[Security Audit] Arc Swap API — 6 Findings (1 Critical, 2 High, 3 Medium)

[empek654]

🔴 ARC-01: No Authentication on Swap Execute (Critical)

File: routes/swap.ts — POST /swap/execute (Line 368)
CVSS 4.0: 9.1
Impact: Anyone can trigger swaps using backend's hot wallet

The endpoint has zero authentication. The requireApiKey middleware exists in the codebase and is used on /fees, but is not applied to /swap/execute or /swap/record.

Live test: Calling POST /api/swap/execute with arbitrary userAddress returns "Insufficient token allowance" — not a 401/403 auth error.

Fix: Add requireApiKey middleware to swap routes.

---

🟠 ARC-02: Backend Wallet as OTC Counterparty (High)

Impact: Backend must always hold both token balances

Swaps don't use the Uniswap V2 AMM. The backend:

1. transferFrom pulls tokens FROM user → backend wallet
2. Calculates output using real market rates (CoinGecko/Frankfurter)
3. transfer sends output FROM backend wallet → user

Fix: Route through the Uniswap V2 Router for AMM swaps.

---

🟠 ARC-03: No User Verification on Swap Execute (High)

Impact: Attacker can trigger swap on behalf of another user

/swap/execute accepts userAddress in request body but never verifies caller controls that address. If user A approved the backend wallet, anyone can call swap with A's address.

Fix: Add EIP-712 signature verification for userAddress.

---

🟡 ARC-04: Swap History Public (Medium)

Impact: All user swap data exposed (addresses, amounts, tx hashes)

Fix: Add auth to history endpoint.

---

🟡 ARC-05: Floating Point Precision in Fee Calculation (Medium)

ts
const amountUnits = Math.round(parseFloat(amountIn) * PRECISION);

JS IEEE 754 precision can produce off-by-one fee errors.

Fix: Use BigInt-based integer arithmetic.

---

🟡 ARC-06: Swap Record Unauthenticated (Medium)

Live test: POST /api/swap/record returns "Invalid transaction hash format" — reachable without auth.

Fix: Add requireApiKey + on-chain tx hash validation.

---

Target: osr21/arc-swap — Full-stack Token Swap DApp on Arc Testnet
Live App: arc-swap-dapp.replit.app
Auditor: empek654 (sawonggaleng185@gmail.com)
Methodology: Manual code review + live endpoint testing
Status: All 6 findings confirmed (source code + live API)