Dynamic fee hook on Ethereum

Uniswap v4 Hook Contract 0xc24aebc2bd21419122cbfbfcb27100c32fc3a888 on Ethereum · Dynamic fee

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

A Uniswap v4 hook that adjusts swap behaviour through a return delta and an admin-set parameter, with possible token-jar fee collection, but its exact logic cannot be fully confirmed from unverified bytecode.

This read was written for the hook 0xc200…a888 on Ethereum and reused here: the two share a code shape, so constants such as fees, owners and addresses can differ.

How it works step by step

  • Runs beforeInitialize to write a per-pool value into a mapping when a pool is created
  • Gates liquidity additions in beforeAddLiquidity, reverting with LiquidityNotAllowed when disallowed
  • Runs beforeSwap and returns a delta that can adjust how much is taken or given on each swap
  • Stores a uint24 parameter that an admin can update through a nonpayable setter
  • Exposes pollTokenJar to move accumulated value to a token jar
  • Provides quote() and pseudoTotalValueLocked() views for off-chain pricing and TVL estimates
Swap behaviour
beforeSwap runs on every swap and can return a delta that changes the amounts settled, reading a stored uint24 parameter and pool state; the hook appears to take or give tokens as part of settlement.
Liquidity behaviour
beforeAddLiquidity (259982e5) is enabled and can revert with LiquidityNotAllowed() as the bytecode contains that error selector, so the hook can restrict who adds liquidity. beforeRemoveLiquidity and afterAddLiquidity/afterRemoveLiquidity selectors exist but their permission flags are not enabled, so they are not called by the PoolManager.
Fee behaviour
The hook exposes a nonpayable setter (c5cda8d2, uint24 argument) that writes a uint24 storage slot, which suggests a fee value is set on-chain; the quote(bool,int256,bytes32) and beforeSwap paths read that same slot, so swap fees are likely computed by the hook, possibly dynamically. Whether a protocol fee is taken into a token jar (tokenJar, protocolFeeController, protocolFeeFlags selectors present) cannot be confirmed.
Owner & admin controls
Storage slot 0 packs an address (likely admin or pool-related) and a uint24 at offset 20; the uint24 is written by c5cda8d2 (likely a fee setter, nonpayable with no access check visible in the decoded selectors) and pollTokenJar (3f7d1179) is a nonpayable public function that moves accumulated value. An admin() getter (f851a440) exists, and an OnlyAdmin() error selector appears in bytecode, so an admin role gates some functions. Exact permissioned set cannot be confirmed without source.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeSwap, beforeSwapReturnDelta

beforeInitialize: runs when the pool is created and writes a mapping keyed by uint256 (dc98354e). beforeAddLiquidity: can gate liquidity provision (LiquidityNotAllowed). beforeSwap: runs before each swap and reads the stored value and pool state to compute swap behaviour. beforeSwapReturnDelta: the hook can return a delta that alters the swap's amounts, meaning it can take or give tokens during swaps.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: An admin key (admin() getter present, OnlyAdmin error present) can likely change the uint24 parameter via c5cda8d2 and trigger pollTokenJar; the bytecode suggests privileged parameter changes without a timelock visible in the decoded data.

Risk to user funds: The hook can take or supply tokens during swaps through its return delta and can move accumulated value to a token jar, so it can affect amounts received by traders and the balance of pool funds, though it does not appear to hold user principal indefinitely.

Security findings

  • [high] Return delta controls swap amounts: beforeSwapReturnDelta is enabled, so the hook can return a delta that takes or supplies tokens during swaps, giving it direct control over settlement amounts.
  • [medium] Admin-adjustable uint24 parameter: The contract contains a nonpayable setter (0xc5cda8d2) writing a uint24 storage value, which an admin may be able to change to alter fees on live pools.
  • [medium] Hook moves currency to a token jar: The contract includes a function that moves accumulated value to a token jar (pollTokenJar, plus take/settle/transferFrom call selectors), so it holds and transfers pool-derived funds.
  • [low] Liquidity provision can be restricted: Bytecode references LiquidityNotAllowed and OnlyAdmin errors, so liquidity provision can be blocked by configuration.
  • [info] Unverified source: The source is unverified and this analysis is inferred from selectors and storage access patterns only, so the exact logic is uncertain.

Contract details

Verified source
No
Bytecode size
11,517 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, return-delta

Pools using Dynamic fee hook