CoW Flash Loan Router is an extension of the CoW Protocol that enables trade solvers to execute multiple flash loans prior to trade settlements. The system integrates with various loan providers through dedicated adapter contracts, allowing for sequential flash loan executions during the settlement process.<\/p>\n
CoW engaged Ackee Blockchain Security to perform a security review of the CoW protocol with a total time donation of 5 engineering days in a period between March 17 and March 21, 2025. 1 additional engineering day was allocated to ensure high confidence, particularly regarding the integration of the audited code with the CoW Protocol Core.<\/p>\n
CoW then engaged Ackee Blockchain Security to perform a review of fixes of the findings from the previous revision. No new findings were discovered.<\/p>\n
We began our audit with a thorough analysis of the contract logic, identifying potential attack vectors and trust model implications. We then employed static analysis tools, including Wake<\/a>, to verify the absence of common issues.<\/p>\n During the review, we focused on ensuring:<\/p>\n The audit was performed on the commit The scope included all Solidity files in the src directory, excluding the The fix review was done on the given commit The classification of a security finding is determined by two ratings: <\/span>impact<\/b> and <\/span>likelihood<\/b>. This two-dimensional classification helps clarify the severity of individual issues. Issues which would be rated as <\/span>medium<\/span><\/i> severity, but which would be likely discovered only by the team, are typically decreased by the likelihood factor to the W<\/em><\/span>arning<\/span><\/i> or I<\/em><\/span>nformational<\/span><\/i> severity ratings.<\/span><\/p>\n Our review resulted in 4 findings, ranging from Info to Warning severity.<\/p>\n The code demonstrated exceptional quality<\/strong>, with findings primarily related to code and gas optimization improvements. The codebase features comprehensive documentation, including clear explanations of caveats and code correctness reasoning. The system trust model, expected usage, and security assumptions are thoroughly documented.<\/p>\n 3 out of 4 findings were confirmed fixed in the fix review, and I2 was acknowledged to benefit from flash loan fee waiving. No new findings were discovered.<\/p>\n No critical severity issues were found.<\/p>\n No critical severity issues were found.<\/p>\n No critical severity issues were found.<\/p>\n No low severity issues were found.<\/p>\n W1: Missing events<\/p>\n I1: Documentation errors<\/p>\n I2: Aave flash loan call optimization<\/p>\n I3: Missing view in interfaces<\/p>\n Tokens interacted with, flash loan adapters, and flash loan providers are trusted not to disrupt the transaction execution, causing the transaction to revert. These entities are also trusted not to abuse the front-running opportunity to worsen the market conditions up to the slippage tolerance set in the trades to be settled.<\/p>\n Ackee Blockchain Security<\/a>\u2019s full CoW audit report can be found here<\/a><\/b>.<\/b><\/p>\n We were very delighted to audit CoW and look forward to working with them again.<\/p>\n","protected":false},"excerpt":{"rendered":" CoW Flash Loan Router is an extension of the CoW Protocol that enables trade solvers to execute multiple flash loans prior to trade settlements. The system integrates with various loan providers through dedicated adapter contracts, allowing for sequential flash loan executions during the settlement process. CoW engaged Ackee Blockchain Security to perform a security review of the CoW protocol with a total…<\/p>\n","protected":false},"author":30,"featured_media":1074,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,10,80,103],"tags":[21,109,24,33],"class_list":["post-1066","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audits","category-ethereum","category-solidity","category-wake","tag-audit","tag-cow-protocol","tag-ethereum","tag-evm"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2025\/07\/cow-blog-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2025\/07\/cow-blog-600x600.png","author_info":{"display_name":"Tom\u00e1\u0161 Kova\u0159\u00edk","author_link":"https:\/\/ackee.xyz\/blog\/author\/tomas-kovarik\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/1066","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=1066"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/1066\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/1074"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=1066"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=1066"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=1066"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
SCOPE<\/span><\/h2>\n
930914f<\/code>.<\/p>\nsrc\/vendored<\/code> directory. The vendored files were reviewed only in terms of their usage in the codebase, with their implementation being out of scope.<\/p>\nf9c1867<\/code>. 3 out of 4 findings were fixed, and I2 was acknowledged to benefit from flash loan fee waiving. No new findings were discovered.<\/p>\nFINDINGS<\/span><\/h2>\n
Critical severity<\/span><\/h3>\n
High severity<\/span><\/h3>\n
Medium severity<\/span><\/h3>\n
Low severity<\/span><\/h3>\n
Warning severity<\/span><\/h3>\n
Informational severity<\/span><\/h3>\n
TRUST MODEL<\/span><\/h2>\n
CONCLUSION<\/span><\/h2>\n