NFTXFlexHook on Ethereum

Uniswap v4 Hook Contract 0xc26a5cb51b1818f62a4c6693a9a1fedb3340efc4 on Ethereum · Dynamic fee · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$47.87K
Pools using this hook
4
Swaps (24h)
17 (6 traders)
Total swaps
422

What it does

A permissionless Uniswap v4 hook that lets anyone create pools pairing an NFTX CollectionToken with a whitelisted pair token, with dynamic owner-set fees, oracle observations and donations of LP fees back to liquidity providers.

How it works step by step

  • Creates dynamic-fee pools between one CollectionToken and an allowed pair token, rejecting the canonical flETH pair and dual-collection pairs.
  • Sets the LP fee per swap from pool override, default fee or per-origin exemption, with the fee flagged to override the pool's stored fee.
  • Takes an optional AMM fee from the unspecified leg of each swap and credits it to an escrow balance for the AMM beneficiary.
  • Queues fee amounts and donates them to in-range liquidity providers before liquidity changes and swaps, deferring when no liquidity is in range.
  • Maintains a truncated tick oracle per pool, skipping observations while no in-range liquidity exists, and exposes observe() for TWAP reads.
  • Lets the owner pause new pool creation, swap the pair token whitelist, attach a notifier, or permanently retire a pool.
Swap behaviour
Each swap is charged the owner-configured dynamic fee (per pool, default, or per-origin exemption), optionally subjected to notifier validation, may trigger a donation flush, and records an oracle observation; an AMM fee may be taken from the unspecified leg and credited to the beneficiary. Swaps revert if the pool was deregistered.
Liquidity behaviour
Before add and remove liquidity the hook flushes any queued donation into the pool; after add and remove it emits state events. It takes no delta from liquidity operations and does not restrict who may add or remove liquidity. Adds are intentionally left open on deregistered pools so that LPs can exit and queued donations can be recovered.
Fee behaviour
Dynamic LP fee: each swap is charged getFee(poolId, tx.origin) with OVERRIDE_FEE_FLAG, using the pool's own fee if set, else defaultFee (1 percent initially), then lowered by any per-origin flat-fee exemption, then optionally adjusted by the notifier. An AMM fee (ammFee, zero by default) is additionally taken from the unspecified leg of each swap and credited to ammBeneficiary via escrow; the beneficiary is credited the amount actually received, capped at the nominal fee. LP fees accrued in the pool are donated back to in-range LPs, deferred when the pool has no in-range liquidity.
Owner & admin controls
Owner (solady Ownable, two-step handover) can: setPairTokenWhitelist (policy for which pair tokens may be paired, takes effect for new pools only), setPaused (blocks new pool creation only), deregisterPool (terminal retirement: swaps revert PoolDeregistered, liquidity exits stay open), setFee per pool and setDefaultFee, setFeeExemption/removeFeeExemption for per-origin flat fees capped to not exceed the pool fee, setAmmFee and setAmmBeneficiary (fee taken from swap unspecified leg), setNotifier (attach external subscriber fan-out that can validate and reject swaps), setDefaultMaxAbsTickDelta, setPoolMaxAbsTickDelta, setDefaultObservationCardinality. No upgrade proxy is evident; the contract is immutable apart from these parameters and the swappable whitelist and notifier.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity, afterRemoveLiquidity, beforeSwap, afterSwap, afterSwapReturnDelta

beforeInitialize: validates pool key (dynamic fee, allowed tick spacing, exactly one collection token side, not the canonical flETH pair, whitelist approval) and seeds the oracle. beforeAddLiquidity and beforeRemoveLiquidity: flush pending fee donations. afterAddLiquidity and afterRemoveLiquidity: emit pool state. beforeSwap: blocks swaps on deregistered pools, calls notifier validation, sets dynamic fee, flushes donations, records oracle observation. afterSwap: takes AMM fee from unspecified leg via afterSwapReturnDelta, credits beneficiary, notifies subscribers. afterSwapReturnDelta is the only return-delta permission and is used to pull the AMM fee.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: The owner can reprice every pool up to the 100 percent LP fee cap, set an AMM fee that takes a share of every swap's unspecified leg, redirect that fee to any beneficiary, attach a notifier that can reject any swap, swap the pair token whitelist to permit arbitrary pairings for new pools, pause new pool creation, and retire live pools so their swaps revert. Owner keys are therefore high-impact even though existing liquidity can always exit.

Risk to user funds: The hook holds escrowed AMM fee balances and queued LP donation reservoirs but does not custody user principal in pools. Owner can extract the AMM fee share of swaps through the beneficiary, can reprice or block swaps, and can route the notifier to reject any swap; funds cannot be drained directly from the pool, and withdrawals of escrowed balances are open to the credited recipient.

Security findings

  • [medium] Owner-controlled swap fee up to 100 percent: Owner can set defaultFee or per-pool fee up to the maximum LP fee, so the owner can effectively make swaps prohibitively expensive for traders on any pool.
  • [medium] Owner can halt trading on individual pools permanently: deregisterPool is terminal: once called, swaps on that pool revert with PoolDeregistered for all traders, while liquidity removal remains possible.
  • [medium] External notifier can block or reprice swaps: An attached notifier can validate and reject swaps and fold arbitrary values into the fee; subscribers are trusted and their reverts are not isolated, so a faulty or malicious subscriber can block swaps across all pools.
  • [low] Pair token assumptions bounded by design: Fee-on-transfer or rebasing pair tokens are handled by crediting only what arrived, and a pair token that blocklists the hook only breaks that pool's swaps, which limits cross-pool contagion.
  • [info] Policy changes do not affect existing pools: Pool creation is gated by the whitelist and the pause flag; existing pools remain tradable after policy changes, so delisting a pair token does not close pools that already exist.

Contract details

Verified source
Yes (NFTXFlexHook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
20,829 bytes
Upgradeable proxy
No
Detected patterns
access-control, donates, dynamic-fee, erc6909-claims, moves-currency, oracle, ownable, pausable, return-delta

Pools using NFTXFlexHook