BunniHook on Unichain

Uniswap v4 Hook Contract 0x005af73a245d8171a0550ffae2631f12cc211888 on Unichain · Auction · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
4
Swaps (24h)
0 (0 traders)
Total swaps
27,144

What it does

BunniHook is the Uniswap v4 hook behind Bunni pools that adjusts swap fees dynamically, runs auto-rebalancing via FloodPlain orders, and lets am-AMM bidders capture swap fees.

How it works step by step

  • Computes dynamic swap fees with surge pricing based on oracle state and vault share price changes
  • Runs auto-rebalancing by creating FloodPlain rebalance orders with the owner-set FloodZone
  • Routes an am-AMM auction so bidders can set swap fees and receive those fees
  • Takes protocol hook fees configured by the owner and claimable to a fee recipient
  • Blocks LP withdrawals while a rebalance order is active unless the owner unblocks them
  • Maintains a TWAP oracle with cardinality management for each pool
Swap behaviour
beforeSwap computes the dynamic fee with surge logic, may accrue am-AMM fees to the manager, and returns a delta so the hook can settle against BunniHub balances.
Liquidity behaviour
beforeAddLiquidity is listed as a permission, but the hook source does not define a callback for it in BunniHook; liquidity is managed through BunniHub. The hook recomputes idle balances after rebalance orders and tracks pool balances through the PoolManager claim tokens. Withdrawals are blocked via canWithdraw while a rebalance order is active unless the owner unblocks them.
Fee behaviour
Swap fees are computed by the hub's dynamic fee logic with surge fees. An am-AMM manager can set swap fees up to maxAmAmmFee and accrue those fees to the manager. A protocol hook fee of 10% to 50% of the swap fee, set by the owner, is taken to the hook fee recipient and can be claimed via claimProtocolFees.
Owner & admin controls
Owner (single owner via Solady-style Ownable with 2-step handover) can set the zone via setZone, set the withdrawal unblock flag per pool via setWithdrawalUnblocked, schedule a higher K for am-AMM via scheduleKChange, and set hook fee and referral reward modifiers via setModifiers once a fee recipient exists. The hook fee recipient is set once by the hookFeeRecipientController, or by the owner after 180 days from deployment. Owner can also transfer or renounce ownership.

Enabled Uniswap v4 callbacks

afterInitialize, beforeAddLiquidity, beforeSwap, beforeSwapReturnDelta

afterInitialize: initializes oracle and pool state for the pool via BunniHookLogic. beforeSwap: computes dynamic fee, surge, rebalance triggering and am-AMM fee accrual. beforeSwapReturnDelta: lets the hook return a delta so it can settle swaps against BunniHub balances and rebalance order outputs. beforeAddLiquidity: enabled in permissions, no dedicated logic found in the BunniHook source reviewed.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: The owner can change the zone that rebalance orders use, unblock withdrawals for any pool at will, raise the K parameter for am-AMM after a scheduled delay, and set the hook fee recipient through the owner route after 180 days. The fee recipient controller can set the recipient permanently. Owner cannot directly drain user funds from the hook based on the reviewed code.

Risk to user funds: The hook holds PoolManager claim tokens and rebalance balances and can pull and push tokens through BunniHub during rebalances and fee claims. Owner-set parameters (zone, withdrawal unblock) can affect whether LP funds can be withdrawn and how rebalance orders execute, but the reviewed code does not show direct owner withdrawal of user funds.

Security findings

  • [medium] Owner can unblock withdrawals: Owner can call setWithdrawalUnblocked to override the rebalance-order withdrawal block for any pool, which changes when LP withdrawals are possible.
  • [medium] Owner-set zone used in rebalance orders: Owner controls the FloodZone address used in rebalance orders via setZone, so a malicious zone could influence rebalance execution and output.
  • [low] Hook holds and routes fee balances: Hook takes protocol fees and am-AMM fees via poolManager balances and return deltas; fee recipient is set once and cannot be changed after being set, but the owner path to set it exists after 180 days.
  • [info] beforeAddLiquidity flag without visible logic: Permissions list beforeAddLiquidity but no matching hook callback logic was found in the reviewed BunniHook source, so the flag may be a benign mismatch to review.
  • [info] Non-upgradeable contract: Upgradeability is not present in the verified source; the contract is not a proxy, so logic cannot be changed post-deployment.

Contract details

Verified source
Yes (BunniHook)
Compiler
solc 0.8.25+commit.b61c2a91
Bytecode size
23,329 bytes
Upgradeable proxy
No
Detected patterns
auction, liquidity-management, oracle, ownable, return-delta

Pools using BunniHook