Dynamic fee hook on Ethereum

Uniswap v4 Hook Contract 0x63c1635485506b3a0ab7e135fe1a620c59d4658b on Ethereum · Dynamic fee

Volume (24h)
$0
Value locked (TVL)
$0.02
All-time volume
$0
Pools using this hook
1
Swaps (24h)
2 (2 traders)
Total swaps
2

What it does

This hook sets dynamic fees via owner-adjustable parameters and can change swap and liquidity settlement amounts through return deltas, but without verified source it cannot be confirmed which trades pay more or less.

How it works step by step

  • Runs on beforeInitialize and records two uint16 parameters in storage slot 0 alongside an address (likely a fee receiver or configured address) set at initialization
  • Uses beforeSwap with beforeSwapReturnDelta enabled, so it can return a delta that adjusts the swap amounts and currency flows
  • Tracks per-pool, per-address balances in a nested mapping (slot 1) and a uint256 counter (slot 3) during liquidity add and remove callbacks
  • Takes currency from the pool via a take(address,address,uint256) call in the bytecode and records debts through debtOf-style accounting
  • Exposes owner-controlled setFeeReceiver and uint16 setters (selectors 0x534eb4cf and 0xcb9442e2) that adjust stored fee-related parameters
  • Implements Uniswap V3 style swap callbacks (uniswapV3SwapCallback and pancakeV3SwapCallback) which suggests it interacts with an external V3 pool for routing or rebalancing
Swap behaviour
beforeSwap is called and, because beforeSwapReturnDelta is enabled, the hook can return a delta that changes the amounts settled for the swap. It may take currency through the take call and perform V3 pool callbacks during execution. Exactly which trade direction pays more or less cannot be determined from decoded bytecode alone.
Liquidity behaviour
afterAddLiquidity and afterRemoveLiquidity are both called and both can return deltas. The hook updates the nested balance mapping in slot 1 and the counter in slot 3 on add and remove, and can take currency from the pool as part of liquidity settlement.
Fee behaviour
The hook has dynamic-fee tagging and stores uint16 values that are likely fee parameters, adjustable by the owner. How the fee is computed per swap cannot be determined without source; it may be returned via the beforeSwap delta.
Owner & admin controls
An owner (Ownable, with renounceOwnership and transferOwnership) can change the fee receiver via setFeeReceiver and can call uint16 setters that change stored parameters. No pause or upgrade mechanism was identified from the selectors, but this is not conclusive.

Enabled Uniswap v4 callbacks

beforeInitialize, afterAddLiquidity, afterRemoveLiquidity, beforeSwap, beforeSwapReturnDelta, afterAddLiquidityReturnDelta, afterRemoveLiquidityReturnDelta

beforeInitialize: stores initialization parameters and the owner-set address. beforeSwap: can apply a return delta to adjust swap settlement and fees. beforeSwapReturnDelta: enables that delta. afterAddLiquidity and afterRemoveLiquidity: update per-pool accounting and settle currency. afterAddLiquidityReturnDelta and afterRemoveLiquidityReturnDelta: allow these callbacks to adjust the liquidity deltas and take currency from the pool.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, low confidence).

Who controls it: A single owner key controls fee receiver, uint16 parameters and ownership transfer. A compromised or malicious owner could raise fees, redirect fee revenue, or transfer ownership to an attacker.

Risk to user funds: The hook can hold and move pool currency through take calls and return deltas on swaps and liquidity operations, so user funds are exposed to whatever logic the owner-configurable parameters enable.

Security findings

  • [medium] Owner can change fee parameters: Owner-only uint16 setter functions (0x534eb4cf, 0xcb9442e2) write to storage slots that affect fee-related state, so a privileged key could change fees that apply to user swaps.
  • [high] Hook can take currency via return deltas: beforeSwapReturnDelta and afterAddLiquidityReturnDelta/afterRemoveLiquidityReturnDelta are enabled and the bytecode calls take(address,address,uint256), so the hook can move pool currency and alter the amounts users settle.
  • [medium] Fee receiver can be redirected: setFeeReceiver (0xefdcd974) lets the owner change the address that receives taken fees, so a compromised owner key could redirect fee revenue.
  • [medium] No verified source: Analysis relies on decoded bytecode without verified source, so exact fee formulas and access checks cannot be fully confirmed.

Contract details

Verified source
No
Bytecode size
12,917 bytes
Upgradeable proxy
No
Detected patterns
dynamic-fee, moves-currency, ownable, return-delta

Pools using Dynamic fee hook