = tx.gasprice.mul(initialGas.sub(gasleft()));
 // tx.gasprice can be adjusted high enough to mint more $PILOT  
  b.pilotAmount = IOracle(_oracle).ethToAsset(PILOT,

Add a limit to tx.gasprice


c. Probable Slippage Attacks
While readjusting the pool, the Unipilot swaps X amount of tokens to make the pool in range. The swap percent (how much should be swapped) and the slippage is hardcoded. This incentivizes sandwich attacks.

The swap amount and slippage should be configurable according to favorable conditions


Low-risk issues 

No low-risk issues were found.

Informatory issues and Suggestions

1. Contracts should be made pausable in case of a mishap.

2. Contracts should have rescue funds methods.


The smart contracts provided by the client for audit purposes have been thoroughly analyzed in compliance with the global best practices till date w.r.t cybersecurity vulnerabilities and issues in smart contract code, the details of which are enclosed in this report. 

This report is not an endorsement or indictment of the project or team, and they do not in any way guarantee the security of the particular object in context. This report is not considered, and should not be interpreted as an influence, on the potential economics of the token, its sale or any other aspect of the project. 

Crypto assets/tokens are results of the emerging blockchain technology in the domain of decentralized finance and they carry with them high levels of technical risk and uncertainty. No report provides any warranty or representation to any third-Party in any respect, including regarding the bug-free nature of code, the business model or proprietors of any such business model, and the legal compliance of any such business. No third-party should rely on the reports in any way, including for the purpose of making any decisions to buy or sell any token, product, service or other asset. Specifically, for the avoidance of doubt, this report does not constitute investment advice, is not intended to be relied upon as investment advice, is not an endorsement of this project or team, and it is not a guarantee as to the absolute security of the project.

Smart contracts are deployed and executed on a blockchain. The platform, its programming language, and other software related to the smart contract can have its vulnerabilities that can lead to hacks. The scope of our review is limited to a review of the Solidity code and only the Solidity code we note as being within the scope of our review within this report. The Solidity language itself remains under development and is subject to unknown risks and flaws. The review does not extend to the compiler layer, or any other areas beyond Solidity that could present security risks.

This audit cannot be considered as a sufficient assessment regarding the utility and safety of the code, bug-free status or any other statements of the contract. While we have done our best in conducting the analysis and producing this report, it is important to note that you should not rely on this report only - we recommend proceeding with several independent audits and a public bug bounty program to ensure security of smart contracts.

More Audits

The Collapse of Blockchain Security: August Edition

Over $720M worth of funds were stolen this month, illuminating a dangerous message about the security and reliability of these platforms- raising several questions. Is orchestrating an attack of this level really so easy? If I happen to be a daring individual with the right technical skills, can I too be the owner of millions of dollars worth of funds? And most importantly, what measures can other platforms take beforehand to ensure they and their users are safe from becoming the next target?

The Poly Network Hack: Who to Blame?

What was essentially the biggest hack in the history of cryptocurrency became a valuable lesson on the importance of security and just how powerless big organizations can become in the face of powerful hackers. The unusual trajectory of this incident also begs the question of where to place the blame in these kinds of attacks. Read more to find out exactly how the hack took place as we analyze the most pressing questions surrounding this attack.

Dafi BSC-ETH Bridge (Final Audit)

Dafi’s “dbridge” enables users to bring their ERC-20 $DAFI tokens across from the Ethereum network to Binance Smart Chain, and vice versa, with aims of making $DAFI available on multiple high-speed and low-cost networks.

The DAO Dichotomy: Public Interest Or Personal Gain?

DAOs can be seen as the next step in achieving this vision, eliminating the use of intermediaries in corporate governance. Functioning via an interconnected network of smart contracts, these Decentralized Autonomous Organizations are essentially communities that are fully managed and owned by their members.

Platypus Finance - February 16, 2023

On February 17, 2023, Platypus Finance was hacked, resulting in a loss of approximately $8.5 million worth of assets. In this hack analysis, we will delve into the details of the attack, the vulnerability that was exploited, and the impact it had on the platform and its users.

Web3: The Advent And Advancement

Creating an internet owned by no one yet contributed to by everyone is bound to have problems related to security- something many believe that the builders of Web3 may not be equipped with.

Social Engineering: Classification & Prevention

Social Engineering is an art, where an attacker manipulates people to extract confidential information. That information could be used in various ways by criminals. Individuals are targeted to install malicious software that could give cybercriminals access to their operating systems,

Remote Work & Cybersecurity Risks 

It is crucial to come up with innovative solutions against cyberattacks, especially when your workforce is remotely working. Since we know that remote work comes with a bunch of security risks, it is essential to cater to them.

Consumer Privacy & Data Breach Part I - Is It a Global Issue?

Data breaches and consumer privacy are one of the most alarming security issues in IT space. About 45% of the world’s population uses social media which makes approximately 3.48 billion people to be interacting with any kind of social media network. These tremendous amounts of connections can lead to various kinds of vulnerabilities if the data is gone into the wrong hands creating pretty damaging consequences.

1 2 3 11
Designed & Developed by: 
All rights reserved. Copyright 2023