Likely access control hook on Polygon

Uniswap v4 Hook Contract 0x1b332b7583b2e3a85c80efffb47f6395721a88c0 on Polygon · Access control

Volume (24h)
$0.10
Value locked (TVL)
$100
All-time volume
$74.73K
Pools using this hook
1
Swaps (24h)
1 (1 traders)
Total swaps
134

What it does

A Polygon hook that gates liquidity provision with an allowlist and runs custom logic around swaps, likely for USDCE and PUSD on/off-ramp routing, controlled by a single owner.

How it works step by step

  • beforeAddLiquidity rejects liquidity additions from addresses not on the allowlist mapping at slot 1.
  • beforeSwap checks the enabled flag and runs custom routing logic before the swap executes.
  • afterSwap performs post-swap settlement, likely using take, settle, wrap or unwrap to move tokens.
  • The owner can toggle the hook on or off, manage the allowlist, and sweep tokens out of the contract.
  • Constants USDCE, PUSD, ONRAMP and OFFRAMP indicate the hook handles USDC.e to PUSD conversion for on/off-ramp flows.
Swap behaviour
beforeSwap and afterSwap run custom logic that can take, settle, wrap or unwrap currency through the pool manager, gated by the enabled flag.
Liquidity behaviour
beforeAddLiquidity checks a per-address allowlist (mapping at slot 1) so only approved addresses can add liquidity. No remove-liquidity hooks are enabled.
Fee behaviour
Uses the pool's static fee; the hook exposes a poolFee view but no dynamic fee override is in the permissions.
Owner & admin controls
Owner (slot 0 address) can call setEnabled to toggle the hook on or off, setLiquidityAllowed to whitelist addresses for adding liquidity, sweep to move tokens out of the hook, refreshApprovals, and transferOwnership. No upgrade proxy or pause timelock was identified.

Enabled Uniswap v4 callbacks

beforeAddLiquidity, beforeSwap, afterSwap

beforeAddLiquidity gates liquidity provision against the allowlist; beforeSwap and afterSwap run custom logic around swaps, gated by the enabled flag and likely used for on-ramp/off-ramp (USDCE, PUSD, ONRAMP, OFFRAMP) routing.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, medium confidence).

Who controls it: The owner can disable the hook, whitelist or change who may add liquidity, sweep tokens held by the hook, and transfer ownership to any address; a compromised key could drain balances held by the contract or redirect flows.

Risk to user funds: The hook holds and moves tokens via take, settle, wrap and unwrap during swaps and can sweep balances to the owner, so user funds routed through it depend on the owner key's integrity.

Security findings

  • [medium] Owner can sweep hook-held tokens: The sweep function, callable by the owner, transfers arbitrary token balances out of the hook contract.
  • [low] Owner can toggle hook behaviour: setEnabled lets the owner switch off the hook's swap logic, changing swap behaviour for all pool users.
  • [low] Single-key ownership: Ownership is a single address with transferOwnership and no evident two-step transfer or timelock.
  • [info] Hook moves currency during callbacks: The hook makes take, settle, wrap, unwrap and modifyLiquidity calls, so it can move pool-manager funds during swap callbacks.

Contract details

Verified source
No
Bytecode size
11,596 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, ownable

Pools using Likely access control hook