UpegHook on Ethereum

Uniswap v4 Hook Contract 0xe54082dfbf044b6a8f584bdddb90a22d5613c440 on Ethereum · Token · Verified contract

Volume (24h)
$21.25K
Value locked (TVL)
$183.29K
All-time volume
$76.04M
Pools using this hook
10
Swaps (24h)
62 (48 traders)
Total swaps
110,872

What it does

A verified Uniswap v4 hook that, for pools pairing a configured token, starts that token once on first liquidity add and advances an on-chain random seed used for generated SVG artwork on each swap.

How it works step by step

  • On afterAddLiquidity, if the pool includes the configured token and the token has not started, it calls start on the token with the PoolManager address.
  • On afterSwap, if the pool includes the configured token, it rehashes an internal random seed using a counter, the previous seed, timestamp, prevrandao and block number.
  • Exposes the random seed through randomSeed() for the SVG/NFT-style generator contract that the hook also inherits from.
  • Does not change swap amounts, fees or liquidity deltas; both callbacks return zero deltas.
Swap behaviour
After each swap, if one side of the pool is the configured token, the hook updates its internal random seed. It does not alter the swap amounts, price or fee.
Liquidity behaviour
After liquidity is added, if the pool contains the configured token and the token is not yet started, the hook calls start on the token. Liquidity removal has no hook callback.
Fee behaviour
Uses the pool's static fee. The hook returns zero deltas and does not set or take fees.
Owner & admin controls
The owner (Solady-style Ownable inherited via SvgGenerator) can set the token address via setToken, set the upegs address via setUpegsAddress, set SVG asset arrays (setBody, setEyes, setHair, etc.), and call ownerRenounce or transferOwnership. Owner-only setters are visible in the ABI; the modifier code for SvgGenerator was not included.

Enabled Uniswap v4 callbacks

afterAddLiquidity, afterSwap

afterAddLiquidity is used to trigger a one-time start call on the configured token when first liquidity is added. afterSwap is used to update the randomness seed when the configured token is traded.

Security & trust assessment

Risk level: medium (verified source, medium confidence).

Who controls it: The owner can change the token address the hook reacts to, change artwork parameters, transfer or renounce ownership. These do not directly move user funds in the hook, but they can alter which token's start is invoked.

Risk to user funds: The hook does not hold, transfer or take tokens: all deltas returned are zero and it has no balance-moving code. It could only block liquidity additions if the token's start call reverts.

Security findings

  • [medium] Owner can repoint the token: setToken lets the owner change which token address the hook treats as its token, so the start call and seed updates follow whatever address the owner sets. The effect on the external token's start function depends on code not included in the input.
  • [low] Weak on-chain randomness: _randomizeSeed mixes block.timestamp, block.prevrandao and block.number, which are influenced or predictable by block producers and by the swapper within the same block. The seed drives artwork generation, not funds.
  • [low] External call from afterAddLiquidity: The hook calls token.start(poolManager) during liquidity addition. If the token's start reverts or misbehaves, liquidity additions to token pools would revert while the token is unstarted. The token code was not provided to confirm this.
  • [info] Token address spoofing check is by address only: The token check compares pool currencies against the stored token address. Only pools containing that exact currency are affected; other pools are unaffected.
  • [info] Unverified inherited ownership code: Ownership, SVG generator and token contracts were omitted from the input, so the onlyOwner modifier and token start logic could not be fully reviewed.

Contract details

Verified source
Yes (UpegHook)
Compiler
solc 0.8.33+commit.64118f21
Bytecode size
20,512 bytes
Upgradeable proxy
No
Detected patterns
ownable

Pools using UpegHook