Audits & Security
Upstream audit references and the limits of their coverage for Watergun deployments and interfaces.
Watergun uses code derived from established protocols. An upstream audit is not an audit of a Watergun deployment, configuration, integration, or front-end. Review the deployed contracts and any project-specific reports before relying on an audit claim.
DEX (V2 & V3) — PancakeSwap Fork
The Watergun V2 and V3 DEX code is derived from PancakeSwap, which builds on Uniswap V2 / V3 designs. The PulseChain DEX remains with 9mm Pro and is outside Watergun's DEX coverage here.
Audit history for the upstream code is publicly available:
- PancakeSwap audits — docs.pancakeswap.finance/contact-us/audits
- Uniswap V2 audit (dApp.org / Consensys / Trail of Bits) — uniswap.org/audit.html
- Uniswap V3 audit (Trail of Bits / ABDK) — github.com/Uniswap/v3-core/tree/main/audits
Watergun Swap — 0x / Matcha Fork
The Watergun Swap DEX Aggregator is a fork of the 0x Protocol (the same routing engine that powers Matcha). 0x has been audited multiple times by leading firms including Trail of Bits, ConsenSys Diligence, and ABDK.
- 0x Protocol audits — 0x.org/docs/developer-resources/audits
Why Forks?
Forking can reuse reviewed code, but differences in compiler settings, deployment roles, configuration, integration, and later changes can introduce new risks. Do not treat upstream audit reports as a security guarantee for Watergun.
Watergun's contributions sit on top of this foundation: deployment configuration, routing, and per-chain integrations described in the DEX and Developer Integration sections. The former 9MM Pro-era holder revenue-sharing program is sunset.
Front-Ends
Upstream contract audits do not automatically cover Watergun smart contracts or front-ends. Public repositories are listed under the 9mm-exchange GitHub org, whose name predates the Watergun rebrand. Repository availability is not proof that a particular release has been independently audited.
If you interact with contracts directly, verify each Watergun DEX address against Deployments and the relevant chain explorer. For the 9mm Pro PulseChain DEX or $9MM token, start at 9mm.pro.
If you're a security researcher and find an issue in our deployment, please reach out via Telegram or DM @watergundotpro on X.