F-2025-0007·spec-deviation

Incorrect SRC20 standard implementation

TL;DR

LP tokens minted by the AMM do not follow the Fuel SRC20 standard. The contract does not populate `symbol`, `name`, and `decimals` storage on token creation, breaking third-party integrations.

Severity
LOW
Impact
LOW
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
LOW
02Section · Description

Description

The SRC20 token implementation in the contract for the LP tokens is not following the official Fuel SRC20 standard document.

The Mira AMM creates a new AssetId for each LP position that it creates in the mint_liquidity(...) method. Each token created in this way needs to have a Symbol, Name and Decimal values assigned and those values must be returned by specific methods.

The contract does not fill the symbol, name, decimals storage variables when a new LP token is created. This does not entail any security vulnerability, but as per the standard of SRC20:

code
fn name(asset: AssetId) -> Option<String>

This function MUST return the name of the asset, such as "Ether". This function MUST return Some for any assets minted by the contract.

In the case of the name(...) method the implementation would call the default std-lib function _name(...) which will return None.

The current behaviour might become problematic when the tokens are integrated in some third-party protocol; not following the standard might require non-standard handling on their side, so there is a risk of becoming difficult to integrate with.

03Section · Impact

Impact

LP tokens emitted by the AMM do not surface metadata as required by SRC20. Third-party indexers, wallets, and integrating protocols may need custom handling, increasing integration friction and the chance of mis-display.

04Section · Recommendation

Recommendation

Assign correct values to symbol, name, decimals storage variables and implement specified event generation when those values change. The full specification is available at: https://docs.fuel.network/docs/sway-standards/src-20-native-asset/

05Section · Resolution

Resolution

Fixed in commit 584e378537207d8120da39e746e1da0293da5528.

Status
Fixed
Fix commit
584e37853720
F-2025-0007

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx