We audited the DEX router of a live AI-agent protocol. Our AI found high-severity swap flaws. Details withheld under responsible disclosure.
We found the minimum-output parameter is effectively ignored in multi-hop swaps — the user's stated minimum is discarded, so a swap can execute at any price. MEV bots or a manipulated pool can extract most of the user's value. The project's own code comment notes the slippage gap.
Full mechanics withheld. Project owners: contact for the report.
We found approvals granted to pools are not reset after a swap, leaving standing allowances that a malicious pool could drain.
Swaps without slippage protection are a direct loss surface for users. AI caught it in minutes.