Token hook on Ethereum

Volume (24h)

$0

Value locked (TVL)

$0

All-time volume

$0

Pools using this hook

1

Swaps (24h)

2 (1 traders)

Total swaps

2

What it does

This hook taxes sells of deskToken with a rate that depends on how recently the last sell happened, and it routes the collected tax to a vault and founder, so sellers pay more when selling soon after a previous sell and buys pay the lower buy rate.

How it works step by step

• Acts as a tax/fee hook on a pool of a token named deskToken, with buy and sell basis-point rates (buyBps, sellBps) capped by MAX_FEE_BPS
• Records the timestamp of the last sell (lastSellTimestamp) and reads it together with a time window (TAX_DURATION, secondsRemaining) to scale or expire the sell tax
• Charges a penalty in basis points (PENALTY_BPS) relative to BPS_BASE, apparently on early or specific trades
• Uses afterSwap to write the last-sell timestamp and to take tokens via return deltas, and beforeSwap to read state and compute the fee
• Gates liquidity add/remove and donate paths with hook callbacks that return fixed values and do not change pool state
• Forwards collected value to a vault address and a founder, with an ETH_THRESHOLD that appears to govern when accumulated funds are transferred out

Swap behaviour

Sell-side swaps are taxed through sellBps and previewSellFeeBps, with the rate depending on the time elapsed since lastSellTimestamp; buys are taxed at buyBps. The afterSwap call records the sell timestamp and takes the tax via return deltas. Exact direction-dependent logic could not be fully confirmed from bytecode alone.

Liquidity behaviour

beforeAddLiquidity and beforeRemoveLiquidity return fixed selectors without state changes; afterAddLiquidity and afterRemoveLiquidity are also pure stubs that return fixed values. Liquidity is not taxed or blocked by the hook's visible logic.

Fee behaviour

Dynamic tax on swaps: buyBps and sellBps set the rates, capped by MAX_FEE_BPS. Sell tax is time-dependent via lastSellTimestamp and TAX_DURATION, and a PENALTY_BPS penalty applies in some conditions. Collected tax is taken through return deltas and routed toward vault and founder.

Owner & admin controls

A founder address is stored and gates FlyWheel(address) (NotFounder revert). Fee constants are shown as pure getters, which suggests they are fixed in code rather than adjustable; no owner setter selector was observed. No upgradeability pattern was detected.

Enabled Uniswap v4 callbacks

beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

beforeSwap: reads state to compute the swap tax. afterSwap: updates lastSellTimestamp and takes the tax through return deltas. beforeSwapReturnDelta and afterSwapReturnDelta: allow the hook to take a portion of swap currency. Other callbacks (liquidity, donate, initialize) are present but appear to be no-ops.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, medium confidence).

Who controls it: The founder address can trigger FlyWheel to move accumulated balances to the vault or destination; a compromised founder key could drain collected funds.

Risk to user funds: The hook takes a percentage of swap currency via return deltas and holds or forwards it to the vault and founder, so trader and pool value passing through swaps is exposed to the tax mechanism and to founder-triggered transfers.

Security findings

• [medium] Hook takes tokens via return deltas: beforeSwapReturnDelta and afterSwapReturnDelta are enabled and afterSwap uses transfers and take calls, so the hook can extract a share of every affected swap.
• [medium] Founder-gated fund movement: FlyWheel(address) is restricted to the founder (NotFounder selector present) and transfers balances out, so the founder can direct accumulated funds.
• [low] Time-dependent sell tax: Sell tax depends on lastSellTimestamp and TAX_DURATION, so the effective rate for a given trader changes with timing; this is a user-facing cost rather than a direct exploit.
• [info] Decoded bytecode only: Without source, exact arithmetic, rounding and edge-case behaviour of the tax and the penalty could not be verified.

Contract details

Verified source

No

Bytecode size

4,454 bytes

Upgradeable proxy

No

Detected patterns

erc20, liquidity-management, moves-currency, return-delta, tax

Pools using Token hook