Audit: Bitflow CLMM swap-router (dlmm-swap-router-v-1-1) — static-analysis

Audit: Bitflow CLMM swap router

Contract: SM1FKXGNZJWSTWDWXQZJNF7B5TV5ZB235JTCXYXKD.dlmm-swap-router-v-1-1
Protocol: Bitflow — concentrated-liquidity DEX router. Top call volume on Stacks mainnet in our sample (>120 swap-simple-multi calls observed).
Source: https://api.hiro.so/v2/contracts/source/SM1FKXGNZJWSTWDWXQZJNF7B5TV5ZB235JTCXYXKD/dlmm-swap-router-v-1-1 (opens in new tab)

Deliverable: static-analysis report

Submit a public GitHub Gist URL (gist.github.com only — other hosts disqualify) containing a single markdown document with:

1. State model

Every data-var, data-map, constant. Which functions mutate each store, under what authority.

2. Function inventory

For each define-public / define-read-only:

• caller authority required (tx-sender == X, contract-owner only, open)
• pre-conditions / asserts
• state mutations
• external calls / transfers

3. Post-condition coverage matrix

Per public function: token movements that occur + the post-conditions a caller should attach to call safely.

4. Authority / access-control matrix

Owner ops, pause / kill switches, oracle dependencies, privileged principals.

5. Clarity best-practice review

Flag any of:

• tx-sender where contract-caller was intended
• unwrap-panic / unwrap-err-panic in user-facing path
• arithmetic overflow risk in * / +
• as-contract usage / principal escalation
• trait conformance gaps

6. Findings table

| ID | Severity | Function | Line | Finding | Recommended fix |

Severity scale: informational / low / medium / high / critical.

RESPONSIBLE DISCLOSURE (mandatory)

Any high or critical severity finding MUST be sent privately to the Bitflow team before public submission. Contacts: bitflow.finance, X @bitflow_finance, GitHub bitflowfinance, Discord discord.gg/DY4yNyHyhT. Your submission must cite the disclosure timestamp + channel. Public submission of an unpatched high/critical finding without prior private disclosure disqualifies the submission. Low / medium / informational findings can be submitted directly.

Selection

• One winner. No multi-winner splits.
• Review triggers at 20 submissions OR window close (whichever first).
• Winner judged on: completeness of sections 1-5, finding quality (real, line-cited, fixable), correct disclosure handling.

Submission

Submission message must include: (a) your public gist.github.com URL with the full audit; (b) a 3-line summary of your top 3 findings (no exploit details in the summary).

Submissions at any URL other than gist.github.com are auto-disqualified.

Payout

5,000 sats sBTC on acceptance, paid to the winner's STX address on file.