Likely oracle hook on Avalanche

Uniswap v4 Hook Contract 0x26026e5b3739a5f554db214859b54436d92a0040 on Avalanche · Access control

Volume (24h)
$0
Value locked (TVL)
<$0.01
All-time volume
$3.81K
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
120

What it does

An unverified afterSwap hook that, from its decoded bytecode, appears to manage positions and move currency via the self-unlock pattern after each swap.

How it works step by step

  • Enables only the afterSwap callback in its permissions bitmap.
  • Uses unlock and unlockCallback to perform PoolManager accounting after swaps.
  • Moves currency with take and transfer calls inside the callback.
  • Stores configuration and position data across slots 0 to 7.
  • Exposes owner and position getters, plus owner-gated state writes via selectors 0xaf8c72ad, 0xd1aae7be, 0xeb0b7605 and 0xf243b5d0.
Swap behaviour
afterSwap runs after each swap and can take or transfer currency through the PoolManager unlock flow; the exact accounting cannot be confirmed without source.
Liquidity behaviour
No liquidity callbacks are enabled. The hook exposes beforeAddLiquidity and afterRemoveLiquidity selectors in its ABI but the permissions bitmap only enables afterSwap, so these are not invoked by the PoolManager.
Fee behaviour
Only afterSwap is enabled. Fee handling is not evident from the decoded selectors; the pool's fee is assumed static unless the afterSwap logic adjusts balances through take or transfer calls.
Owner & admin controls
An owner() getter is present, and writes to storage slots 0 through 4 occur in the state-changing selectors (0xaf8c72ad, 0xd1aae7be, 0xeb0b7605, 0xf243b5d0), which suggests owner-gated configuration or position management, but the access control checks cannot be confirmed from bytecode alone.

Enabled Uniswap v4 callbacks

afterSwap

afterSwap is enabled; its handler (selector 0xb47b2fb1) reads config and position storage and uses the self-unlock pattern (unlock and unlockCallback) with take and transfer calls to move currency.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: An owner address is exposed, and the state-changing selectors write to core storage slots, so the owner key could likely reconfigure the hook's stored parameters and position data, though the exact effect cannot be verified without source.

Risk to user funds: Because afterSwap can take and transfer currency and the hook holds positions in storage, the hook may hold or move tokens tied to swaps and could affect user funds if its owner-controlled state or afterSwap logic is misconfigured or malicious.

Security findings

  • [medium] Unverified source: The hook is not verified, so its logic and access controls cannot be audited against source code.
  • [medium] Hook moves pool currency during afterSwap: The hook calls unlock and unlockCallback and moves currency via take and transfer, so it can hold and move tokens in afterSwap.
  • [medium] Owner-controlled state changes: The contract exposes an owner getter and writes storage slots from configuration selectors, suggesting privileged parameter or position management.
  • [info] Reentrancy guard and safe transfer usage: The contract includes SafeERC20 and reentrancy guard errors, which suggests some hardening against reentrancy and unsafe token transfers.

Contract details

Verified source
No
Bytecode size
18,682 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, self-unlock

Pools using Likely oracle hook