PunkHook on Ethereum

Uniswap v4 Hook Contract 0x0d978cbf28490d46e36a5fd38c4fd4aa31180440 on Ethereum · Utility · Verified contract

Volume (24h)
$0
Value locked (TVL)
$5.95K
All-time volume
$969.56K
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
6,663

What it does

A Uniswap v4 hook that starts a configured token when its first liquidity pool is added and refreshes an on-chain random seed used for generated SVG punk art on swaps involving that token.

How it works step by step

  • Enables a configured token on first liquidity addition by calling its start function with the pool manager as the pool address.
  • Updates an internal random seed after swaps that involve the configured token.
  • Stores and renders on-chain SVG punk art layers that the owner uploads.
  • Exposes the seed-derived metadata and SVG generation through view functions.
  • Does not take fees, modify swap amounts or hold user funds.
Swap behaviour
afterSwap checks whether the pool includes the configured token; if so it updates the internal random seed, otherwise it does nothing. Swap amounts and fees are not modified.
Liquidity behaviour
On afterAddLiquidity, if the pool includes the configured token and the token is not yet started, it calls token.start(poolManager) once to enable trading. No liquidity removal callbacks are enabled.
Fee behaviour
The hook takes no fees and sets no fee overrides; it uses the pool's static fee and returns zero deltas.
Owner & admin controls
Owner (set at deployment, can be renounced) can set the punks collection address via setPunksAddress, set the token via setToken, upload all SVG art layers (setBody, setHorn, setEyes, setHair, setAccessories, setWings, setTail, setLegsFront, setLegsBack, setGround), transfer ownership and renounce ownership. No pause, no upgrade proxy, and no fee or swap-blocking controls were found in the source.

Enabled Uniswap v4 callbacks

afterAddLiquidity, afterSwap

afterAddLiquidity is used to start the configured token when its first liquidity pool is created. afterSwap is used to update the on-chain random seed when a swap involves the configured token. No return-delta permissions are enabled.

Security & trust assessment

Risk level: low (verified source, high confidence).

Who controls it: The owner controls which token and punks collection the hook is wired to and can replace the on-chain art. The owner cannot block swaps, move pool funds or change fees, but it can point the hook at a different token address before any token is set.

Risk to user funds: The hook never holds tokens and returns zero deltas, so it cannot custody or move user or pool funds. Its only interaction with funds is the trust placed in the external token contract's start function, which it calls during liquidity addition.

Security findings

  • [medium] Owner can rewire token reference: The owner can call setToken at any time to replace the token address, changing which pools trigger start and which swaps update the seed.
  • [low] Dependency on external token start call: The start call on the token is made from inside afterAddLiquidity, so a token whose start function reverts would block the first liquidity addition for pools containing that token.
  • [low] Weak on-chain randomness: randomSeed is derived from block.timestamp, block.prevrandao, block.number and a counter. Validators can influence these values, so the seed is not suitable for value-sensitive randomness.
  • [info] Ownership can be renounced: The owner can renounce ownership, after which the art and configuration become immutable.

Contract details

Verified source
Yes (PunkHook)
Compiler
solc 0.8.33+commit.64118f21
Bytecode size
12,740 bytes
Upgradeable proxy
No
Detected patterns
ownable

Pools using PunkHook