Security Audit Report for Bitget's bgw-swap-aggregator-evm

The target of this audit is the private code repository of bgw-swap-aggregator-evm of Bitget. BWAggregator is a DEX aggregator that enables swaps across Uniswap and its fork protocols through specialized router and handler actions. The platform supports ERC20-to-ERC20, ETH-to-ERC20, and ERC20-to-ETH swaps through a meta-transaction architecture. Users can specify complex action sequences for the aggregator to execute atomically on their behalf, typically involving multiple swaps across different protocols. The system employs a threephase execution method with fund tracking. Fee collection comprises two components: a fixed deduction amount and a proportional fee amount.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we have found that the codebase contains 2 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as security suggestions that should be considered. The bgw-swap-aggregator-evm team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.