TL;DR verdict
Yes, Uniswap V2 is safe to use. It’s a constant-product AMM that has run without a major exploit since launching in 2020. The code is immutable and was reviewed and formally verified by dapp.org in early 2020. No incidents are recorded in DeFi Intel’s database. As of 2026-07-15, the protocol holds ~$0.78B in TVL across six chains, reflecting sustained trust.
- Zero known hacks or exploits in five years.
- Formally verified and audited by dapp.org; simple, battle-tested code.
- No admin keys or upgradability—contracts are fixed.
Audit history
Uniswap V2 has been audited by:
- dapp.org – a six-engineer team reviewed and formally verified the core contracts (UniswapV2Pair and UniswapV2Factory) from January to April 2020, using the act specification language and the K framework. The review found one medium- and one low-severity issue in core, plus one medium-severity issue in the router.
The review covered the constant-product pool, router contracts, and core libraries. No critical vulnerabilities were found. Since the protocol is immutable, no ongoing audit program applies, but the open-source code has been extensively reviewed by the community and forked thousands of times. (An earlier version of this page also credited Trail of Bits with a Uniswap V2 audit; that could not be verified against Uniswap's official audit resources and has been removed.)
Incidents and exploits
No major incidents are recorded in DeFi Intel’s database as of 2026-05-28. Uniswap V2 has not suffered a smart‑contract exploit, oracle manipulation leading to protocol‑level loss, or governance takeover. Users have occasionally lost funds due to phishing, fake token listings, or front‑running, but these are inherent to interacting with any permissionless DEX and do not constitute a protocol breach.
Smart contract risks
Uniswap V2’s contracts are immutable—they cannot be upgraded or patched. This removes admin‑key risk but means any future vulnerability would be permanent. The code is minimal and well‑understood, reducing bug surface. The main contract logic has been battle‑tested across billions of dollars in volume over five years.
No multisig or privileged role exists for routine operations; pair creation is permissionless. The AMM itself does not rely on oracles, but many integrators use its TWAP (time‑weighted average price) for pricing. TWAP manipulation is possible on low‑liquidity pairs, though costly for attackers. Users interfacing with oracle‑dependent apps should verify liquidity depth.
Operational and counterparty risks
Uniswap V2 is governed by the Uniswap DAO, but governance cannot alter the protocol’s immutable contracts. The original developer team (Uniswap Labs) is well‑known and has a strong reputation. Regulatory risk exists because DEXs face increasing scrutiny, but V2’s fully decentralized and non‑custodial nature insulates users from direct enforcement actions.
The protocol has no native insurance or safety module. Third‑party coverage is available through platforms like Nexus Mutual, though not mentioned in our data. Key dependencies are limited: the contracts live on EVM‑compatible chains and interact only with ERC‑20 tokens. No external bridges or keeper networks are required for swaps, reducing systemic risk.
How to use it more safely
- Verify token addresses before swapping—scam tokens with similar names are common.
- Use a hardware wallet to sign transactions, especially for large amounts.
- Set appropriate slippage (0.1–0.5% for liquid pairs; higher for volatile tokens) to avoid front‑running.
- Be mindful of impermanent loss if providing liquidity; understand that gains or losses can diverge from holding.
- Prefer aggregators like 1inch or Uniswap’s own interface, which route through multiple pools for best execution.
- Monitor governance proposals if you hold UNI, though governance cannot directly affect V2’s core logic.
Verdict
Uniswap V2 is one of the safest DEXs in DeFi. Its simplicity, immutability, and long clean track record place it well above average. While no code is risk‑free, the protocol’s design and lack of any exploit history justify a safety score of 8.5 out of 10. For swapping long‑tail or meme tokens, it remains a reliable first choice.
DeFi Intel publishes editorial research, not financial advice. Smart contract risk is never zero. Do your own research and consider position sizing accordingly.