Likely custom pricing hook on Avalanche

Uniswap v4 Hook Contract 0xd2e2f5215b3b6c85b9ef3068f44075d5f6201088 on Avalanche · Custom pricing

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
75
Swaps (24h)
0 (0 traders)
Total swaps
12

What it does

An owner-managed hook that registers pools on initialization and, on each swap, uses a beforeSwap return delta to take over swap pricing for registered pools, with the owner setting per-pool fees.

How it works step by step

  • On pool initialization, afterInitialize records the pool in internal registries (a mapping, a pool list and a pool count exposed via getPoolCount and allPools).
  • beforeSwap reads the pool registry and an address-flag mapping, and uses the beforeSwapReturnDelta permission, so it can take over part or all of a swap's accounting.
  • The owner can set a per-pool fee through setPoolFee(bytes32,uint24).
  • The owner can transfer ownership with setOwner and run arbitrary external calls with execute(address,uint256,bytes).
  • It exposes unlockCallback, so it can interact with the PoolManager directly (for example to settle or take tokens) outside of a user's swap.
Swap behaviour
beforeSwap is nonpayable, reads the pool registry and an address-allowlist mapping, and can return a delta, so it can override the swap rather than just observe it. The exact pricing logic cannot be determined from the decoded bytecode.
Liquidity behaviour
No liquidity callbacks are enabled in the permissions. The beforeAddLiquidity and beforeRemoveLiquidity functions appear in the dispatch table but only as view stubs, and the permission bits are not set.
Fee behaviour
Fees are stored per pool and the owner can change them with setPoolFee. A default fee value held in the owner storage slot can be changed by a separate uint24 setter (selector 0xbefa61d5). How the fee is applied during swaps, and whether the hook keeps any of it, cannot be confirmed from the bytecode.
Owner & admin controls
A single owner (stored in slot 0) can transfer ownership via setOwner, set per-pool fees via setPoolFee, change a default fee value via an unnamed uint24 setter, change an address stored in slot 5 via an unnamed setter, and call any address with any calldata and value via execute. No pause, timelock or multisig logic was identified.

Enabled Uniswap v4 callbacks

afterInitialize, beforeSwap, beforeSwapReturnDelta

afterInitialize registers new pools and stores their configuration. beforeSwap runs custom logic before each swap, and beforeSwapReturnDelta lets that logic return a delta that changes the amounts the swapper pays or receives.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, low confidence).

Who controls it: The owner can change pool fees, change configuration addresses, hand control to another address, and execute arbitrary calls from the hook's address. This gives broad control over any assets or permissions the hook holds.

Risk to user funds: The hook is designed to alter swap amounts through return deltas and has an unlockCallback, so it can take or settle tokens with the PoolManager during swaps. It does not enable liquidity callbacks, so LP positions are not directly intercepted. Whether it holds balances between transactions cannot be determined, but if it does, the owner's execute function could move them.

Security findings

  • [high] Arbitrary call by owner: execute(address,uint256,bytes) is nonpayable and gated by the owner slot, so the owner can make the hook call any contract with any data. Any tokens or approvals held by the hook could be moved this way.
  • [medium] Swap accounting taken over via return delta: beforeSwap together with beforeSwapReturnDelta lets the hook change what swappers pay or receive. Without source, the pricing logic and any hook-retained amount cannot be verified.
  • [medium] Owner-controlled per-pool fee: setPoolFee takes a bytes32 pool id and uint24 fee and is owner-only. No cap was visible in the decoded output, so the owner may be able to set very high fees.
  • [low] Single EOA-style owner with transferable ownership: setOwner changes ownership instantly with no two-step process or timelock visible, so a compromised key gives full control.
  • [info] Unverified source: No verified source is available, so the unnamed functions (0x0aa87769, 0x8ec6cd0d, 0xbfd3da96, 0xbefa61d5) and the nine consecutive storage slots read by 0xa7d6d0a0 could not be named or reviewed.

Contract details

Verified source
No
Bytecode size
14,739 bytes
Upgradeable proxy
No
Detected patterns
return-delta

Pools using Likely custom pricing hook