Dirol

We express our gratitude to the Dirol team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Dirol is a multi-router DEX aggregator that supports complex weighted swaps across six different decentralized exchange types.

The system users should acknowledge all the risks summed up in the risks section of the report

{Finding_Table?columns=title,severity,status&setting.filter.type=Vulnerability}

Documentation quality

• NatSpec is sufficient.

• Technical description is provided.

Code quality

• Some of the practices are not applied.

Test coverage

Code coverage of the project is 100% (branch coverage).

• Deployment and basic user interactions are covered with tests.

Dirol implements a multi-router DEX aggregator (CoreAggregator) that supports complex weighted swaps across six different decentralized exchange types, including Uniswap V2/V3, LFJ V1, ZkSwap V3, Kuru, and Crystal orderbooks. It is tightly integrated with a gasless limit order module (LimitOrderModule), which allows off-chain order signing via Permit2 and on-chain execution by authorized keepers when profitable.

The files in the scope:

1\. CoreAggregator

Type: Upgradeable, Ownable

Primary Role: Acts as the core DEX aggregator for executing complex multi-hop and multi-router swaps.

Key Features:

• Supports 6 router types: Uniswap V2/V3, LFJ V1, ZkSwap V3, Kuru Orderbook, Crystal Orderbook.

• Permit2 integration enables gasless token approval.

• Weighted route execution with fee deduction and split routing logic.

• Support for both ERC20 and native ETH input/output.

Swap Methods:

• swap: Direct swap function.

• swapWithPermit2: Swap using a Permit2 signature.

• swapWithPermitted: Swap using a pre-approved Permit2 allowance.

Router Management:

• setRouter / removeRouter: Owner-controlled router registry.

Fees:

• Configurable via setFee and setFeeReceiver (BPS-based).

Emergency:

• withdrawStuckTokens: Emergency token recovery function.

2\. LimitOrderModule

Type: EIP-712 compliant limit order executor.

Primary Role: Enables off-chain signed limit orders to be executed on-chain by authorized keepers.

Key Features:

• Gasless order creation using Permit2's permitWitnessTransferFrom.

• Order execution through CoreAggregator with fee collection.

• Strict input validation and reentrancy protection.

• On-chain order cancellation by users (per order or all).

Fee:

• 10 BPS taken from output amount, sent to feeRecipient.

Keeper Model:

• Only pre-authorized addresses (set by owner) can execute orders.

Order Tracking:

• Nonce-based system to invalidate old orders.

• getOrderKey provides unique hash of an order for identification.

PRIVILEGED ROLES

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope