Likely oracle hook on Avalanche

Uniswap v4 Hook Contract 0x2bafe07145bb012dc1cf66d8de1c1d3973444040 on Avalanche · Oracle

Volume (24h)
$0
Value locked (TVL)
<$0.01
All-time volume
$12.36K
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
306

What it does

A post-swap hook that, after each swap, performs currency movements and position bookkeeping through the PoolManager, with owner-controlled state; exact behaviour could not be fully verified without source.

How it works step by step

  • Runs an afterSwap callback after each pool swap
  • Calls PoolManager unlock with a self-unlock pattern to batch currency actions
  • Uses take and ERC20 transfer/transferFrom to move currency settled by the hook
  • Maintains stored position and config state read by getPositions and getConfig
  • Exposes an owner() getter, indicating an owner-controlled configuration
Swap behaviour
afterSwap executes after every swap and can move currency via the PoolManager unlock/take/transfer path; it does not change swap pricing or block swaps.
Liquidity behaviour
No liquidity callbacks are enabled in the hook permissions; the hook's own nonpayable functions appear to manage stored position data (slots 3-9) and the contract calls unlock() and take()/transfer, indicating it manages its own liquidity positions through the PoolManager.
Fee behaviour
Not determinable from decoded bytecode; afterSwap writes no fee state and the hook returns no fee override, so the pool's fee is presumed static.
Owner & admin controls
An owner() getter exists and the contract stores positions for an owner-controlled set (entrypoints 0x604a57e1, 0xaf8c72ad, 0xeb0b7605, 0xf243b5d0 are nonpayable and write to storage slots 0-5), but no pause, upgrade or fee-setting function was identified with certainty from the decoded selectors.

Enabled Uniswap v4 callbacks

afterSwap

afterSwap is the only enabled callback; it runs after each swap to perform a follow-up action in the pool, most likely moving currency via the PoolManager unlock/take/transfer path.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: An owner-set address appears to control the stored position and config state; the privileged key may be able to alter positions or redirect movements of pool currency, though exact capabilities could not be confirmed.

Risk to user funds: The hook can hold and move currency through the PoolManager (unlock, take, transfer), so funds it custodies or routes after swaps are at risk if its owner-controlled logic is malicious or buggy.

Security findings

  • [medium] Hook moves pool currency: The hook calls unlock, take and transfer/transferFrom selectors, so it can move currency held for the pool during afterSwap.
  • [info] Post-swap only hook: Only afterSwap is enabled, so the hook can react to swaps but cannot block them; swap execution itself is not gated by it.
  • [medium] Privileged state writes unverified: Storage writes to the owner and position slots are reachable from several nonpayable functions without a verified access check visible in bytecode.
  • [info] Source not verified: Without verified source, the exact access control on the nonpayable entrypoints could not be confirmed.

Contract details

Verified source
No
Bytecode size
21,154 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, self-unlock

Pools using Likely oracle hook