HIGH H-01: Unlimited Fee Rates

Location: set-fee-rate-x, set-fee-rate-y

The pool owner or contract owner can set fee rates to any uint value with no upper bound. A fee rate ≥ 100% causes the entire user input to be consumed as fees, yielding zero output.

(define-public (set-fee-rate-x (token-x principal) (token-y principal) (factor uint) (fee-rate-x uint))
    (let ((pool (try! (get-pool-details token-x token-y factor))))
        (asserts! (or (is-eq tx-sender (get pool-owner pool)) (is-ok (check-is-owner))) ERR-NOT-AUTHORIZED)
        ;; NO UPPER BOUND CHECK
        (map-set pools-data-map { ... } (merge pool { fee-rate-x: fee-rate-x }))
        (ok true)))

Impact: Effective rug pull — users lose 100% of input. Pool owner can front-run to set fees to max, steal swap inputs, then reset.

Recommendation: Add (asserts! (<= fee-rate-x u10000000) ERR-FEE-TOO-HIGH) (cap at 10%).

HIGH H-02: as-contract Without Asset Restrictions

Location: add-to-position, reduce-position, swap-x-for-y, swap-y-for-x

Uses pre-Clarity 4 as-contract which grants blanket asset authority to the contract principal for the enclosed expression. Clarity 4's as-contract? with with-ft/with-stx can restrict exactly which assets and amounts are authorized.

(as-contract (try! (contract-call? .alex-vault-v1-1 transfer-ft token-y-trait dy sender)))
(as-contract (try! (contract-call? .token-amm-swap-pool-v1-1 mint-fixed ... sender)))

Impact: Broader attack surface if vault or LP token contracts have vulnerabilities.

Recommendation: Migrate to Clarity 4; use as-contract? with explicit with-ft allowances.

MEDIUM M-01: Zero-Output Swaps

Location: swap-x-for-y, swap-y-for-x

Small inputs can result in dy = 0 after fees. The guard (and (> dy u0) ...) silently skips the output transfer — user pays input + gas, receives nothing.

(and (> dy u0) (as-contract (try! (contract-call? .alex-vault-v1-1 transfer-ft token-y-trait dy sender))))

Recommendation: Add (asserts! (> dy u0) ERR-INVALID-LIQUIDITY) before the conditional transfer.

MEDIUM M-02: Fee Accounting Vault Dependency

Location: swap-x-for-y, swap-y-for-x

Non-rebated fees are sent to the vault reserve via add-to-reserve, but the pool's tracked balance-x only includes dx-net-fees + fee-rebate. This creates an implicit dependency on the vault correctly segregating reserve from pool balances.

Impact: If vault accounting is compromised, pool balances become unreliable.

MEDIUM M-03: Pool Owner Can Freeze Trading

Location: set-start-block, set-end-block

Pool owner can set start-block > end-block, causing check-pool-status to always fail. Swaps are blocked; withdrawals still work (reduce-position doesn't check pool status).

Recommendation: Validate start-block <= end-block in both setters.

MEDIUM M-04: Permissionless Pool Creation

Location: create-pool

Anyone can create pools with any SIP-010 pair. Pools are created with max-in-ratio: u0 and max-out-ratio: u0, making the pool non-functional until configured. Malicious token contracts can be paired.

Recommendation: Restrict pool creation to contract owner or require valid initial parameters.

LOW L-01: No Minimum Liquidity Lock

First LP deposit has no minimum locked liquidity, unlike Uniswap V2. Mitigated by requirement that both dx > 0 and dy > 0.

LOW L-02: Saturating Subtraction in reduce-position

Uses (if (<= balance-x dx) u0 (- balance-x dx)) pattern. Rounding could cause computed withdrawal to exceed tracked balance, leaving phantom dust in vault.

LOW L-03: Oracle Price Manipulation

Oracle EMA updated on every swap. If oracle-average is set low, the resilient price tracks spot price closely and can be manipulated in a single block.

INFO I-01: unwrap-panic Usage

reduce-position uses unwrap-panic for LP token balance query. If the LP contract is unreachable, the tx panics with no useful error.

INFO I-02: Multi-Hop Slippage Gap

swap-helper-a/b/c pass none for intermediate slippage. Only the final leg has user-specified min output. Intermediate legs are sandwich-able.

INFO I-03: No Admin Events

Parameter changes (fee rates, ownership, oracle settings) don't emit print events, hindering off-chain monitoring.

INFO I-04: Pre-Clarity 4

Recommend migration to Clarity 4 for as-contract? with explicit asset allowances.