TurbineHook on Ethereum

Uniswap v4 Hook Contract 0x0244b2a4aeffee4f6628d1a2ac64578e274c6088 on Ethereum · Custom pricing · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
3
Swaps (24h)
0 (0 traders)
Total swaps
445

What it does

Turbine hook that lets a designated router execute swaps and liquidity operations against per-pool reserves tracked by the hook, issuing an ERC20 LP token per pool.

How it works step by step

  • Registers a pool on initialization after checking for a dynamic-fee sentinel and canonical tick spacing of 1.
  • Deploys a new LPToken contract per pool named Turbine LP Token SYM0-SYM1.
  • Restricts swaps and liquidity mint/burn to the single router address set at construction.
  • On swap, mints input and burns output claims on the pool manager and overrides settlement via a before-swap delta.
  • Tracks per-pool reserves in hook storage rather than relying on pool manager balances.
  • Locks 1e17 LP units on first mint to mitigate inflation attacks.
Swap behaviour
On each swap the router-only beforeSwap callback decodes an expected amountOut from hookData, mints the input currency and burns the output currency on the pool manager, updates the hook's reserves and returns a before-swap delta so that the router-determined amounts settle the trade.
Liquidity behaviour
No liquidity callbacks. Liquidity is managed through the router calling mint and burn on the hook, which issue and burn an ERC20 LP token per pool and track reserves in hook storage; MINIMUM_LIQUIDITY of 1e17 is permanently locked on first mint.
Fee behaviour
Uses a static pool fee (dynamic-fee sentinel rejected). The hook does not take or redirect fees; hook delta is computed from amountIn and amountOut supplied via hookData.
Owner & admin controls
No privileged admin role or owner found; the router address is fixed as an immutable set at construction and the router is set as a pool manager operator. No pausing, upgrade or parameter-change functions are present.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeSwap, beforeSwapReturnDelta

beforeInitialize: validates tick spacing, registers the pool, deploys an LP token and records it. beforeSwap: restricted to the router, mints input and burns output claims on the pool manager and returns a before-swap delta that replaces the AMM swap with the router-supplied amounts. beforeSwapReturnDelta: enables that delta to adjust the swap settlement.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: No owner key exists. The router is the sole trusted party: it alone can trigger swaps and liquidity operations, and it is granted operator rights over the hook's pool manager balances. If the router is compromised or buggy it could mint or burn hook-held claims arbitrarily.

Risk to user funds: The hook holds reserves as ERC6909 claims on the pool manager and mints or burns them during swaps and liquidity operations. User funds are exposed to the router's correctness and to the amountOut supplied via hookData, since the hook does not independently verify swap pricing. The hook has no pause or withdrawal path to block users.

Security findings

  • [high] Swap output determined by caller-supplied hookData: beforeSwap trusts the amountOut value decoded from hookData with no on-chain check against the pricing model; correctness of swap output depends entirely on the router supplying a valid amount.
  • [medium] Router has broad operator rights and cannot be changed: The hook calls setOperator on the pool manager for the router, granting it broad rights over the hook's ERC6909 balances, and the router is fixed at construction with no way to rotate it.
  • [low] Reserve accounting relies on router-consistent amounts: Reserves are stored as hook-side accounting and updated with unchecked arithmetic in burn and beforeSwap (reserve subtraction), so a router-supplied amountOut larger than reserves would underflow and revert rather than drain funds, but reliance on the router for correct amounts remains.
  • [info] Pool registration is restricted: Pool registration keys on (token0, token1, fee) and beforeInitialize enforces canonical tick spacing, reducing slot squatting; the pool's fee cannot be changed after registration.

Contract details

Verified source
Yes (TurbineHook)
Compiler
solc 0.8.31+commit.fd3a2265
Bytecode size
16,991 bytes
Upgradeable proxy
No
Detected patterns
erc20, return-delta

Pools using TurbineHook