Utility hook on Ethereum

Uniswap v4 Hook Contract 0xdc766448ff29b8cd12ae12d8252762d93ecd2ac0 on Ethereum · Utility

Volume (24h)
$34.80K
Value locked (TVL)
$976
All-time volume
$48.99K
Pools using this hook
6
Swaps (24h)
1,163 (59 traders)
Total swaps
1,403

What it does

A Uniswap v4 hook with admin-gated controls over liquidity, swaps and routing, which appears to manage pool liquidity, residual balances and access by trusted routers and keepers.

How it works step by step

  • Gates pool initialization, liquidity additions and removals through beforeInitialize, beforeAddLiquidity and beforeRemoveLiquidity.
  • Runs swap-time checks in beforeSwap, including a global pause flag and trusted-router verification.
  • Performs post-swap accounting in afterSwap, tracking deficits and rounding debt.
  • Takes and transfers currency via the pool manager, so it holds and moves tokens during operations.
  • Maintains admin-managed allowlists for trusted routers, quoters and keepers.
  • Supports admin sweep, withdrawal and residue-recipient management for leftover funds.
Swap behaviour
beforeSwap and afterSwap are enabled; beforeSwap checks the global pause and router trust, and afterSwap handles accounting and residue or deficit tracking. Exact fee or price adjustments could not be confirmed from the decoded bytecode.
Liquidity behaviour
beforeAddLiquidity and beforeRemoveLiquidity are enabled and their selectors are dispatched, which suggests the hook gates or inspects liquidity changes, and the presence of ThirdPartyLiquidityBlocked and InsufficientGasBeforeCanonical errors suggests third-party liquidity may be restricted. Exact behaviour not determinable without source.
Fee behaviour
Could not determine fee logic from decoded selectors; no fee-setting function is evident beyond the pool's own configuration via getPoolConfig. Treat as uses the pool's fee unless further analysis shows otherwise.
Owner & admin controls
Admin address in slot 0 can set itself or change admin via setAdmin, toggle global pause (setGlobalPaused), manage trusted routers (setTrustedRouter), trusted quoters (setTrustedQuoter), keepers (setKeeper), set the residue recipient (setResidueRecipient) and gas policy (setGasPolicy). Withdrawals and sweeps are also callable by the admin path (withdrawFloat, sweep).

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeRemoveLiquidity, beforeSwap, afterSwap

beforeInitialize: validates pool initialization (UnauthorizedInitializer error present). beforeAddLiquidity: gates liquidity additions, possibly blocking third-party liquidity. beforeRemoveLiquidity: gates liquidity removals. beforeSwap: main swap-time logic including pause check and gas/routing checks. afterSwap: post-swap accounting, residue and deficit handling (HookDeficit, RoundingDebtTooLarge errors present).

Security & trust assessment

Risk level: medium (decoded bytecode, low confidence).

Who controls it: The admin key can pause all swaps globally, change trusted routers, quoters and keepers, change the residue recipient that receives leftover tokens, and sweep or withdraw tokens held by the hook. A compromised admin key could redirect residual funds or halt trading.

Risk to user funds: The hook can hold tokens via take and transfer calls and the admin can sweep or withdraw balances and change the residue recipient. Users' pool funds may be exposed to admin action, and swaps can be blocked by the global pause.

Security findings

  • [medium] Hook holds and moves tokens: The hook calls take and moves currency during pool operations (take selector and transfer/transferFrom present), so it can hold and move pool funds.
  • [medium] Admin can withdraw and redirect funds: setAdmin, setResidueRecipient and sweep/withdrawFloat are reachable by the admin, allowing the admin to direct accumulated funds.
  • [low] Global pause control: setGlobalPaused lets the admin halt swaps for all pools using this hook.
  • [info] Self-unlock pattern: Contract uses a self-unlock pattern (unlock and unlockCallback selectors present) and calls the pool manager, which increases integration complexity but is not itself a vulnerability.
  • [info] Unverified source: Source is unverified, so all behaviour is inferred from selectors and storage, and the admin mechanisms and error names are only partially understood.

Contract details

Verified source
No
Bytecode size
24,432 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, self-unlock

Pools using Utility hook