DESCRIPTION
The target of this audit is the private code repository of bgw-swap-aggregator-solana of Bitget Wallet. The BGW Swap Aggregator is a comprehensive, Solana-native DEX protocol designed for optimal crypto trading. Serving the Bitget Wallet Swap ecosystem, it achieves efficiency through intelligent liquidity aggregation and order splitting.The protocol analyzes liquidity across multiple integrated DEXs—including Raydium AMM/CLMM and Pumpswap—to calculate the best swap price and minimize slippage. By leveraging advanced routing algorithms and Solana’s low fees, it provides a superior trading experience.
Please refer to the report for the detailed audit scope.
Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.
In summary, we did not find any critical issues within the audited codebase. However, we have identified some non-critical issues that should be addressed. Additionally, we have put forth recommendations and notes that should be taken into consideration. It is important to note that the scope of our audit was strictly limited to the specific code versions mentioned in the report. Any updates made subsequent to our review would require a re-evaluation.
KEY FINDINGS
In total, we find 2 potential issues in the smart contract. We also have 2 recommendations and 4 notes, as follows:
| ID | Severity | Description | Status |
|---|---|---|---|
| 1 | Low | Incorrect update in the function handle_action_token_out() |
Confirm |
| 2 | Low | Lack of handling pumpfun sell operation in swap_v3() function |
Confirm |
| 3 | - | Lack of validation between proxy_pda_index and current_proxy_pda |
Fixed |
| 4 | - | Default security setting for signature verification | Confirm |
| 5 | - | fee_params validation responsibility |
- |
| 6 | - | Potential Centralization Risks | - |
| 7 | - | Potential dust funds locked in proxy pda token accounts | - |
| 8 | - | The parameter order_id may be inaccurate |
- |
More details are provided in the audit report.
