SCA- V3 Limit Order Reactor- PR10

Introduction#

SaucerSwap Labs engaged Halborn to perform a smart contract security assessment of the V3 Limit Order Reactor from October 15th, 2026 to October 15th, 2026. The review focused on the commit that makes SIG_MODE_DELEGATED (0x02) vault authorization fail-closed and also reports issues observed in surrounding unchanged code. The Scope section lists the reviewed files, commits, exclusions, and assessment limits.

The V3 Limit Order Reactor is a UniswapX-derived settlement contract deployed on Hedera by SaucerSwap Labs. It processes partial-fill limit orders signed by swappers and executed by fillers through Permit2 allowances. The commit under review introduces fail-closed authorization for the delegated signature mode: IDelegatorVault.authorizeOrder now returns a bytes4 magic value, PartialFillLimitOrderReactor::_authorizeDelegated checks both contract existence and that return value before spending any allowance, and Vault.authorizeOrder returns the selector. The surrounding code reviewed includes the Vault and VaultManager contracts, the V3-style oracle integration for price bounds, and the broader partial-fill reactor settlement path.

Assessment Summary#

Halborn was allocated 1 business day for this engagement and assigned 1 full-time security engineer to conduct a comprehensive review of the source code within scope. The engineer is an expert in blockchain and smart contract security, with advanced skills in penetration testing and smart contract exploitation, as well as extensive knowledge of multiple blockchain protocols. The objectives of this assessment were to:

• Verify that the SIG_MODE_DELEGATED fail-closed check correctly gates vault authorization and cannot be bypassed by a non-vault contract.

• Identify security issues in the delegated authorization path, the Vault, VaultManager, and surrounding reactor code.

• Assess the correctness of the bytecode deployed on Hedera mainnet against the audited source.

• Review Permit2 allowance exposure for the deployed reactor.

In summary, Halborn identified several areas for improvement to reduce the likelihood and impact of security risks, which were partially addressed by the SaucerSwap Labs team. The primary recommendations were:

• Bind delegated authorization to a trusted vault registry so that only VaultManager-created clones can authorize 0x02 orders, eliminating the echo-fallback bypass regardless of the accepted return value.

• Deprecate the mainnet reactor and migrate allowances to a corrected deployment, given that the deployed bytecode matches the pre-commit revision and retains the original fail-open behavior.

• Authenticate the vault oracle pool in VaultManager.createVault against the SaucerSwap V2 factory and require enough observation history for the TWAP window, so that the vault creator cannot choose the price source.

• Correct revert classification and NatSpec so that vault policy failures surface to callers with accurate selectors and the IDelegatorVault documentation reflects the actual consent property.

• Deploy the fixed reactor, the new Vault implementation and a new VaultManager together, and do not point a manager built with the earlier Vault implementation at the fixed reactor, because its vaults cannot return the required authorization value.

Test Approach and Methodology#

Halborn used manual line-by-line review of the commit diff and its callers, automated static analysis with Slither, Aderyn, and Semgrep, Foundry test execution including attack reproductions, runtime bytecode comparison against the deployed Hedera mainnet reactor, and a Permit2 event scan. Manual review examined the SIG_MODE_DELEGATED authorization path introduced by the commit, the IDelegatorVault interface and its interaction with PartialFillLimitOrderReactor, the Vault and VaultManager contracts, the V3 Dutch and partial-fill reactor paths, revert classification logic, NatSpec accuracy, and the Hedera-specific deployment context. The assessment included:

• Manual line-by-line review of the commit diff, its callers, and the surrounding unchanged authorization and settlement code.

• Foundry test execution, including a baseline run of 674 passing tests and targeted reproductions of the echo-fallback drain, ERC-1271 parity, and skip classification issues.

• Static analysis with Slither, Aderyn, and Semgrep, with all results triaged against the codebase.

• Runtime bytecode comparison of the deployed Hedera mainnet reactor (account 0.0.10815913) against both the pre-commit and post-commit builds via the public mirror node.

• Permit2 event scan for allowances to the deployed reactor address.

Material limits: Findings outside the commit diff did not receive the same depth of review as in-scope changes; the testnet reactor was not measured.

Risk Methodology#

Scope#