TL;DR
Uniswap is the reference AMM, and a prior verdict of solid on the most foundational DEX we track is exactly the kind of judgement that coasts on reputation. So this run read the contracts instead. A deployed Uniswap v3 pool exposes 11 external functions and exactly two of them are owner-gated, both about fees, both bounded in the code itself. A v2 pair has no governance lever at all. The v4 PoolManager has no upgrade path, no pause, no selfdestruct, and it inherits a guard that actively rejects delegatecall. Nobody, not Uniswap Labs and not the UNI DAO, can upgrade a pool, freeze it, or move a liquidity provider's funds. That is the strongest fact in this report and it survived the check. What governance can do is turn a fee dial, and two weeks ago it did: Proposal 100 executed on 27 July 2026 and switched protocol fees on for v4 pools across seven chains. The v4 mechanic differs from v3 in a way that matters to LPs, and last month's report described it wrong. Everything else that can hurt you here is your own choosing: impermanent loss, a thin pool, or a v4 hook written by somebody else.
Checklist
Audits & contracts. I checked immutability rather than restating it. UniswapV3Pool.sol contains no delegatecall, no selfdestruct, no proxy hook, no pause modifier and no initializer; the same is true of UniswapV2Pair.sol and of the 395-line v4 PoolManager.sol, which additionally imports NoDelegateCall and applies a noDelegateCall modifier to initialize, modifyLiquidity, swap and donate. These are not proxies behind an admin, they are the code that runs. The v3-core repo carries its audit reports in a visible audits/ directory, from ABDK Consulting and Trail of Bits. v4-core has no equivalent directory, so the widely repeated claim of nine independent audits and a $2.35M security competition rests on Uniswap's blog rather than on an artifact you can open, which is a real step down in evidence quality even if the claim is probably fine. The bug bounty is live and verifiable on Cantina: $15.5M for a critical in v4 core, $2.25M each for v3-core and v3-periphery, $500K for v2, and 927 findings submitted since it opened in November 2024. Read the scope line before you take comfort from that number. It excludes bugs in "external tokens, price oracles, bridges, or other third-party protocols" even where they affect Uniswap users, unless caused directly by Uniswap-controlled code. That is precisely the category that took $12M out of Cork and $8.4M out of Bunni.
Admin control. Near nothing, and it is worth being specific about how near. UniswapV3Pool.sol declares 17 functions in total, of which 11 are external and the rest internal or private. Two of the 11 carry onlyFactoryOwner: setFeeProtocol and collectProtocol. setFeeProtocol reverts unless the value is zero or between 4 and 10, and the protocol takes one nth of the swap fee, so the factory owner can take between one tenth and one quarter and no more, with the ceiling enforced by a require statement rather than by a promise. collectProtocol clamps its withdrawal to the protocol fees already accrued, so it cannot reach LP principal or LP-owed fees even if the owner key is stolen. A v2 pair has no governance-gated function at all; its only access check is a one-shot initialize restricted to the factory at deployment. The single v2 lever anywhere is feeTo on the factory, and _mintFee hardcodes the cut at one sixth of the growth in the square root of k, meaning governance can switch v2 on or off but cannot tune it. v4 keeps the same shape: setProtocolFeeController is owner-only, setProtocolFee reverts for any caller other than that controller and must pass isValidProtocolFee, and MAX_PROTOCOL_FEE is 1000 out of a 1,000,000 denominator, so 0.1% per swap direction is the hard ceiling. Uniswap Labs still runs the frontend, the wallet and the API. That is a censorship and phishing surface, not a fund-loss surface, because the pools work without any of it.
Oracle. The core needs no price feed, which deletes an entire failure class that dominates lending-protocol postmortems. Uniswap is a price source rather than a price consumer. Its TWAPs are manipulable on thin pools, and the losses from that have always landed on the protocols that trusted them, not on Uniswap LPs. If you provide liquidity into a v4 pool whose hook reads an oracle, you have inherited that hook's oracle risk and it is no longer this dimension you should be reading.
Liquidity & exit. $3.00B across all live versions, split $1.40B in v3, $0.80B in v2, $0.80B in v4 and $3.1M in the deprecated v1. Exit is a single permissionless transaction with no cooldown, no queue and no withdrawal cap. TVL is down 22.3% over 90 days and 49.5% over a year, which is a size and market-cycle story, not a distress story, and depth on majors remains the best in DeFi. One caveat is real: Trail of Bits lists "hook failures can block pool actions" among its seven recurring v4 hook failure patterns, and its example is exact. If reward distribution, dust cleanup or other non-essential code reverts inside an afterRemoveLiquidity callback, users cannot exit their positions. That is a hooked-pool risk, not a Uniswap risk, but the money is just as stuck while you wait.
Yield: real vs emission. No emissions subsidise LP returns at all, which is rarer than it should be. The fees are large and real: $98.4M over 30 days, $842.3M over the last year, $5.74B all time. Impermanent loss is still the thing that decides whether your net is positive, and it is not a protocol constant. On the protocol fee, last month's report said the switch "clips roughly one-sixth of the LP fee", and that is right for v3 and wrong for v4. In v3 the cut is genuinely subtractive: setFeeProtocol diverts a tenth to a quarter of the fee that would otherwise have accrued to you. In v4 it composes instead. ProtocolFeeLibrary.calculateSwapFee returns protocolFee plus lpFee minus their product, and the source comment states the order plainly: the protocol fee is taken from the input amount first, then the LP fee is taken from what remains. On a 30bp pool with a 5bp protocol fee the trader pays 34.99bp all in, the LP fee tier is untouched at 30bp, and the LP ends up with 29.985bp of the original input. Hayden Adams put it as "protocol fees are additive, not subtractive", and on the mechanic the source agrees with him: the LP gives up fifteen thousandths of a basis point, which is immaterial. Critics arriving at a 20% to 33% figure are measuring the protocol's cut as a share of LP fee revenue, or looking at lower fee tiers where that ratio runs higher. That is a dispute about which denominator to use, not evidence that LP economics fell by a third, and I am not going to pretend either framing is the only honest one.
Holder concentration. Blocked again. Etherscan's top-holder endpoint is a Pro feature and returned the paywall refusal for the second consecutive month when re-attempted this run, so the distribution stays unverified and this dimension stays yellow on absence of evidence rather than on evidence of a problem. What is measurable: 624.3M UNI circulating, 891.6M total, 1B max. Total supply was 893.2M at the last run and is 891.6M now, so roughly 1.6M UNI has left the supply in the 40 days since, and the burn is demonstrably running rather than merely announced. Whatever became of the 2% perpetual inflation clause from the 2020 launch blog, net supply is contracting. UNI concentration is a governance question, since concentrated holders steer the fee dial, and the dial has a code-enforced ceiling. It is not a claim on your LP position.
Track record. No exploit of v2, v3 or v4 core across three market cycles. That claim is usually made by Uniswap about itself, so I checked it against a tracker that has no reason to be kind: DeFiLlama's hacks list holds 621 entries, is current through 9 August 2026, added 173 entries during 2026, and contains zero rows mentioning Uniswap. The same list carries "Cork V1", 28 May 2025, $12,000,000, technique recorded as "Access Control Bypass Via Hook", and "Bunni V2", 2 September 2025, $8,400,000, recorded as a liquidity distribution function exploit. So the tracker does cover the hook layer, files it under the hook project's name, and still has nothing to file under Uniswap. Trail of Bits reached the same conclusion independently on 30 July 2026, stating that neither incident stemmed from a flaw in the Uniswap v4 core protocol or the PoolManager, and that both arose from application-specific authorization and accounting logic built around hooks. The honest asterisk stays. Uniswap v1, deprecated for years, lost somewhere between $300k and $1.1M in April 2020 when its imBTC pool was drained through ERC-777 reentrancy, so "never hacked" is a v2-and-later claim. An X scan covering 3 July to 12 August 2026 turned up no Uniswap incident, no frontend compromise, no DNS hijack and no router exploit; the only Uniswap-branded scams in that window were phishing sites, not compromises of anything Uniswap runs.
Worst case
For a v2, v3 or hookless v4 position the realistic worst case is not theft. It is impermanent loss quietly outrunning your fee income in a volatile pair while the headline APR still looks healthy, and governance widening the protocol fee on your pool up to its code ceiling. Neither of those is a hack and neither will be announced.
For a hooked v4 pool the worst case is total loss of that position, and it is not hypothetical. Pool creation through the PoolManager is permissionless, initialize carries no access control, the hook address is part of the pool key, and anyone can deploy a pool with any hook on any token pair. A malicious or merely buggy hook can drain the pool through accounting that still satisfies the PoolManager's settlement invariant, or brick your withdrawal by reverting in a callback. Cork and Bunni are what that looks like with real money. The $15.5M bounty does not cover it. There is no insurance fund anywhere in this stack.
The quieter worst case is the long tail. Anybody can list any token, so the pool that pays 400% is usually paying you to hold something nobody else wants, and the AMM will execute that trade faithfully all the way down. Uniswap being safe does not make the pool you picked safe.
Bottom line
Solid, and this run earned it from source rather than inheriting it. The core is immutable in the strict sense: no proxy, no pause, no admin withdrawal, and the single governance lever is a fee fraction with a ceiling written into the require statements. Fees are real and there are no emissions propping up the yield. The verdict covers canonical v2 and v3 pools and hookless v4 pools in deep pairs. Every hooked v4 pool is a separate protocol wearing Uniswap's brand and belongs to its own risk assessment, with the bounty scope exclusion as the clearest signal that Uniswap agrees. Size for impermanent loss, not for the fee APR, and read the hook address before you read the APR.
Data appendix
- TVL: $3.00B ($2,997,922,840; DeFiLlama parent
uniswap). Slug nuance, resolved: DeFiLlama has no standaloneuniswapprotocol row. The parent splits intouniswap-v3$1,401,472,916,uniswap-v4$797,969,173,uniswap-v2$795,401,518 anduniswap-v1$3,079,235, which sum to the parent to the dollar. This report uses the parent figure, because the subject is Uniswap and not one of its versions. - TVL trend: 30d ago $3.0516B (-1.8%), 90d ago $3.8601B (-22.3%), 1y ago $5.9420B (-49.5%). ATH $10.2404B on 2021-05-12, so today is 29.3% of ATH (DeFiLlama historical series, 2,840 daily points beginning 2018-11-03).
- Discrepancy in our own table, flagged and re-measured:
/riskshows Uniswap at $1.40B, stored as $1,398,840,482.59 with a 30d change of -3.5%. That is theuniswap-v3book, 46.7% of the protocol's actual $3.00B. Cause traced inservices/scanner/protocol_facts.pyand confirmed against the live/protocolspayload (8,019 entries):_index()keys DeFiLlama's protocols by slug and name, no key normalises touniswap,SLUG_OVERRIDEandPARENT_AGGREGATEhave no entry for it, somatch_protocol()falls through to the fuzzy branch, which sorts the six names containing "uniswap" by TVL and returns Uniswap V3. Same failure class as the documented Mellow ($2.7k) and Kinetiq ($78M short) misses already annotated in that file, andPARENT_AGGREGATEis where the fix would go. Not fixed here, flagged for the maintainer. - Fees: $4.49M 24h (a +83.7% day, treat as spiky), $19.63M 7d, $98.37M 30d, $842.31M 1y, $5.736B all time (DeFiLlama fees API). The 30d figure has more than doubled since the 2026-07-03 run ($43.28M) while the 1y figure moved only from $842.1M to $842.31M; the two are hard to reconcile, cause not established, so do not read it as a confirmed volume surge.
- Protocol revenue: $230,424 24h, $1.62M 7d, $5.23M 30d, $30.76M 1y, $30.94M all time. The 1y figure is 99.4% of the all-time figure, which independently confirms that protocol revenue is a post-UNIfication phenomenon. Press coverage of Proposal 100 reports roughly $325k/day against DeFiLlama's $230k for this particular day; both are cited, neither is reconciled.
- Audits: v3-core
audits/directory verified this run, containsabdkandtob(ABDK Consulting, Trail of Bits). v4-core has noaudits/directory (repo root listed this run); the nine-audits and $2.35M security-competition claims are Uniswap-blog-sourced from the 2026-07-03 run and were not re-verified against a repo artifact. Bug bounty verified live on Cantina, status Live, opened 2024-11-26, 927 findings submitted: critical $15.5M (v4 core), $2.25M (v3-core), $2.25M (v3-periphery), $500K (v2), $2.25M (other contracts), $2.25M (Unichain L1), $250K (web apps and infrastructure); high $1M, medium $100K on v4 core. Scope excludes bugs in external tokens, price oracles, bridges or other third-party protocols even where they affect Uniswap users, unless caused directly by Uniswap-controlled code. - Admin / governance (verified from contract source this run):
UniswapV3Pool.solis 869 lines and declares 17 functions, 11 of them external and 2 of those gated byonlyFactoryOwner:setFeeProtocol(requires 0 or 4 to 10, so one tenth to one quarter of the swap fee) andcollectProtocol(clamped to accruedprotocolFees, cannot reach LP funds).UniswapV2Pair.solis 201 lines with zero governance-gated functions; its only access check isinitialize, restricted to the factory at deployment. The one v2 lever isfeeToonUniswapV2Factoryset byfeeToSetter, with_mintFeefixing the cut at one sixth of the growth in sqrt(k). v4PoolManager.solis 395 lines, inheritsProtocolFees.solandNoDelegateCall:setProtocolFeeControllerisonlyOwner,setProtocolFeereverts for any caller other than the controller and must passisValidProtocolFee, andProtocolFeeLibrary.MAX_PROTOCOL_FEEis 1000 pips of a 1,000,000 denominator, so 0.1% per swap direction. None of the three contracts contain delegatecall, selfdestruct, an upgrade function, an initializer or a pause.PoolManager.initializecarries onlynoDelegateCalland no access control, so pool creation with any hook is permissionless by design. - Fee switch state: UNIfication passed 2025-12-25 (prior run). Expanded 2026-03-08 and 2026-06-02 (prior run). New this run: Governance Proposal 100 executed 2026-07-27, activating protocol fees on selected v4 pools across Ethereum, Arbitrum, Base, BNB Chain, Polygon, OP Mainnet and Robinhood Chain, passing with roughly 46.6M UNI for and 1.27M against against a 40M quorum. The protocol fee is 5bp on enabled pools, equal to one sixth of the LP fee on the 30bp tier, routed through V4FeePolicy and V4FeeAdapter to TokenJar contracts and bridged back to Ethereum to buy and burn UNI. Hayden Adams submitted the proposals on 2026-07-17 and publicly rebutted the LP-cut framing with "protocol fees are additive, not subtractive";
calculateSwapFeereturning protocolFee + lpFee - product, plus its source comment that the protocol fee is taken from the input first and the LP fee from the remainder, corroborates the mechanic for v4. - Oracle: none consumed by core. Publishes TWAPs; manipulation risk sits with integrators and with hooks that add oracle logic.
- Token: UNI $3.75, market cap $2.34B (rank 37), FDV $3.35B, 624,316,424 circulating, 891,564,420 total, 1B max, ATH $44.92 on 2021-05-02, +1.4% over 30 days (CoinGecko, updated 2026-08-11T21:10Z). Total supply was 893.2M on 2026-07-03 and is 891.6M now, roughly 1.6M UNI removed, consistent with an active burn.
- Holder concentration: top-holder table
_refresh_. EtherscantokenTopHoldersre-attempted this run against 0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984 and returned the API Pro paywall refusal, second consecutive blocked run. Genesis split 60.00% community / 21.266% team / 18.044% investors / 0.69% advisors with 4-year vesting completed September 2024, carried from the 2026-07-03 launch-blog fetch and not re-verified this run. - Incident record: DeFiLlama hacks list, 621 entries, current through 2026-08-09, 173 entries dated 2026, zero rows mentioning Uniswap. Cork V1 2025-05-28 $12,000,000 "Access Control Bypass Via Hook" and Bunni V2 2025-09-02 $8,400,000 "Liquidity Distribution Function Exploit" are both listed under their own names. Trail of Bits, 2026-07-30, names seven recurring hook failure patterns: anyone can call your hook, treating any pool as legitimate, custom accounting leaks value, right logic wrong hook, address bits are part of the API, hook failures can block pool actions, and state can change during a callback sequence. Uniswap v1 imBTC pool drained 2020-04-18 via ERC-777 reentrancy, $300k to $1.1M depending on source, carried from the prior run, not re-verified this run and not present in DeFiLlama's list.
- Recent-news scan: X search covering 2026-07-03 to 2026-08-12 found no Uniswap incident, exploit, frontend compromise, DNS hijack, router exploit or v4 hook exploit; Uniswap-branded scam reports in the window were phishing sites, not compromises of Uniswap infrastructure. Governance items only: Proposal 100 execution, Hayden Adams on 2026-07-17 on the onchain proposals, and ongoing August discussion of v4 volume and LP retention under the active fee switch.
Maintained monthly. Methodology: DeFi Research Instruction v2.