SuperDCAGauge on Optimism

Uniswap v4 Hook Contract 0x4a4e794ac258fc4b653647211fb1cd533e67fa80 on Optimism · Rewards · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
2
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

SuperDCAGauge is a Uniswap v4 hook that lets users stake SuperDCA tokens against a paired token and distributes minted SuperDCA rewards to the pool's liquidity providers, while charging internal addresses zero fees and external swappers a 1% fee.

This read was written for the hook 0xbc5f…3a80 on Base and reused here: the two share a code shape, so constants such as fees, owners and addresses can differ.

How it works step by step

  • Stakes SuperDCA tokens per paired token address and tracks a global reward index that grows with time and mintRate
  • Mints SuperDCA rewards on liquidity add/remove events, splitting them 50% to the developer and 50% to the pool manager
  • Donates the community share of rewards to the pool when it has active liquidity, then settles the donation
  • Applies a per-swap dynamic fee: 0% for internal addresses and 1% for everyone else
  • Enforces that only pools containing SuperDCA and using dynamic fees can be initialized
Swap behaviour
On beforeSwap the hook looks up the swapper (via the sender's msgSender) and returns a dynamic fee: internalFee (0%) if the swapper is flagged internal, otherwise externalFee (1%). The hook takes no delta and does not alter swap amounts.
Liquidity behaviour
On beforeAddLiquidity and beforeRemoveLiquidity the hook first syncs the SuperDCA currency, updates the global reward index and computes the reward owed to the non-SuperDCA token's stakers. It then mints a 50/50 split between the developer address and the PoolManager, and donates the community share to the pool (when the pool has liquidity) followed by a settle. LPs therefore receive donated SuperDCA rewards as part of the pool's fee growth.
Fee behaviour
Swap fees are overridden per swap via the dynamic-fee flag: addresses flagged as internal pay internalFee (initially 0%), all others pay externalFee (initially 1.00%). Fees are set by the manager through setFee and are not taken as a hook delta; the hook returns zero delta and does not take a share of fees.
Owner & admin controls
DEFAULT_ADMIN_ROLE (initially the developer address) can grant and revoke roles, replace the MANAGER_ROLE holder via updateManager, and reclaim SuperDCA token ownership via returnSuperDCATokenOwnership. MANAGER_ROLE (also initially the developer) can change mintRate, internalFee and externalFee, and mark or unmark addresses as internal. No pause mechanism and no upgrade proxy were found.

Enabled Uniswap v4 callbacks

beforeInitialize, afterInitialize, beforeAddLiquidity, beforeRemoveLiquidity, beforeSwap

beforeInitialize: reverts unless the pool includes the SuperDCA token. afterInitialize: reverts unless the pool uses a dynamic fee. beforeAddLiquidity and beforeRemoveLiquidity: trigger reward index update, minting, donation and settlement. beforeSwap: returns the per-swap dynamic fee based on the internal address registry. No return-delta permissions are enabled.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: The developer-controlled DEFAULT_ADMIN_ROLE and MANAGER_ROLE can set the external fee up to the uint24 maximum, which is capped by the v4 dynamic fee validity limit, and can set the mint rate to arbitrarily high values, inflating the SuperDCA supply that is minted into the pool manager and donated. Managers can also flag any address as internal to receive zero-fee swaps. The hook also has ownership of the SuperDCA token and can transfer it back to the admin, and the token's mint function is gated by that ownership.

Risk to user funds: Users' staked SuperDCA is held by the hook and withdrawable via unstake, with no admin seizure path visible. Swappers and LPs are exposed to fee and mint-rate changes made by privileged roles, and LP positions are indirectly exposed to donated reward amounts that the manager can inflate.

Security findings

  • [high] Unbounded mint rate controlled by manager: A manager can raise the mintRate without limit, causing large amounts of SuperDCA to be minted to the developer and the PoolManager, diluting holders and donating inflated rewards.
  • [medium] Manager can change fees and fee exemptions instantly: A manager can set externalFee arbitrarily and flag addresses as internal, changing swap pricing for all users at will.
  • [medium] Reward distribution depends on token mint permission and external calls: Minting to the developer and donation to the pool happen inside liquidity hooks; failed mints are silently ignored and the settle call relies on the pool manager state, so reward accounting depends on the token's mint permissions.
  • [medium] Single-key centralization: Access is governed by a single developer-held admin key with no timelock, pause or multisig requirement visible in the source.
  • [info] Hook holds token mint authority: The hook can mint SuperDCA tokens, a permission held through token ownership, which is a privileged trust assumption rather than a funds-custody risk.

Contract details

Verified source
Yes (SuperDCAGauge)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
17,720 bytes
Upgradeable proxy
No
Detected patterns
donates, dynamic-fee, erc20, moves-currency, ownable, rewards

Pools using SuperDCAGauge