Cinder on Robinhood Chain

Uniswap v4 Hook Contract 0x437ad39facb90c908ca5dfad106baaa45fa9a0cc on Robinhood Chain · Fee sharing · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

Cinder takes a fixed ETH toll of 0.75% to 5% on every swap through its home pool, so every trade pays it, and the collected ETH is held in four keeper-controlled caches that the owner cannot change or pause.

How it works step by step

  • Charges a fixed toll in ETH on every swap through its own home pool, between 0.75% and 5% (tollBps is fixed at smelting time), taken via beforeSwapReturnDelta or afterSwapReturnDelta depending on swap direction and exact-in/exact-out mode.
  • Keeps the collected ETH inside the PoolManager as an ERC-6909 claim minted to the hook, and tracks it in four accounting caches: smelter (80% minus the lodge share), lodge (credits share of the smelter side), mill (10%), and bloomery (remaining ~10% plus rounding dust).
  • Lets each cache's keeper (smelter, lodge, mill, or furnaceman) call empty() to burn the matching claim and withdraw the ETH to their own address.
  • Hard-codes the home pool: beforeInitialize only accepts one initialisation from the Bloomery with native ETH as currency0, the coin as currency1, fee 0 and tick spacing 1; beforeSwap and afterSwap revert for any other pool.
  • Mints a fixed supply of one billion coins to the Bloomery at deployment and renounces ownership in the constructor, so owner() returns zero.
  • Reverts every liquidity and donate callback (afterInitialize, before/after add, remove and donate), so liquidity can only enter and leave through the standard pool logic.
Swap behaviour
Every swap in the home pool pays a toll in ETH. For buys with exact ETH in, the toll is taken from the ETH sent before the pool sees it. For sells with exact ETH out, the pool is asked for a grossed-up ETH amount and the toll is the difference. For buys with exact coins out and sells with exact coins in, the toll is calculated in afterSwap on the ETH actually moved and must match the fill exactly or the swap reverts with PartialFill.
Liquidity behaviour
All liquidity callbacks revert with NotWired. Liquidity can still be added or removed through the PoolManager's standard path, but the hook does not take any part in it.
Fee behaviour
The pool's own fee is 0. The hook charges its toll through return deltas at tollBps (75 to 500 basis points, fixed at deployment). The collected ETH is stashed across the four caches: about 80% to the smelter side (split between smelter and lodge by creditsBps), about 10% to the mill, and the remainder to the bloomery.
Owner & admin controls
No owner (ownership renounced in the constructor). The keepers of each cache can withdraw their own cache balance by calling empty(). Nobody can pause swaps, change the toll, change the cache addresses, or upgrade the contract; all addresses and rates are immutable.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

beforeInitialize restricts the home pool to a single initialisation from the Bloomery with the canonical key. beforeSwap computes the toll for exact-in buys and exact-out sells and returns it as a before-swap delta. afterSwap computes the toll for exact-out buys and exact-in sells from the actual ETH moved and returns it as an after-swap delta. beforeSwapReturnDelta and afterSwapReturnDelta are enabled because the hook takes a share of the swap amounts.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: The four cache keepers (smelter, lodge, mill, furnaceman) fixed at deployment can each withdraw the ETH stashed in their own cache at any time. No single key can change the toll, pause swaps or alter the pool configuration.

Risk to user funds: The hook holds ETH claims in the PoolManager from collected tolls and can release them only through empty() by the matching keeper. It takes a share of each swap via return deltas and can revert a swap with PartialFill, but it cannot move coin or LP balances held by users outside the toll mechanism.

Security findings

  • [info] Hook takes a fee through return deltas: beforeSwap and afterSwap return deltas that reduce the amounts the trader receives or pays by tollBps (75 to 500 bps), so every swap through the home pool costs the trader more than the pool's quoted price.
  • [medium] Swaps revert on partial fills: afterSwap reverts with PartialFill if the ETH actually moved differs from the amount expected after the toll, so a swap that does not fill completely fails instead of partially filling.
  • [medium] Keepers control withdrawal of stashed ETH: Each cache's keeper can call empty() at any time to withdraw that cache's full balance, and the keepers are fixed at deployment, so the toll is accessible only to those four addresses.
  • [info] Liquidity and donate paths disabled: All liquidity-related and donate hook callbacks revert with NotWired, so the hook cannot add or block liquidity but liquidity providers still interact with the pool through the standard PoolManager path.
  • [info] Immutable configuration: The toll rate, cache addresses and credits split are immutable and set at deployment, with no owner, pause, upgrade or parameter-change paths found in the decoded functions.

Contract details

Verified source
Yes (Cinder)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
8,096 bytes
Upgradeable proxy
No
Detected patterns
erc20, moves-currency, ownable, return-delta, self-unlock, tax

Pools using Cinder