MorphepeHook on Ethereum

Uniswap v4 Hook Contract 0x0a31d7fa30208d4d69672c6a549ce9a2ab8f60c4 on Ethereum · Dynamic fee · Verified contract

Volume (24h)
$398
Value locked (TVL)
$0
All-time volume
$398
Pools using this hook
1
Swaps (24h)
6 (5 traders)
Total swaps
6

What it does

MorphepeHook charges a dynamic swap fee of 0.30% to 3.00% set by an external program, where the LP share goes to liquidity providers and the burn and bounty shares are taken by the hook, which burns MORPHEPE and funds the registry's reviewer bounties.

How it works step by step

  • Charges a dynamic per-swap fee; the LP share is returned to the pool as an overridden LP fee, while the burn and bounty shares are taken by the hook from the unspecified currency via afterSwap return delta.
  • Burn share of the hook fee: when the fee is taken in MORPHEPE tokens they are burned immediately; when taken in ETH the ETH is kept by the hook for later buybacks.
  • Bounty share is sent to the registry (ETH or MORPHEPE), which pays reviewers.
  • Fee parameters are supplied by an active external program via a staticcall with a 100,000 gas cap; invalid or failing answers fall back to base parameters.
  • Swarm-controlled parameter pulses (setParams) are queued with a 5-minute notice, limited to one per 30 minutes, and bounded by hard limits: fee 0.30% to 3.00%, burn up to 60%, LP 20-80%, bounty 10-30%.
  • buybackAndBurn lets the swarm spend accumulated ETH to buy MORPHEPE through the pool and burn the proceeds and any tokens held by the hook.
Swap behaviour
Every swap runs beforeSwap, which sets a dynamic fee: the LP portion is returned as an overridden LP fee and the remainder is stored transiently. afterSwap then takes the hook fee from the unspecified currency and splits it between burn and bounty. Swaps by the hook itself (buybacks) pay only the LP fee. Trades with a higher fee from the active program pay more; the program's SwapContext includes direction, size, swaps this block, tick move and reversal flags, so the exact fee per trade depends on the external program.
Liquidity behaviour
No liquidity callbacks.
Fee behaviour
Dynamic: the total fee comes from the active program (bounded 0.30% to 3.00%); the LP share of it is applied as the pool LP fee and the remaining share is taken by the hook as burn and bounty. Burn and bounty percentages are set by the swarm within bounds and change at most by 10 and 5 points per pulse.
Owner & admin controls
No owner or upgrade mechanism is present. The swarm address, read from the registry, can queue parameter changes (setParams, bounded and rate limited) and trigger buybackAndBurn. The registry determines the swarm and the active program, so control over those contracts controls the hook's behaviour. The token has no owner and no mint.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeSwap, afterSwap, afterSwapReturnDelta

beforeInitialize restricts pool creation to the designated initializer, one ETH/MORPHEPE dynamic-fee pool. beforeSwap computes and overrides the LP fee and records the hook fee. afterSwap takes the hook fee via poolManager.take and performs burns, bounty transfers and ETH transfers, using afterSwapReturnDelta.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: A privileged swarm key (or a registry that can change the swarm) could queue parameter changes within bounds, pick when buybacks happen, and with a malicious program could set fees up to 3% for every trade. No key can directly drain user funds or change the pool key.

Risk to user funds: The hook holds ETH from burn shares and can hold MORPHEPE tokens before burning. Buyback swaps use only ETH the hook already holds and are capped by minOut slippage. The hook cannot block swaps unless the revert paths trigger; fee inputs fall back to base parameters on program failure, so swaps remain possible.

Security findings

  • [info] Hook takes fees via return delta: afterSwapReturnDelta is enabled and afterSwap calls poolManager.take to withdraw a fee of up to 3% of the unspecified-currency amount, so users pay this as an additional swap cost.
  • [medium] Fee program is externally controlled: The fee is computed by registry.activeProgram() through an external staticcall. Although outputs are clamped by MorphepeBounds, a malicious or replaced program can set any allowed value up to 3.00% and decide the per-swap fee for every trade.
  • [medium] Registry-controlled swarm and program: The onlySwarm modifier and the program address both come from the registry contract, which is not included in the provided source; a compromised or upgradeable registry would control parameter changes and buybacks.
  • [low] Buybacks and parameter changes gated by swarm: buybackAndBurn spends hook ETH on pool swaps with a caller-supplied minOut; the swarm chooses the timing and amount, which could be used to move price or burn ETH at unfavourable times.

Contract details

Verified source
Yes (MorphepeHook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
13,618 bytes
Upgradeable proxy
No
Detected patterns
return-delta, self-unlock

Pools using MorphepeHook