CumHook on Ethereum

Uniswap v4 Hook Contract 0x29d6e0ff868ba37fd81f84208b1bc6781dffb0c0 on Ethereum · Dynamic fee · Verified contract

Volume (24h)
$33
Value locked (TVL)
$480
All-time volume
$3.07M
Pools using this hook
5
Swaps (24h)
5 (2 traders)
Total swaps
36,085

What it does

A dynamic-fee hook that raises or lowers swap fees based on how much each swap pushes the pool's price, with a cumulative impact that decays over time, so trades that increase imbalance pay more.

How it works step by step

  • Requires pools to use the dynamic fee flag at initialization
  • Estimates each swap's price impact from illiquidity and swap size before execution
  • Tracks a cumulative directional price impact that decays linearly to zero over a configured time window
  • Charges higher fees when a swap increases pool imbalance and lower fees when it reduces it
  • Clamps the computed fee between per-pool minimum and maximum bounds and adds a 1 pip protocol fee
  • Emits events for initialization, configuration, swap estimates and realised swap impact
Swap behaviour
beforeSwap estimates the price impact of the incoming swap, decays the stored cumulative price impact by elapsed time, and returns a dynamic fee clamped to the pool's min and max bounds plus protocol fee; afterSwap then records the realised price impact and updates the cumulative impact and illiquidity.
Liquidity behaviour
No liquidity callbacks.
Fee behaviour
Fees are computed per swap in beforeSwap from estimated price impact and a time-decayed cumulative price impact, then clamped between the configured minFee and maxFee, with a fixed protocol fee of 1 pip added and the override flag set. The first swap after configuration uses the fallback fee plus protocol fee.
Owner & admin controls
configurePool(bytes32,uint24,uint24,uint24,uint256,uint256) is an external function with no access check in the verified source (the comment says it should be pool-owner only but no such check exists), so any address can set or overwrite min fee, max fee, fallback fee, decay length and illiq scale for any configured or unconfigured pool. No owner, pause or upgrade mechanism found.

Enabled Uniswap v4 callbacks

beforeInitialize, afterInitialize, beforeSwap, afterSwap

beforeInitialize enforces that pools use a dynamic fee; afterInitialize emits a PoolInitialized event; beforeSwap computes and returns the dynamic fee override; afterSwap updates the cumulative price impact, timestamp and illiquidity state.

Security & trust assessment

Risk level: high (verified source, high confidence).

Who controls it: Anyone can call configurePool for any pool id, so a malicious caller could set maxFee and minFee to extreme values (for example a very high fee) or a fallback fee of 100% and degrade pool pricing for LPs and traders, or reset decay parameters to disrupt the mechanism.

Risk to user funds: The hook does not hold or move pool tokens and returns zero deltas, so it cannot directly take user funds. However, because configurePool is unrestricted, any caller can set the fee on a pool to an arbitrary level within the protocol cap, which can cost swappers and affect LP returns on that pool.

Security findings

  • [high] Unrestricted pool configuration: configurePool is external with no msg.sender check, despite a comment stating only the pool owner should configure it. Any address can change fee bounds and decay parameters for any pool.
  • [medium] No validation of fee parameters: Fee bounds are set by configurePool without validation against LPFeeLibrary.MAX_LP_FEE or against minFee being less than maxFee. Fees above the protocol cap could cause the call to be rejected by the pool manager, while an unbounded maxFee lets swappers pay very high fees.
  • [medium] No ownership of pool configuration: poolData and poolConfig are keyed only by PoolId with no ownership record, so a pool configured by one party can be reconfigured by any other party at any time.
  • [low] Unchecked illiqScale and timeDecayLength: Setting illiqScale to zero or other extreme values can cause divisions or saturating behaviour inside HookUtils estimates, potentially producing degenerate fees.
  • [info] No user fund custody: The hook does not return any balance deltas and does not take custody of tokens; it only sets dynamic LP fees and emits events.

Contract details

Verified source
Yes (CumHook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
13,338 bytes
Upgradeable proxy
No
Detected patterns
dynamic-fee

Pools using CumHook