yAudit Contact
Reports

Smart Contract Security Assessment

Vfat - Aggregator Connector

The Aggregator Connector contract is a generic swap router interface that enables token swaps through any external aggregator by forwarding arbitrary calldata while ensuring minimum output amounts.

2
Issues
0
C/H/M
Period
Sep 10, 2025 - Sep 11, 2025
Auditors
Watermelon, Panda

Review Summary

Protocol Overview

The Aggregator Connector contract is a generic swap router interface that enables token swaps through any external aggregator by forwarding arbitrary calldata while ensuring minimum output amounts.

Protocol
Sickle
Timeline
Sep 10, 2025 - Sep 11, 2025
Audit Team
Watermelon, Panda
Source
yAudit/vfat-AggregatorConnector-report

Audit Overview

Scope and Resources

github.com/vfat-io/sickle-contracts b43bd1735d

Scope

This audit covers a single smart contract totaling 83 lines of code across a day of review.

Overall Assessment

The audited contract was found to be secure from malicious actors' actions and from a potentially malicious arbitrary call to the utilized swap router. These claims stem from the auditors' understanding that only a Sickle owner is able to interact with their Sickle, which has been found to hold during previous security engagements.

Evaluation Matrix

access control

mathematics

complexity

libraries

decentralization

code stability

documentation

monitoring

testing

Key Findings

Findings Summary

0
Critical
0
High
0
Medium
0
Low
2
Informational
0
Gas
Ref Severity Title
I-1 Informational Unnecessary `payable` modifier in `swapExactTokensForTokens`
I-2 Informational Token verification asymmetry between methods
I-1 Finding

I-1: Unnecessary `payable` modifier in `swapExactTokensForTokens`

Informational

Description:

The swapExactTokensForTokens function in AggregatorConnector.sol line 33 includes a payable modifier but never sends ETH in its router call, unlike swapExactETHForTokens which explicitly uses { value: swap.amountIn }. Removing the payable modifier will prevent ETH from being sent by mistake.

Impact:

Informational.

Recommendation:

  • Consider whether the payable modifier is necessary for this function since it doesn't send ETH value in the router call.
  • If the payable is kept for interface reasons, check the sent ETH and revert if it's not zero.

Developer Response:

Fixed PR#587.

I-2 Finding

I-2: Token verification asymmetry between methods

Informational

Summary:

AggergatorConnector offers 2 methods to swap either tokens or ETH for other tokens: swapExactTokensForTokens and swapExactETHForTokens.

Description:

swapExactETHForTokens validates that swap.tokenOut does not match address(0), which is used to represent native ETH, ensuring that the swap's input and output tokens do not match.
swapExactTokensForTokens does not verify that swap.tokenIn != swap.tokenOut.

Impact:

Informational.

Recommendation:

Within swapExactTokensForTokens, consider verifying that swap.tokenIn != swap.tokenOut holds.

Developer Response:

Fixed PR#587.

Methodology

Severity Classification

Critical

Immediate threat to user funds or protocol integrity

Direct loss of funds, protocol compromise

High

Significant security risk requiring urgent attention

Potential fund loss, major functionality disruption

Medium

Important issue that should be addressed

Limited fund risk, functionality concerns

Low

Minor issue with minimal impact

Best practice violations, minor inefficiencies

Gas

Findings that improve gas efficiency

Increased transaction costs

Informational

Code quality and best practice recommendations

Reduced maintainability and readability