Likely fee sharing hook on MegaETH

Uniswap v4 Hook Contract 0x4111c33c6cd08e0421a813caa570263e984b8044 on MegaETH · Access control

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
2
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

This hook takes a share of swap flows after each trade and routes it toward a configurable treasury, with market registration controlled by a factory address.

This read was written for the hook 0x1a3c…8044 on Robinhood Chain and reused here: the two share a code shape, so constants such as fees, owners and addresses can differ.

How it works step by step

  • Runs afterSwap on every swap to compute a hook share of the trade.
  • Uses afterSwapReturnDelta to adjust the amount settled with the trader.
  • Calls take on the pool manager to move the skimmed tokens out.
  • Forwards proceeds to a treasury address stored in slot 1.
  • Registers markets via registerMarket, gated by a stored factory address.
  • Maintains an inventory tracked through inventoryCount and inVault functions.
Swap behaviour
After each swap the hook runs its afterSwap logic and applies a return delta, taking a portion of the settled amount and sending it through the pool manager toward the treasury.
Liquidity behaviour
beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity, afterRemoveLiquidity, beforeDonate and afterDonate are dispatched but no liquidity-related permission is enabled in the address flags, so these are likely not invoked by the pool manager.
Fee behaviour
The hook uses afterSwap with a return delta and calls take(address,address,uint256) on the pool manager, so it appears to skim a portion of swap output to a treasury address. The exact fee rate could not be determined from the decoded bytecode.
Owner & admin controls
Owner-style setters exist: setFactory(address) writes storage slot 0 and setTreasury(address) writes slot 1, so a privileged key can repoint the factory and the treasury recipient. registerMarket is called from the factory-registered path and writes market records keyed by a mapping in slot 2. No pause or upgrade function was identified.

Enabled Uniswap v4 callbacks

afterSwap, afterSwapReturnDelta

afterSwap: runs after each swap to compute and take the hook's share. afterSwapReturnDelta: lets the hook return a delta that changes the amount settled with the trader, which is how it takes a cut of the swap.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: The treasury key can redirect the skimmed value by calling setTreasury, and the factory key can change the registration source via setFactory. Whoever holds these keys controls where hook proceeds go.

Risk to user funds: The hook can take tokens from swaps via its return delta and appears to hold inventory it can transfer out, so user swap proceeds pass through hook-controlled logic. Privileged setters can redirect proceeds, but no direct withdraw-all function was identified.

Security findings

  • [medium] Hook takes a cut of swaps via return delta: afterSwapReturnDelta lets the hook alter settlement amounts on every swap, so the hook takes tokens out of swap flows on each trade.
  • [medium] Treasury address is changeable by a single key: setTreasury(address) overwrites the treasury recipient in storage slot 1 with no visible timelock or multisig gating in the bytecode.
  • [medium] Factory address controls market registration: setFactory(address) writes slot 0 and gates registerMarket, so a compromised factory key could register arbitrary market entries.
  • [info] Hook holds inventory balances: The bytecode includes an inventoryCount and inVault selector along with EmptyInventory and transfer calls, indicating the hook may hold token inventory it distributes.
  • [info] Unused liquidity callbacks present in bytecode: Several liquidity and donate hook functions are present but their permission flags are off, so they should be unreachable.

Contract details

Verified source
No
Bytecode size
4,421 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, return-delta

Pools using Likely fee sharing hook