Patch Review 2

This section documents notable changes applied to the in-scope code from commit to commit for our review on May 22nd to May 23rd, 2025.

Notable changes

The following notable changes were made to the codebase.

OdosWETHExecutor contract

The OdosWETHExecutor contract is used to handle WETH transfers. There has been no change to the contract.

OdosTransferHook contract

The OdosTransferHook contract has been added to the codebase. This contract is used to handle the transfer of tokens after a swap. While it has arbitrary token-transfer logic, all tokens are ultimately transferred to the destination address, so it is not possible to steal the tokens.

OdosRouterV3 contract

The swapMultiPermit2WithHook, swapMultiWithHook, and swapWithHook functions have been added to the OdosRouterV3 contract. These functions are similar to the existing swap functions but accept additional parameters: hookTarget and hookData. When the swap is executed and the tokens are transferred to the hookTarget contract, the OdosRouterV3 contract calls the executeOdosHook function to transfer its tokens to the address specified in hookData.

The referral fee now uses the splitBPS value instead of the fixed 80% fee. Additionally, positive slippage is now allowed when the 49th bit of the referralCode is set to 1.

+      uint256 splitBPS = (referralInfo.code >> 32) & 65535;
+      if (splitBPS == 0) splitBPS = 8000;
+      require(splitBPS <= 10000, "Invalid Ref Code");
+
       if (referralInfo.feeRecipient != address(this)) {
         _universalTransfer(
           tokenInfo.outputToken,
           referralInfo.feeRecipient,
-          amountOut * referralInfo.fee * 8 / (FEE_DENOM * 10)
+          amountOut * referralInfo.fee * splitBPS / (FEE_DENOM * 10000)
         );
       }
       amountOut = amountOut * (FEE_DENOM - referralInfo.fee) / FEE_DENOM;
     }
     int256 slippage = int256(amountOut) - int256(tokenInfo.outputQuote);
-    if (slippage > 0) {
+    if (slippage > 0 && (referralInfo.code >> 48) & 1 == 0) {
       amountOut = tokenInfo.outputQuote;
     }