AtlasHook on Ethereum

Uniswap v4 Hook Contract 0x0064d33f01a6651defd9f8d5bef191610fdda888 on Ethereum · Utility · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
2
Swaps (24h)
0 (0 traders)
Total swaps
10

What it does

A custom swap router hook that executes swaps across fixed Uniswap V4 and V3 pools for the WETH/USDC pair and takes a small service fee, restricted in who can initialize pools and add liquidity.

How it works step by step

  • Quotes and sorts routes across hardcoded Uniswap V4 pools and V3-style pools for WETH/USDC using effective prices with fee adjustments
  • Takes a service fee of 1/16384 of the amount and donates it to the pool through PoolManager.donate
  • Executes exact-in or exact-out swaps across up to four routes, settling and taking tokens via PoolManager
  • Handles Uniswap V3 and PancakeSwap V3 swap callbacks by taking tokens from the PoolManager and paying the pool, wrapping ETH to WETH when needed
  • Restricts beforeInitialize and beforeAddLiquidity to the hardcoded ADMIN tx.origin
Swap behaviour
beforeSwap runs custom routing: it reads prices from the hardcoded pools, sorts routes by effective price, donates a service fee to the pool and executes swaps across V4 and V3 pools, settling the net deltas. The hook returns a before-swap delta, so it determines the swap outcome rather than the pool curve.
Liquidity behaviour
beforeAddLiquidity only allows liquidity additions from the hardcoded ADMIN tx.origin; removals are not gated by the hook. The test router seeds a full-range position through this path.
Fee behaviour
Does not set a dynamic LP fee; the pool uses its static fee. The hook takes a service fee of 1/16384 (shr(14, amount)) on swaps and donates it to the pool via PoolManager.donate, and beforeSwap returns no fee override.
Owner & admin controls
beforeInitialize and beforeAddLiquidity revert with Unauthorized unless tx.origin equals the hardcoded ADMIN address 0xEC08EfF77496601BE56c11028A516366DbF03F13, so only that EOA can initialize pools or add liquidity through this hook. There is no owner, pause, upgrade proxy or parameter setter in the source; the routing data (pool addresses, fees, V3 pools) is fixed in the immutable DATA blob.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeSwap, beforeSwapReturnDelta

beforeInitialize: restricts pool initialization to ADMIN. beforeAddLiquidity: restricts liquidity additions to ADMIN. beforeSwap: executes a custom routing swap across hardcoded Uniswap V4 and V3-style pools and returns a before-swap delta, so the hook itself settles the swap instead of the pool's AMM.

Security & trust assessment

Risk level: high (verified source, medium confidence).

Who controls it: The ADMIN EOA controls pool initialization and liquidity provision for this hook. Because the hook logic is immutable, the admin cannot change routing parameters, but the admin's key compromise would let an attacker initialize malicious pools or add liquidity using ADMIN as tx.origin.

Risk to user funds: The hook holds and moves funds during swaps: it takes tokens from the PoolManager, wraps ETH, pays via V3 callbacks and donates a service fee to the pool. Users swapping through the hook trust its routing; the ADMIN can add liquidity and initialize pools.

Security findings

  • [high] Hook controls swap amounts through return delta: beforeSwap returns BeforeSwapDelta via return-delta permission and performs its own routing and settlement, so the hook (not the pool's curve) determines amounts. Payouts depend on hardcoded pool addresses in the immutable DATA blob.
  • [medium] tx.origin based authorization: Access control uses tx.origin rather than msg.sender, so any contract that tricks ADMIN into a transaction could pass the check.
  • [medium] Hook is in the fund path for swaps: Swaps route through the hook's custom logic with fixed pool addresses; the swap callback handlers and WETH wrap/unwrap paths transfer tokens to the hook's routing destinations, so the hook is in the fund flow.
  • [info] Development artifacts in deployed source: Source contains a Test-inherited Main contract, hardcoded ADMIN address and console logs in the router; these are development artifacts and the contract is not a neutral general-purpose hook.

Contract details

Verified source
Yes (AtlasHook)
Compiler
solc 0.8.31+commit.fd3a2265
Bytecode size
6,517 bytes
Upgradeable proxy
No
Detected patterns
return-delta

Pools using AtlasHook