Spot on Robinhood Chain

Uniswap v4 Hook Contract 0x0f927005fc00089d51c11746dcbb42a5e151d0cc on Robinhood Chain · Dynamic fee · Verified contract

Volume (24h)
$0
Value locked (TVL)
<$0.01
All-time volume
$284.33K
Pools using this hook
52
Swaps (24h)
0 (0 traders)
Total swaps
6,145

What it does

A Spot pool hook that sets a dynamic swap fee from oracle volatility with surge pricing after cap events, and collects a protocol fee that is reinvested into a full-range liquidity position managed by the owner.

How it works step by step

  • Enforces that only dynamic-fee pools can be initialized and sets up per-pool policy, oracle and fee state on afterInitialize.
  • Computes a dynamic swap fee each swap as base fee (oracle tick movement times a factor, clamped) plus a linearly decaying surge fee after cap events.
  • Records a pre-swap tick observation in a TruncGeo oracle and tracks whether tick movement exceeded the cap per swap or per block.
  • Takes a configurable protocol share of swap fees using before/after swap return deltas and mints ERC6909 claims to the liquidity manager.
  • Attempts to reinvest accumulated protocol fees into a full-range Uniswap v4 position after each swap when price is near the TWAP, unless reinvestment is paused.
Swap behaviour
beforeSwap sets a dynamic fee override (base plus surge, or a manual fee), records an oracle observation, and for exact-input swaps takes the protocol fee as a return delta; afterSwap updates oracle cap state, takes the protocol fee for exact-output swaps, and attempts reinvestment.
Liquidity behaviour
No liquidity callbacks. Liquidity is managed by the separate FullRangeLiquidityManager, which holds a full-range Uniswap v4 position and accumulates protocol fees that are reinvested into that position during afterSwap when price is within a TWAP tolerance.
Fee behaviour
Each pool's swap fee is set in beforeSwap as a dynamic fee override equal to base fee plus surge fee, where base fee is derived from oracle tick movement times a configurable factor and clamped by min/max, and surge fee decays linearly after oracle cap events. A manual fee can override this. A protocol share (POL share) of the input amount is minted as ERC6909 claims to the liquidity manager, and is also deducted via beforeSwap or afterSwap return delta.
Owner & admin controls
Owner of PoolPolicyManager (policyOwner) can set reinvestment pause via setReinvestmentPaused, set pool POL share up to a very large cap, set manual fee overrides per pool, adjust dynamic fee bounds and surge parameters, and call withdrawFromFRLM/depositToFRLM through Spot. FullRangeLiquidityManager owner-gated functions include withdrawProtocolLiquidity and sweepExcessERC6909 and sweepExcessTokens; the source also contains owner-only helper functions withdrawAllMyTokens and withdrawMyNft that transfer any token or NFT held by the liquidity manager to a hardcoded address. No proxy or upgrade mechanism is present in the verified source.

Enabled Uniswap v4 callbacks

afterInitialize, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

afterInitialize: enforces dynamic fee pools only, initializes policy, oracle and dynamic fee state for the pool. beforeSwap: sets dynamic fee override, records oracle observation, and takes protocol fee for exact-input swaps via return delta. afterSwap: updates oracle cap frequency and dynamic fee manager, takes protocol fee for exact-output swaps via return delta, and attempts reinvestment of accrued fees. beforeSwapReturnDelta and afterSwapReturnDelta: allow the hook to take a share of swap amounts as protocol fees.

Security & trust assessment

Risk level: high (verified source, high confidence).

Who controls it: The policy owner can set manual fees up to 10 percent per pool, change dynamic fee bounds and surge multiplier, set a POL share that may exceed 100 percent of the fee (up to about 4444x), pause reinvestment, and withdraw protocol-owned liquidity or sweep tokens. Owner-only helper functions in FullRangeLiquidityManager can transfer any ERC20 or NFT balance the contract holds to a single hardcoded EOA, which is a rug vector for protocol-held assets.

Risk to user funds: The hook takes a protocol fee of the swap input or output via return deltas and mints ERC6909 claims to the liquidity manager, so user swap amounts are directly reduced. The liquidity manager holds the pool's full-range position and pending fees, and the owner can withdraw protocol liquidity, sweep tokens, and drain arbitrary ERC20 or NFT balances through owner-only functions, which can remove funds from the pool.

Security findings

  • [high] Owner backdoor to drain contract-held tokens and NFTs: withdrawAllMyTokens and withdrawMyNft transfer all of a given ERC20 balance or a given NFT from the FullRangeLiquidityManager to a hardcoded address, gated only by msg.sender equality with that same address.
  • [high] Unbounded protocol fee share can exceed swap amounts: setPoolPOLShare accepts values up to 4444000111 PPM, meaning the protocol fee can exceed the swap fee and the POL take can be far larger than intended, potentially leaving swappers with a negative net amount.
  • [medium] Owner can change swap fees instantly: The policy owner can set reinvestment paused and manual fees at any time; manual fees are capped at 10 percent, and the owner can change the fee used on any pool instantly.
  • [medium] Owner sweeps of accounted liquidity: sweepExcessTokens and sweepExcessERC6909 let the owner withdraw balances above accounting or all ERC6909 claims held by the liquidity manager, which can include protocol fees owed to pool liquidity.
  • [info] Non-blocking external calls: The hook uses try/catch around oracle and fee manager calls and reinvestment, so failures are swallowed and emitted as events rather than reverting swaps.

Contract details

Verified source
Yes (Spot)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
9,452 bytes
Upgradeable proxy
No
Detected patterns
dynamic-fee, oracle, return-delta

Pools using Spot