Token hook on Ethereum

Uniswap v4 Hook Contract 0x648302c5c2a814461e89f1559f86e4dcb834c0cc on Ethereum · Token

Volume (24h)
$179
Value locked (TVL)
$0
All-time volume
$179
Pools using this hook
1
Swaps (24h)
3 (2 traders)
Total swaps
3

What it does

A sell-tax token hook that taxes sells during a configured window and routes the proceeds to a reward vault and buyback/burn routines.

How it works step by step

  • Applies a sell penalty computed from PENALTY_BPS and BASE_BPS over a TAX_DURATION window.
  • Tracks last sell timestamp and sell state in afterSwap.
  • Takes a share of swap amounts through return deltas.
  • Routes collected currency to a reward vault using take and transfer.
  • Accumulates funds that feed executeBuyback and executeBurn once BUYBACK_TRIGGER and minBuyback thresholds are met.
  • Uses self-unlock to manage PoolManager accounting during these operations.
Swap behaviour
beforeSwap and afterSwap handle sell-side taxation and state tracking; return-delta permissions let the hook take a share of swap amounts.
Liquidity behaviour
Has beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity and afterRemoveLiquidity selectors, which appear to be pass-through or view-level hooks; no clear state changes were identified.
Fee behaviour
Charges a sell-side tax via previewSellFeeBps(uint256) using PENALTY_BPS, BASE_BPS and BPS_BASE constants, with TAX_DURATION controlling how long the tax applies. Exact routing of the fee is not confirmed from bytecode.
Owner & admin controls
No verified source. Selectors suggest a founder address (founder()) and a FlyWheel(address) setter (0x4e84c366), plus a 27f69879 nonpayable function with an address argument, which may set a privileged address or flags. Exact access control cannot be confirmed from bytecode alone.

Enabled Uniswap v4 callbacks

beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

beforeSwap: may modify swap deltas and gate sells. afterSwap: updates sell-related state such as lastSellTimestamp and sell flags. beforeSwapReturnDelta: lets the hook take a share of swap input via return deltas. afterSwapReturnDelta: lets the hook adjust output or take a fee after the swap.

Security & trust assessment

Risk level: medium (decoded bytecode, low confidence).

Who controls it: The founder and FlyWheel-related addresses may control parameters, reward vault routing and buyback triggering; the extent is unverified.

Risk to user funds: The hook can take a share of swap amounts via return deltas and transfer currency to a reward vault and buyback routines. Users trading the pool pay the sell tax and may lose value if parameters are changed by privileged addresses.

Security findings

  • [medium] Return-delta fee capture: Hook has beforeSwapReturnDelta and afterSwapReturnDelta, so it can take tokens from swaps and alter traders' effective amounts.
  • [medium] Hook moves currency: Bytecode calls take(address,address,uint256) and transfer(address,uint256), so the hook moves currency out of the PoolManager and to external addresses such as a reward vault.
  • [low] Self-unlock pattern: Bytecode contains self-unlock flow via unlock(bytes) and unlockCallback(bytes), so the hook can open its own accounting sessions.
  • [medium] Public buyback and burn triggers: executeBuyback() and executeBurn() are nonpayable and callable externally; they can trigger token movements gated by timing and thresholds (BUYBACK_TRIGGER, minBuyback, lastBuybackAt). Whether they are permissionless is unconfirmed.
  • [info] External vault dependency: The hook depends on external token balances and vault addresses; a compromised or misconfigured vault could redirect or lock fees.

Contract details

Verified source
No
Bytecode size
9,453 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, return-delta, self-unlock

Pools using Token hook