CumHook on Ethereum

Uniswap v4 Hook Contract 0xde1949891ca439164a6850b98b4aed9cdcf0e0c0 on Ethereum · Dynamic fee · Verified contract

Volume (24h)
$0
Value locked (TVL)
<$0.01
All-time volume
$37.60K
Pools using this hook
4
Swaps (24h)
0 (0 traders)
Total swaps
1,871

What it does

A dynamic-fee hook that raises swap fees when a pool's price is pushed in one direction by recent trades, and lowers them when trades move the price back toward balance, with a fixed 0.04% protocol fee on top.

How it works step by step

  • Requires pools to use the dynamic fee flag at initialization.
  • Estimates each incoming swap's price impact from its size and the stored illiquidity measure.
  • Charges a higher fee when the swap pushes the cumulative price impact further in the same direction, and a lower fee when it moves back toward balance.
  • Decays the cumulative price impact linearly toward zero over a configurable time window.
  • Adds a fixed 400 pip protocol fee on top of the computed fee and clamps the result between configured min and max bounds.
  • Emits BeforeSwap and AfterSwap events with the state used for each fee decision.
Swap behaviour
Before each swap the hook estimates the price impact from the swap size and pool illiquidity, combines it with a time-decayed cumulative price impact and sets a dynamic fee accordingly. After each swap it updates the cumulative price impact, illiquidity and last-swap timestamp.
Liquidity behaviour
No liquidity callbacks.
Fee behaviour
Each swap computes a dynamic fee from an estimated price impact, a time-decayed cumulative price impact and the pool's min/max bounds, then adds a fixed 400 pip protocol fee (0.04%) and returns it with the override flag. The first swap after initialization uses fallbackFee plus the protocol fee.
Owner & admin controls
configurePool is an external function with no access control in the source (the comment says it should be pool-owner only but no check exists), so any address can set or overwrite min/max/fallback fees, time decay length and illiq scale for any pool. No owner, pause or upgrade mechanism found.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeSwap, afterSwap

beforeInitialize rejects pools without a dynamic fee flag. beforeSwap computes and overrides the swap fee and records state. afterSwap updates cumulative price impact, illiquidity and timestamp from the realized price move.

Security & trust assessment

Risk level: high (verified source, high confidence).

Who controls it: configurePool has no caller restriction, so anyone can reconfigure fee bounds and decay parameters for any configured or unconfigured pool, directly changing the fees charged to traders and LPs.

Risk to user funds: The hook does not hold tokens or take deltas, so it cannot directly move or lock funds. Users are exposed through the fee: an unrestricted configurePool can set extreme fees on any pool, causing swappers to overpay and LPs to receive fee income manipulated by whoever configured the pool.

Security findings

  • [high] Unrestricted pool configuration: configurePool is external with no msg.sender check, despite a comment saying it should be restricted to the pool owner. Anyone can set minFee, maxFee, fallbackFee, timeDecayLength and illiqScale on any pool.
  • [medium] Front-runnable pool setup: beforeSwap reverts with PoolNotConfigured for unconfigured pools, so a pool stays unusable until someone calls configurePool; a third party can configure it with arbitrary parameters first.
  • [medium] Fee parameters fully attacker-set: The fee is clamped to [minFee, maxFee] plus protocol fee, so a configurer can set maxFee to the large maximum and charge swappers very high fees, or set minFee high to block cheap swaps.
  • [info] No token custody or delta takes: Hook returns a fee override and afterSwap reads volume and price from slot0 without return deltas, so it does not take or hold user tokens directly.

Contract details

Verified source
Yes (CumHook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
12,962 bytes
Upgradeable proxy
No
Detected patterns
dynamic-fee

Pools using CumHook