SellOnlyHook on Ethereum

Volume (24h)

$14.54K

Value locked (TVL)

$165.35K

All-time volume

$527.30K

Pools using this hook

1

Swaps (24h)

6 (3 traders)

Total swaps

126

What it does

A sell-only gate for the ABX/USDC pool: anyone can sell ABX into it, but only allowlisted accounts can buy ABX with USDC or add liquidity.

How it works step by step

• beforeSwap checks whether the input currency is USDC and, if so, requires the resolved trader to be in the isBuyer allowlist.
• Trader identity is resolved via callerOf, which asks trusted routers for the real caller through msgSender().
• beforeAddLiquidity reverts unless the resolved provider is in the isLiquidityProvider allowlist.
• beforeInitialize only allows creating a pool that pairs ABX and USDC, initialized by an allowlisted liquidity provider.
• Owner manages buyers, liquidity providers and trusted routers through setter functions that emit events.
• The hook never modifies balances, fees or deltas.

Swap behaviour

beforeSwap reverts when the input token is USDC and the trader is not an allowlisted buyer; swaps selling ABX are unrestricted. Returns zero delta and no fee override.

Liquidity behaviour

beforeAddLiquidity reverts unless the caller (resolved through trusted routers via msgSender) is an allowlisted liquidity provider. Removing liquidity is never restricted and no beforeRemoveLiquidity callback is enabled.

Fee behaviour

Does not set or take fees; returns zero delta and zero fee override. Uses the pool's static fee.

Owner & admin controls

Owner (Ownable2Step, two-step transfer and renounce available) can add or remove buyers, liquidity providers and trusted routers at any time. No pause, no upgrade path, no fee or delta control. Owner is set at deployment and initially allowlisted as buyer and liquidity provider.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeSwap

beforeInitialize: restricts pool creation to the ABX/USDC pair and to allowlisted liquidity providers. beforeAddLiquidity: restricts adding liquidity to allowlisted providers. beforeSwap: reverts swaps that pay USDC into the pool unless the trader is an allowlisted buyer; ABX sells are open to everyone.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: The owner controls who may buy ABX, who may add liquidity, and which routers are trusted to report the true caller. A malicious or compromised owner could block all buyers or all liquidity providers, or trust a router that spoofs msgSender to bypass the buyer allowlist.

Risk to user funds: The hook does not custody tokens or alter balances. It can block USDC-to-ABX buys and liquidity additions, and removing liquidity is never blocked, so user principal in the pool is not locked by the hook itself.

Security findings

• [medium] Trust placed in trusted routers: Buy restrictions depend on sender attribution. For addresses flagged as trusted routers, the hook trusts the return value of msgSender(); if a trusted router is malicious or upgradeable, it can report any buyer address.
• [medium] Instant owner control over access lists: The owner can revoke buyer or LP status instantly with no timelock, which can freeze all USDC-to-ABX swaps or liquidity additions for everyone else.
• [low] Liquidity gating limits pool depth: Liquidity added by allowlisted providers is a two-sided position in a pool where only allowlisted buyers may pay USDC. Liquidity restriction is what prevents bypassing the buyer list, but any provider that is not vetted cannot add liquidity at all, limiting pool depth to the approved set.
• [info] Two-step ownership transfer: Ownership transfer uses Ownable2Step, so a transfer requires explicit acceptance by the new owner, reducing the risk of accidental loss of control.
• [info] No direct custody of funds: The hook never holds tokens, takes deltas or changes fees; it only gates callers, so it cannot directly seize or lock pool principal beyond blocking operations.

Contract details

Verified source

Yes (SellOnlyHook)

Compiler

solc 0.8.26+commit.8a97fa7a

Bytecode size

4,461 bytes

Upgradeable proxy

No

Detected patterns

ownable

Pools using SellOnlyHook

• USDC / ABX (0.05% fee) — 24h volume $14.54K, TVL $165.35K, 6 swaps today