BMX

What it is

BMX is a perpetuals and spot exchange on Base and Mode, and Deli Swap is its Uniswap v4 hook: concentrated liquidity ranges, a fee processor, and a voter that directs emissions to the pools that earn them.

What was reviewed

A competition on the Deli Swap hook in September 2025, first place, and a private review with Sherlock in November 2025 over the same protocol.

What was found

10 findings from the competition, 5 of them high severity.

Featured finding

BMX pays liquidity providers through a hook that keeps its own record of which price ranges are currently earning, and that record has to follow the pool as its price crosses out of one range and into the next. A swap landing exactly on a boundary counts as a crossing in the pool but stopped one step short in the hook, so the hook went on paying a range the pool had already left. Anyone could steer a swap onto a boundary deliberately and then supply liquidity to the range everyone else reads as out of range, collecting the fees with nobody to share them with.

As designedA swap moves the price across a range boundary↓The pool crosses the boundary and the hook’s record follows it↓Fees go to the positions that are actually in range

The path the bug allowedA swap is steered to land exactly on a boundary↓The pool counts that as a crossing, but the hook stops one step short↓The hook goes on paying a range the pool has already left↓Liquidity supplied to that range, out of range to everyone else, collects the fees alone

See the whole finding

Engagement history