AggHook on Ethereum

Uniswap v4 Hook Contract 0x001e24ac5b91d77982755c075f904bbe5d2be888 on Ethereum · Utility · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
29

What it does

A v4 hook that routes swaps for USDT/WBTC-style pairs across embedded Uniswap v4 and V3 pools to find the best effective price, taking a fee on swaps.

How it works step by step

  • Holds a hardcoded list of two v4 pools and two V3 pools for the same token pair
  • Ranks venues by fee-adjusted effective price at each swap
  • Executes the swap sequentially across the best venues using sqrt price limits
  • Donates the swap fee to the hook's v4 pool via donate()
  • Returns a BeforeSwapDelta so the pool manager accepts the hook-routed result
  • Restricts pool initialization and liquidity addition to a hardcoded admin address
Swap behaviour
On every beforeSwap, the hook computes effective prices across four configured venues, sorts them, executes the swap in sequence against v4 and V3 pools, settles via sync/settle/take, and returns a BeforeSwapDelta so the hook covers the swap.
Liquidity behaviour
beforeAddLiquidity reverts for everyone except the hardcoded admin (tx.origin); liquidity is therefore only addable by the admin EOA. No liquidity removal callbacks are used.
Fee behaviour
Swap fees are taken from the amount specified as a fixed bps-style fee packed in the swap data (FEE_SHIFT 14) and donated to the v4 pool via donate() to the hook's own pool key, not kept as protocol revenue; fees are not dynamic per block.
Owner & admin controls
ADMIN address 0xEC08EfF77496601BE56c11028A516366DbF03F13 is hardcoded and checked via tx.origin in beforeInitialize and beforeAddLiquidity; the admin cannot change parameters at runtime (routing data is immutable bytecode set at deployment via constructor offset). No pause, upgrade or owner transfer functions found.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeSwap, beforeSwapReturnDelta

beforeInitialize: restricted to admin, returns selector only. beforeAddLiquidity: restricted to admin, returns selector only. beforeSwap: routes the entire swap across embedded Uniswap v4 and V3/PancakeSwap V3 pools and returns a BeforeSwapDelta so the hook itself settles the swap, enabling return-delta control of the swap outcome.

Security & trust assessment

Risk level: medium (verified source, medium confidence).

Who controls it: The hardcoded admin EOA can add liquidity and initialize pools with this hook; the ADMIN check uses tx.origin, so any contract wallet or phishing contract that makes the admin sign a transaction could be exploited. Admin cannot alter routing parameters post-deployment.

Risk to user funds: The hook receives the pool manager's swap callbacks and can move tokens through external pools during swaps, so user swap funds pass through its routing logic; the hook holds no custody beyond transient settlement and donated fees. Admin cannot withdraw funds directly.

Security findings

  • [medium] Hook takes control of swap settlement via return delta: beforeSwap returns a BeforeSwapDelta that routes swaps through external pools and takes/settles tokens, so the hook actively moves funds during swaps.
  • [medium] tx.origin-based admin authorization: Admin check uses origin() instead of a msg.sender-based check, so a malicious contract called by the admin EOA could pass the check.
  • [medium] V3 swap callbacks lack caller validation: Routing relies on external V3 and V4 pool addresses and on hardcoded token addresses; swap execution trusts the embedded pool addresses and receives callbacks from them (uniswapV3SwapCallback / pancakeV3SwapCallback) which only call take() without validating caller pool identity.
  • [low] Routing price limits derived from live pool state: Swap routing sets price limits from effective prices computed from pool state at call time, which could be manipulated within a transaction and expose swaps to sandwich attacks; no slippage protection beyond the caller's sqrtPriceLimit.
  • [info] Immutable routing configuration: The routing table, pool addresses and fees are fixed in immutable bytecode, so the hook cannot be reconfigured to add or remove venues.

Contract details

Verified source
Yes (AggHook)
Compiler
solc 0.8.31+commit.fd3a2265
Bytecode size
5,446 bytes
Upgradeable proxy
No
Detected patterns
return-delta

Pools using AggHook