Likely custom pricing hook on Optimism

Uniswap v4 Hook Contract 0x987105e95645d39ad967c8698478e17861271088 on Optimism · Custom pricing

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
91
Swaps (24h)
0 (0 traders)
Total swaps
3

What it does

An owner-managed hook that tracks pools it is initialized for, takes over swap handling through a beforeSwap return delta, and lets the owner set per-pool fees and run arbitrary calls.

How it works step by step

  • Registers each pool at afterInitialize, storing pool data in a mapping and an array. The decoded getters allPools(uint256), pools(bytes32) and getPoolCount() expose these records.
  • Uses beforeSwap with a return delta, so it can take over or change swap amounts instead of just observing them. Decoded storage shows beforeSwap reading the pool mapping and an address-to-bool mapping, but the exact logic cannot be seen.
  • Exposes setPoolFee(bytes32,uint24), which only the owner can call, so fees can be changed per pool after launch.
  • Has an unlockCallback, so the hook itself interacts with the pool manager inside unlock sessions to move tokens.
  • Includes an owner-only execute(address,uint256,bytes) that makes an arbitrary external call. Another owner-only function writes an address to storage slot 5, and setOwner transfers ownership.
Swap behaviour
beforeSwap is non-view and reads the pool registry and an address allowlist-style mapping. Because beforeSwapReturnDelta is enabled, the hook can return a delta that replaces part or all of the swap's normal AMM execution. The exact pricing and routing logic cannot be determined from the decoded bytecode.
Liquidity behaviour
No liquidity callbacks are enabled. The liquidity functions in the ABI are interface stubs the hook does not use.
Fee behaviour
The hook keeps per-pool fee configuration, and the owner can change it with setPoolFee(bytes32,uint24). A default fee value is stored next to the owner in slot 0 and set by an owner function (selector 0xbefa61d5). How fees are applied or taken in beforeSwap is not visible in the decoded output.
Owner & admin controls
A single owner (stored in slot 0, with setOwner and owner()) can change the owner, set per-pool fees via setPoolFee, change the default fee via selector 0xbefa61d5, write an address to slot 5 via selector 0xbfd3da96, and run arbitrary external calls via execute. Other owner-gated functions with unknown purpose also exist (0x0aa87769, 0x8ec6cd0d). No pause or timelock was found, and nothing indicates a proxy.

Enabled Uniswap v4 callbacks

afterInitialize, beforeSwap, beforeSwapReturnDelta

afterInitialize records the new pool in the hook's pool registry and stores per-pool configuration. beforeSwap runs custom swap logic before the AMM executes. beforeSwapReturnDelta lets that logic return a delta so the hook can take or settle currency amounts on the swap.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, low confidence).

Who controls it: The owner can change fees, execute arbitrary calls from the hook, rewrite configuration addresses, and hand ownership to anyone. Users must trust this key and the unverified swap logic.

Risk to user funds: The hook can hold and move tokens through its unlockCallback, its beforeSwap return delta, and the owner's execute function. Any balances or approvals held by the hook are exposed to the owner. Swaps could also be affected by hook logic, though no explicit pause was found. Pool liquidity itself is held in the pool manager and is not touched by liquidity callbacks.

Security findings

  • [high] Arbitrary call by owner: execute(address,uint256,bytes) is owner-gated and forwards a call to any address with any value and calldata. The owner could use it to move any tokens or ETH the hook holds or has approved.
  • [medium] Swap return delta: beforeSwapReturnDelta is enabled, so the hook can alter swap amounts and take or redirect tokens. The decoded bytecode does not show whether this is bounded, so swapper outcomes depend on unverified logic.
  • [medium] Owner-controlled fees: setPoolFee(bytes32,uint24) and a default-fee setter are owner-only. No cap is visible in the decoded output, so the owner could raise fees sharply on registered pools.
  • [medium] Unverified source: No verified source is available, and the contract is large at 14739 bytes with several unnamed functions. Behaviour is inferred only from selectors and storage layout.
  • [low] Single EOA-style owner: Ownership uses a simple setOwner pattern in slot 0 with no two-step transfer or timelock, so a compromised or mistaken owner change is immediately effective.

Contract details

Verified source
No
Bytecode size
14,739 bytes
Upgradeable proxy
No
Detected patterns
return-delta

Pools using Likely custom pricing hook