Likely custom pricing hook on Arbitrum

Uniswap v4 Hook Contract 0xcf1b5c613c3d0ca99a4588d60147893cff2d0088 on Arbitrum · Custom pricing

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
48
Swaps (24h)
0 (0 traders)
Total swaps
28

What it does

A Uniswap v4 hook with an owner-controlled pause switch and per-pool fee settings that runs logic before each swap and can adjust swap deltas, apparently serving a market or Morpho-related integration.

How it works step by step

  • Runs a beforeSwap callback that checks a global paused flag and can alter the swap through a return delta
  • Stores a pool registry with a per-pool fee (setPoolFee selector 0xf8f5ae94 writes a mapping keyed by pool id)
  • Holds a market registry keyed by a computed market id (computeMarketId and isMarketInitialized selectors), suggesting lending-market or Morpho-linked state
  • Exposes an execute(address,uint256,bytes) function that forwards arbitrary calls, which could be used to interact with other contracts on behalf of the hook
  • Includes an owner-only setter for the owner address and a setPaused control
  • Has a pool-manager and Morpho reference exposed through view getters
Swap behaviour
beforeSwap is implemented and reads the paused flag; when the hook is paused it is expected to reject or bypass swaps. Because beforeSwapReturnDelta is enabled, the hook can return a delta that changes the amounts settled for the swap, so it may take or supply tokens during swaps. The exact logic cannot be confirmed without source.
Liquidity behaviour
beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity and afterRemoveLiquidity selectors are present in the dispatch table, but these callbacks are not enabled in the hook permissions, so the pool manager will not invoke them.
Fee behaviour
A per-pool fee is stored and set through setPoolFee(bytes32,uint24), and a setter for a uint24 value is also present. Whether this fee is applied via the swap return path or the LP fee override cannot be confirmed from bytecode alone.
Owner & admin controls
The owner (storage slot 0) can change the owner, pause and unpause the hook, set per-pool fees, and call execute to make arbitrary external calls. The contract appears to have no timelock, and no upgrade proxy pattern is evident in the dispatch table.

Enabled Uniswap v4 callbacks

beforeSwap, beforeSwapReturnDelta

beforeSwap: runs pause checks and per-pool logic before each swap. beforeSwapReturnDelta: lets the hook return a delta that alters the amounts exchanged in the swap.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: A single owner key controls pausing, per-pool fees, ownership transfer and arbitrary external calls via execute, so compromise of that key could halt trading or drain any assets the hook controls.

Risk to user funds: The hook can alter swap deltas and call external contracts with the owner's privilege; whether it holds pool or user funds directly cannot be determined from bytecode, but execute and return-delta together give it a path to move value.

Security findings

  • [medium] Owner can pause all swaps: setPaused(bool) is owner-only and beforeSwap reads the paused flag, so the owner can halt swaps for this hook's pools at will.
  • [medium] Owner can set arbitrary pool fees: setPoolFee(bytes32,uint24) lets the owner set the fee for any pool id with no visible bound in the decoded selectors, which could be used to set a punitive fee on traders.
  • [high] Arbitrary execute capability: execute(address,uint256,bytes) lets the owner make arbitrary calls with the contract's authority, which could move tokens or interact with any approved contracts if the hook holds funds or approvals.
  • [medium] Return-delta swap manipulation: beforeSwapReturnDelta allows the hook to alter swap settlement amounts; a privileged or buggy path could shift value between traders and the pool.
  • [info] Source not verified: No verified source is available, so the exact conditions for the return delta, fee bounds and access checks on execute cannot be confirmed.

Contract details

Verified source
No
Bytecode size
21,990 bytes
Upgradeable proxy
No
Detected patterns
pausable, return-delta

Pools using Likely custom pricing hook