Sherwood on Robinhood Chain

Uniswap v4 Hook Contract 0x0c9ddd9e45817252d56f70ec015a4e828212a0cc on Robinhood Chain · Rewards · Verified contract

Volume (24h)
$866
Value locked (TVL)
$637
All-time volume
$4.22K
Pools using this hook
1
Swaps (24h)
32 (11 traders)
Total swaps
238

What it does

Sherwood is a daily leaderboard game on an ETH/PFWA Uniswap v4 pool where buys score points, a 5% fee on swaps funds a daily prize pot, and the top three players share winnings.

How it works step by step

  • Charges a 5% fee on every ETH swap and routes it into the day's prize pot via beforeSwap and afterSwap return deltas.
  • Awards points per 0.001 ETH of buys (capped at 100 per buy), with a holder bonus and welcome/referral bonuses.
  • Lets buyers pick a move: STEAL takes a share of the previous player's points, ROBIN_HOOD takes from the leader for the lowest recent player, and FLIP requests Dice randomness for a double-or-lose outcome.
  • Wipes a seller's positive points for the day, so selling forfeits the game position.
  • After the day ends, anyone can settle: top three split 50/20/10% of the pot (claimable within 7 days if still holding the bought PFWA), 10% goes to a buyback-and-burn reserve, and the rest rolls into the next day.
  • Pays referral rewards from the rollover and points from the referred player's buys, with a 5% prize share for referrers who also played.
Swap behaviour
Buys (ETH in) are charged a 5% pot fee and, if at least 0.001 ETH, score points and optionally trigger a move (STEAL, ROBIN_HOOD or a Dice-randomized FLIP). Sells (PFWA in) are charged a 5% fee on the ETH out, and the seller's positive points are wiped. Exact-output swaps and partial fills of buys are rejected.
Liquidity behaviour
No liquidity callbacks. Liquidity add/remove hooks are unimplemented and revert with HookNotImplemented.
Fee behaviour
Every exact-input ETH buy takes 5% (FEE_BPS 500) of the ETH side via poolManager.take into the day's pot through beforeSwap return delta. Every sell takes 5% of the ETH paid out in afterSwap via afterSwapReturnDelta. Fees are not shared with LPs; they fund the daily pot, 10% buyback and burn, and rollover.
Owner & admin controls
Owner (initially the deployer) can set a new owner and a new operator; the operator can run buybacks and Dice refunds. The owner can create the single ETH/PFWA pool only once (beforeInitialize) and set the buyback pool only once (setBuybackPool). There is no pause, no upgrade proxy, and no fee or parameter setter; game constants are immutable.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

beforeInitialize: restricts pool creation to the owner and validates the pool is ETH/PFWA. beforeSwap: takes the 5% pot fee on buys, scores points and resolves moves (BUY, STEAL, ROBIN_HOOD, FLIP) using tx.origin as the player, and reverts on exact-output or wrong pool. afterSwap: on sells takes the pot fee, wipes the seller's positive points, and on buys requires full fill and records $PFWA bought for holder-bonus and prize-eligibility tracking. beforeSwapReturnDelta and afterSwapReturnDelta: used so the hook can take ETH fees out of the swap.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: The owner can set a new owner and operator but cannot touch pot balances, claims, or user points directly. The operator can call buybackAndBurn (only from buybackReserve, to the configured pool, with minPfwaOut slippage) and refundDiceRequest. A malicious owner could replace the owner and operator, but the buyback reserve can only be spent through the one configured pool, and the buyback pool is set once. Owner can also create the pool, which is one-time.

Risk to user funds: The hook holds all accumulated pot ETH and buyback reserve ETH, and takes 5% of every ETH swap on the pool into its accounting. Users can lose prize eligibility by selling, and funds sent to the hook directly become pot. The owner/operator cannot withdraw pot ETH to themselves; buybacks burn PFWA to the dead address.

Security findings

  • [info] Player identity uses tx.origin: Players are identified by tx.origin, so smart-contract wallets and routers relaying for users are credited to the EOA rather than the router, and contracts calling the hook directly via tx.origin cannot be the player.
  • [low] External randomness dependency for flips: A flip loss debits the player's points and can push them below zero; a flip's Dice fee is paid out of the day's pot, and an unrevealed flip scores as a plain buy after FLIP_TIMEOUT. If Dice fails, the move falls back to BUY so swaps are not blocked.
  • [medium] Prize forfeiture on sell: Settlement and claims depend on the holder's current PFWA balance; winners who sell below their held amount forfeit proportionally, and unclaimed prizes are swept into a future pot after the claim window. This is by design but can surprise winners.
  • [low] Hook custody of pot ETH: Pot funding (fees, seeding) is held as ETH accounting in the hook; ETH sent directly to the hook goes into today's pot, and the hook holds all pot ETH until claim or sweep. A bug in the accounting would affect pot funds, but no owner withdrawal path for pot ETH exists.

Contract details

Verified source
Yes (Sherwood)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
17,738 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, return-delta, rewards, self-unlock, tax

Pools using Sherwood