Likely access control hook on Monad

Uniswap v4 Hook Contract 0x72573fb54fef1f44225c855505705a342b92c040 on Monad · Rewards

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
19

What it does

A Uniswap v4 hook that runs logic after each swap, using a router reference and on-chain pseudo-random state, and is owned by a single Ownable admin.

How it works step by step

  • Runs an afterSwap callback after every swap in its pool.
  • Maintains an on-chain randomSeed and randomCount updated on each afterSwap call.
  • Checks or uses an officialRouter address stored by the owner.
  • Owner can change the official router via setOfficialRouter.
  • Ownership uses a two-step handover pattern (request, complete, cancel).
Swap behaviour
After each swap, afterSwap updates internal random seed and counter state and references the official router; it does not alter the swap amounts or fees.
Liquidity behaviour
No liquidity callbacks are enabled by the hook permissions (only afterSwap). beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity and afterRemoveLiquidity selectors exist in the bytecode but are not active permissions.
Fee behaviour
Hook does not set or take fees in any identified callback; fees follow the pool's configured fee. The afterSwap logic appears to involve a random seed and counter, which may be used for a reward or lottery-style mechanism, but this is not confirmed.
Owner & admin controls
Owner (Ownable-style, two-step ownership handover) can call setOfficialRouter(address) to set the router address used by afterSwap, can transferOwnership, renounceOwnership, and complete ownership handovers. No pausing or upgrade function was identified in the decoded selectors.

Enabled Uniswap v4 callbacks

afterSwap

afterSwap: runs after each swap, updates storage (random seed and counter) and performs logic tied to the official router; no other callbacks are enabled.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: The owner can change the official router address via setOfficialRouter, which may affect which callers are treated as trusted in afterSwap. Ownership can be transferred to any address, so a single key controls these settings.

Risk to user funds: The hook has no liquidity or fee-taking callbacks enabled, so it cannot directly hold pool liquidity through those paths. Its afterSwap logic runs after trades and may move or reference tokens, but the decoded bytecode does not confirm it takes custody of user funds; this could not be fully verified without source.

Security findings

  • [medium] Owner-settable router address: setOfficialRouter(address) lets the owner change the router address that the afterSwap logic relies on, so a malicious or compromised owner could redirect trusted-caller logic.
  • [info] Single owner control: The hook contract uses Ownable with two-step handover and renounce, so ownership control is concentrated in one key.
  • [low] Weak on-chain randomness: Hook logic relies on pseudo-random values derived from on-chain state (randomSeed, randomCount), which can be predictable or influenced by block producers.
  • [info] Token balance interaction unconfirmed: Bytecode contains a token balanceOf call and afterSwap writes state, so the hook may interact with token balances, but the exact flow could not be confirmed without source.

Contract details

Verified source
No
Bytecode size
4,652 bytes
Upgradeable proxy
No
Detected patterns
ownable

Pools using Likely access control hook