Security & Audits
Pivot alert: Wido has become Walnut. This docs as well as the Wido Zap API will be discontinued. Read full announcement.
Protecting user funds is a top priority, and Wido takes several steps to ensure users' funds are safe.
Wido Token Manager is an important component used to protect user funds from malicious steps.
As mentioned in the Technology > Overview page, Wido Router is a smart contract that enables swaps between any token, liquid or non-liquid, such as farms, vaults or pools. If ERC20 allowances were made directly to Wido Router contract, a malicious actor could send a transaction containing malicious steps and manage to drain user funds. This is because Wido is permissionless and there is no allow list behind steps.
However, since these allowances are made to the Wido Token Manager contract and steps are strictly forbidden to make calls to Wido Token Manager, malicious steps do not have direct access to user funds.
Wido Router calls Wido Token Manager to pull funds, at the beginning of a swap, if the sender of the transaction is the owner of the funds and if the order parameters are valid.
For each route, Wido Route Finder calculates the minimum tokens the user will receive, given the slippage tolerance of the user. Wido Router smart contract respects the minimum tokens the user should receive. The transaction is reverted if it cannot guarantee the minimum number of tokens. This protects user transactions from MEV attacks.
Wido Router contracts only interact with approved contracts. Once a Step is added to Wido, we run a few checks before approving it.
- 1.Automated tests are run to ensure the new Step performs the desired Token A to Token B swap.
- 2.The Step is compared with other Steps providing Token A to Token B swap to ensure that it can offer competitive rates.
- 3.Solidity engineers review the contract and the Step to ensure it is not malicious.
Once the above checks pass, the Step is approved and added to the Steps database.
Last modified 1mo ago