Launchpad hook on Ethereum

Uniswap v4 Hook Contract 0x7f58507732329dcc57eb647355196026efaa6880 on Ethereum · Launchpad

Volume (24h)
$201
Value locked (TVL)
$198
All-time volume
$201
Pools using this hook
1
Swaps (24h)
2 (1 traders)
Total swaps
2

What it does

This appears to be a launchpad hook that gates liquidity during a launch phase and runs a randomized draw from a pot, with the owner able to take accrued funds; because the swap path and fee behaviour could not be confirmed, it is unclear which trades pay more or less.

How it works step by step

  • Hook is deployed with beforeInitialize, beforeAddLiquidity and beforeSwap permissions only, and holds pool state in storage slots (poolId, bandLiquidity, bandIn, opened, openedAt, depth, pending, held, nextToSettle).
  • beforeInitialize (0xdc98354e) writes the pool id and an opened flag, indicating the hook sets up a single pool on creation and records it as a launch.
  • beforeAddLiquidity (0x259982e5) writes a boolean flag, suggesting liquidity additions are gated during the launch phase.
  • beforeSwap (0x575e24b4) is view-only in its selector mutability, so swap handling reads the launch state and does not itself change storage through this selector.
  • Contains a self-unlock pattern (unlockCallback 0x91dd7346, abort 0xe50701f4, close 0x43d726d6, withdraw 0x3ccfd60b, payOwner 0x3335a2b8) and calls take() and transfer(), so it moves pool currency out of the pool manager.
  • Exposes a batch and order subsystem (orders, batches, MAX_ORDERS, MIN_BATCH, drawPot, randomness, seedOf), which suggests a randomized draw of participants and a per-owner credit ledger (credit, ownerOwed).
Swap behaviour
Swaps are routed through beforeSwap, which reads the launch state; the decoded bytecode does not show a fee override or return delta on this path, so the exact treatment of individual trades cannot be confirmed.
Liquidity behaviour
beforeAddLiquidity writes a launch-state flag, so additions appear to be gated while the launch is open; beforeRemoveLiquidity is present in the dispatch table but not enabled in the hook permissions, so removals are not intercepted by the hook.
Fee behaviour
Uses the pool's static fee as far as the enabled callbacks show; the presence of FEE, LP_FEE, OWNER_FEE, DRAW_FEE and KEEPER_FEE getters suggests fee amounts are configured constants, but no dynamic fee override is confirmed.
Owner & admin controls
An OWNER() getter and payOwner/ownerOwed indicate an owner who is paid accrued amounts; withdraw, close and abort exist, and access restrictions could not be confirmed from bytecode alone. Specific privileged roles are not verified.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeSwap

beforeInitialize records the pool and opens the launch; beforeAddLiquidity updates the launch flag to control liquidity entry; beforeSwap reads launch state for swap handling.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, low confidence).

Who controls it: An owner-linked role appears able to trigger payouts, withdrawals and closing or aborting the launch, which could redirect or freeze accrued funds if the access checks are weak.

Risk to user funds: The hook holds and moves pool currency through take/transfer and a credit ledger, so user and LP funds sit under the hook's control and can be paid out, withdrawn or aborted by its privileged paths.

Security findings

  • [high] Hook takes and moves pool currency: The bytecode contains take() and transfer() selectors together with an unlockCallback self-unlock flow, so the hook can withdraw tokens from the pool manager and send them to addresses it stores.
  • [medium] Owner payout and withdrawal paths: payOwner, withdraw and close selectors write to balance mappings and held/pending slots, so a privileged party may be able to extract accrued funds; the access check could not be verified.
  • [medium] Randomized draw logic: randomness and seedOf functions drive a draw from a pot (drawPot), and the randomness source is not verifiable from decoded bytecode, so outcomes may be predictable or manipulable.
  • [info] Unverified source: No verified source is available, so access control and the exact flow of funds are inferred only from selectors and storage writes.

Contract details

Verified source
No
Bytecode size
17,247 bytes
Upgradeable proxy
No
Detected patterns
erc20, launchpad, moves-currency, self-unlock

Pools using Launchpad hook