Unizen

We express our gratitude to the Unizen team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Unizen is a next-generation DEX aggregator, offering developers, traders, and businesses the ability to unlock unparalleled token swap capabilities.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

• Functional requirements are detailed.

• • Project overview is detailed

  • All roles in the system are described.

  • Use cases are described and detailed.

  • For each contract, all futures are described.

  • All interactions are described.

• Technical description is clear and concise.

• • Run instructions are provided.

  • Technical specification is provided.

  • The NatSpec documentation is sufficient.

Code quality

• The development environment is configured.

Test coverage

Code coverage of the project is approximately 60.00% (branch coverage).

• Deployment and basic user interactions are covered with tests.

• Negative cases coverage is partially missed.

• Interactions involving multiple users are tested.

• Fork tests are present.

• Not all branches are covered by tests.

The Unizen DEX Aggregator leverages a set of specialized smart contracts, optimizing decentralized token swaps with a focus on cross-chain interoperability and cost efficiency. Unizen enables seamless, omni-chain swaps across various blockchain networks through a modular contract architecture, aggregating liquidity from multiple interoperability providers, including LayerZero, Debridge, Meson, Stargate, and Thorchain. This architecture supports single-chain and cross-chain trades, utilizing optimized routes to minimize costs and execution time. Key roles include the Router, which orchestrates trade execution, Executors for specific swap tasks, and specialized contracts for cross-chain compatibility.

The files in the scope:

• SingleChainExecutor.sol: Manages single-chain token swaps using multiple methods on a single blockchain.

• GasLessExecutor.sol: Facilitates gasless transactions by validating signed user orders for trade execution without requiring user gas.

• UnizenRouter.sol: Central router that initiates all trade executions, coordinates executors, and manages protocol fees.

• UnizenBridgeExecutor.sol: Handles asset bridging across chains within Unizen’s ecosystem using LayerZero interoperability.

• DebridgeMesonWormholeExecutor.sol: Executes cross-chain swaps via Debridge, Meson, and Wormhole protocols.

• BaseExecutor.sol: Provides foundational swap, fee handling, and asset recovery functions for executors.

• DexHelpers.sol: Maintains a whitelist of approved DEXes and functions that executors can access.

• StargateThorchainExecutor.sol: Manages cross-chain swaps using Stargate and Thorchain protocols.

• EthReceiver.sol: Simple contract to receive and hold ETH.

• Controller.sol: Governs the protocol, managing contract pausing, whitelisting DEXes, and handling dev permissions.

• CCTPBase.sol: Base contract for cross-chain messaging and asset transfers via Wormhole and Circle's CCTP.

• IGaslessExecutor.sol: Defines the structure for gasless order execution, including UnizenGasLessOrder struct to handle gasless swap details and an event for gasless swap completion.

• IStargateThorchainExecutor.sol: Provides structures and functions for cross-chain swaps via Stargate and Thorchain, detailing swap parameters and events for tracking cross-chain swap status and UTXO operations.

• IRouter.sol: Interface for UnizenRouter, managing token transfers and program execution, with specific structures for handling executors, token transfer permits, and executable programs.

• IDebridgeMesonWormholeExecutor.sol: Specifies structures and functions for executing cross-chain swaps using Debridge, Meson, and Wormhole protocols, detailing swap events for each protocol’s operations.

• ISingleChainExecutor.sol: Interface for single-chain swaps, defining structures for exact-in and exact-out swap types and functions for initiating these swaps with related events.

• IWETH.sol: Interface for Wrapped ETH (WETH) functions, including deposit, transfer, and withdraw methods to interact with the WETH token contract.

• IDexHelpers.sol: Interface for DexHelpers, providing a function to verify if a given DEX and function selector is whitelisted for trading.

• Types.sol: Defines key data structures (Integrator, SwapCall, ContractBalance, Permit) used across contracts to manage trade parameters, contract balances, and integrator fees.

• IUniswapV2Pair.sol: Interface for Uniswap V2 pair interactions, specifically for executing token swaps within a Uniswap V2 liquidity pool.

• ILayerZeroUserApplicationConfig.sol: Interface for configuring LayerZero messaging, allowing applications to set messaging versions, manage configurations, and resume message flow.

• ILayerZeroReceiver.sol: Interface for receiving LayerZero cross-chain messages, enabling the contract to handle payloads from other chains through the lzReceive function.

• IStargateReceiver.sol: Interface for receiving tokens and executing swaps via Stargate protocol, handling messages with specific chain IDs, tokens, and payload data for cross-chain swaps.

Privileged roles

• UnizenRouter.sol

• • Owner:

  • • Can set executor and gasless executor status with setExecutor.

    • Can set the Permit2 contract address with setPermit2.

    • Can withdraw earned fees from executors using unizenWithdrawFee.

  • Executor:

  • • Authorized to execute transactions through the execute function.

    • Can call routerTransferTokens to transfer tokens on behalf of users.

    • Can use routerTransferTokensPermit2 for token transfers under gasless conditions if it has been permitted by Permit2.

• Controller.sol

• • Owner:

  • • Assigns a developer management address via setDevMultiSign.

    • Pauses and unpauses contract execution using adminPause and adminUnPause.

  • Dev:

  • • Can whitelist or remove DEX addresses via whiteListDex and whiteListDexes.

    • This role is given permissions to manage DEX verification lists and ensure only approved addresses can execute trades.

• DexHelper.sol

• • Owner:

  • • Can set a developer for managing DEX whitelisting with setDev.

  • Developer (Dev):

  • • Can whitelist DEX addresses and their associated function selectors using whitelistDexes.

    • Can remove DEX addresses from the whitelist through removeDexes.

    • Can add or remove specific function selectors for any DEX with addOrRemoveFuncSign.

• BaseExecutor (Inherits in all Executors)

• • Owner:

  • • Updates the router and DexHelper contract addresses.

    • Manages token allowances by revoking approvals.

    • Withdraws earned fees from integrators with unizenWithdrawEarnedFee.

    • Recovers assets mistakenly left in the contract via recoverAsset.

  • UnizenRouter:

  • • Only Unizen Router can call unizenWithdrawEarnedFee to withdraw earned fees across multiple tokens.

• DebridgeMesonWormholeExecutor

• • Owner:

  • • Configures cross-chain parameters (DLN, Meson, Wormhole), including setting stable token statuses, relayer contracts, and integrators.

    • Updates contract configurations for Wormhole, including address mappings for supported tokens and integrators.

• GasLessExecutor

• • Owner:

  • • Configures senders for gasless transactions with setSender.

    • Can initialize contract settings including WETH and DexHelper.

  • UnizenRouter:

  • • Authorized to execute the swapGasLess function for executing gasless swaps on behalf of users.

• SingleChainExecutor

• • Owner:

  • • Configures contract parameters such as WETH and router address.

  • UnizenRouter:

  • • Authorized to execute swap and swapExactOut, allowing swaps and managing liquidity on a single chain.

• StargateThorchainExecutor

• • Owner:

  • • Configures Stargate and Thorchain routers and manages valid destination addresses.

    • Sets destination addresses for supported chain IDs.

    • Manages stable token mappings and approvals across Stargate pools.

  • UnizenRouter:

  • • Authorized to execute swapSTG and swapTC for cross-chain swaps, allowing source and destination swaps across supported chains.

• UnizenBridgeExecutor

• • Owner:

  • • Manages LayerZero endpoint configurations and cross-chain destination mappings.

    • Configures bridge tokens, their supported destinations, and corresponding mappings.

    • Sets fee rate and fee recipient addresses.

  • UnizenRouter:

  • • Authorizes deposits and token transfers via deposit, enabling cross-chain bridging functionalities.

The scope of the project includes the following smart contracts from the provided repository: