Custom pricing hook on Avalanche

Uniswap v4 Hook Contract 0xcdf0049105d85b0a32d39d0ea7a99818733d80c0 on Avalanche · Custom pricing

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0.10
Pools using this hook
127
Swaps (24h)
0 (0 traders)
Total swaps
1

What it does

A Uniswap v4 hook on Avalanche that gates pool access through a registry of enabled pools and reserve tokens, and performs swap-time accounting that moves currency between the hook and the pool manager.

How it works step by step

  • Keeps an owner-managed registry of pools that are enabled for the hook, toggled through setPoolEnabled.
  • Maintains a whitelist of reserve tokens via setReserveToken, read when computing token balances.
  • Runs logic in beforeSwap and afterSwap, with per-pool and counter-based storage updated on each swap.
  • Exposes withdrawToken and tokenBalance, indicating the hook holds token balances of its own.
  • Reads pool configuration and position information through getPoolConfig and external position manager calls.
  • Includes route validation and swap execution selectors (validateRoute, swapExactInput), suggesting it routes swaps against its own inventory.
Swap behaviour
beforeSwap and afterSwap are both implemented; beforeSwap checks registry state and afterSwap updates storage and settles currency with the pool manager (take, settle, sync selectors present).
Liquidity behaviour
Liquidity add and remove callbacks are present as view stubs (beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity, afterRemoveLiquidity) and do not appear to modify state; the hook does not enable liquidity callbacks in its permissions.
Fee behaviour
Uses the pool's static fee as far as can be determined; no fee-override selector is decoded and the afterSwap delta return suggests possible currency accounting rather than fee changes.
Owner & admin controls
owner() is exposed and setPoolEnabled, setReserveToken and withdrawToken are nonpayable with no decoded access-control revert shown; the NotOwner error selector is present, suggesting an onlyOwner guard, which could not be confirmed from the decoded bytecode. No upgrade mechanism was identified.

Enabled Uniswap v4 callbacks

beforeSwap, afterSwap

beforeSwap: gates or prepares swaps against the enabled-pool registry and inventory. afterSwap: updates swap accounting and settles currency with the pool manager.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: The owner can enable or disable pools, change reserve token status, and withdraw token balances held by the hook, so a compromised owner key could drain hook inventory and disrupt swaps.

Risk to user funds: The hook can hold and move tokens (tokenBalance and withdrawToken are present) and settles currency during swaps, so user and pool funds that pass through it are exposed to owner actions and to any accounting bugs in swap callbacks.

Security findings

  • [high] Owner can withdraw hook token balances: withdrawToken(address,address,uint256) is nonpayable and the hook tracks tokenBalance, so the owner can likely move inventory the hook holds for pools. The onlyOwner guard is inferred from the NotOwner selector, not verified.
  • [medium] Owner controls pool enablement and reserve tokens: setPoolEnabled and setReserveToken let the owner turn pools on or off for the hook and change which tokens count as reserves, which can block swaps or alter accounting for any pool.
  • [medium] Hook moves currency during swaps: The presence of take, settle and sync selectors alongside afterSwap indicates the hook transfers tokens to and from the pool manager, so its accounting logic directly affects user and pool balances.
  • [medium] Unverified source: No verified source is available, so the exact access checks, arithmetic and failure paths cannot be confirmed from the bytecode alone.
  • [low] Storage mapping writes in afterSwap: afterSwap writes to a uint128 mapping and a uint256 slot, which are likely per-pool counters; overflow or misuse could not be assessed without source.

Contract details

Verified source
No
Bytecode size
13,904 bytes
Upgradeable proxy
No
Detected patterns
moves-currency

Pools using Custom pricing hook