FlowstateC1Hook on Robinhood Chain

Uniswap v4 Hook Contract 0x44ca381b2264d0f0173f817d42ab2a8489f968cc on Robinhood Chain · Custom pricing · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
8
Swaps (24h)
4 (4 traders)
Total swaps
4

What it does

FlowstateC1Hook sells tokens to buyers only, pricing each buy at the market oracle cost plus a spread that is higher for larger trades, with a fixed jar fee taken from that spread, while LPs cannot add meaningful liquidity and the owner controls the spread and can sweep accrued margin.

How it works step by step

  • Overrides the concentrated-liquidity curve via beforeSwapReturnDelta so the hook, not the pool curve, prices every swap, with the hook consuming the entire specified amount.
  • Only permits buy-direction swaps (quote asset in, inventory token out); sell-direction swaps revert with SellDirectionNotSupported.
  • Routes buys into FlowstateMarket pool deposits and Gen-4 one-candidate listings, walking queue order within gas and attempt limits, and reverts if an exact-input fill is short.
  • Prices each fill as recomputed oracle cost plus a spread (base spread plus size-based rung), with the spread accrued as margin per quote asset.
  • Pays a fixed TokenJar fee (jarFeeBps, immutable) out of the spread on every fill.
  • Allows exactly one liquidityDelta == 1 dust add per pool (visibility beacon) before closing the pool to liquidity events.
Swap behaviour
Only buy-direction swaps (quote in, token out) are served; sell-direction swaps revert. On each buy the hook reads the market price, takes the buyer's input, sources tokens from market pool deposits and listings within gas and attempt caps, and settles the output. The buyer pays the oracle cost plus the spread (base plus size rung), and a jar fee is carved from that spread. Larger trades matching a higher rung pay a higher total spread; trades above the top rung pay the top rung's extra bps. Exact-output swaps are pre-funded and unused input is returned to the PoolManager.
Liquidity behaviour
Only one liquidityDelta == 1 add per pool is permitted, from any caller, to emit a ModifyLiquidity event; it can never participate in pricing. All other liquidity additions revert with LiquidityNotAllowed. Removals are not hooked, and no real LP position of meaningful size can be created.
Fee behaviour
The pool's LP fee must be zero. Pricing is determined by the market's oracle cost plus a spread: baseSpreadBps per pair plus a size-based rung schedule per market asset. Spread is accrued as margin per quote asset and swept to a sweep destination by the owner. A fixed jarFeeBps (immutable) is paid to the TokenJar from the spread on every fill, never from the buyer's price beyond the spread.
Owner & admin controls
Owner (Ownable2Step, two-step transfer) can register and unregister pairs, set base spread per pair, set the base spread floor and market registration spread (both bounded below by jarFeeBps and above by MAX_SPREAD_BPS of 10%), set size rung schedules per market asset, set native share between the two ETH pools, set the reseller code, set the sweep destination, sweep accrued margin and dust, and sweep ETH. There is no pause, no upgrade mechanism (the contract is not a proxy), and no sender gating in swaps. Owner cannot change the jar fee, the PoolManager, the market, or the listing endpoints, which are immutable.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

beforeInitialize: enforces zero LP fee, canonical tick spacing 60, and readiness of the registered pair. beforeAddLiquidity: gates the one-time dust visibility beacon and rejects all other liquidity additions. beforeSwap: implements the custom curve, pricing and filling the swap and returning a hook delta. afterSwap: no-op returning zero delta. beforeSwapReturnDelta: lets the hook take over the swap so the core curve does not run. afterSwapReturnDelta: enabled by the address flags, but afterSwap returns zero, so it has no observed effect beyond the flag.

Security & trust assessment

Risk level: medium (verified source, medium confidence).

Who controls it: The owner can unilaterally raise spreads on every pair up to the 10% per-component cap, change which pairs are registered, redirect accrued margin and dust plus any ETH the hook holds to a chosen sweep destination, and choose the native share between two ETH pools. The owner cannot pause swaps, change the jar fee or the core market and PoolManager addresses, or upgrade the contract.

Risk to user funds: During a swap the hook briefly holds the buyer's input and the output token inside a PoolManager unlock; between unlocks it holds only accrued spread margin and inversion dust, which the owner can sweep. Buyers are charged oracle cost plus a spread that the owner can raise, and the jar fee is taken from that spread. The source is partially truncated, so some listing and queue behavior is unverified.

Security findings

  • [medium] Owner can raise spreads up to 2x cap: baseSpreadBps and per-rung extraBps are each capped at 10%, so total spread can reach roughly 20% of the oracle cost on every buy, set unilaterally by the owner via setBaseSpread and setSizeRungs with no timelock visible in the source.
  • [medium] Owner can sweep all hook balances: sweepMargin and sweepETH transfer the hook's full token and ETH balance to sweepDestination, which the owner sets; this includes accrued spread margin and dust awaiting sweep, which are user-paid amounts.
  • [info] Hook takes buyer funds via return deltas: The hook takes the buyer's input and settles the output through the PoolManager using beforeSwapReturnDelta, so the hook transiently holds user funds inside each unlock; the design states it holds no user funds between unlocks, except accrued margin and dust.
  • [low] Pool legs can be blocked by gas and read failures: Exact-input fills revert with ExactInputShortfall if gas is insufficient or a read or leg fails, and exact-output reverts on shortfall; this means swaps can be blocked by ordinary conditions, though no owner pause exists.
  • [info] Immutable addresses bind hook to market and listing endpoints: PoolManager, market, weth9, tokenJar, jarFeeBps, listingRegistry and listingSettlement are immutable, so the trust surface is fixed at deployment and the hook cannot be redirected by admin.

Contract details

Verified source
Yes (FlowstateC1Hook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
24,040 bytes
Upgradeable proxy
No
Detected patterns
erc20, fee-sharing, moves-currency, ownable, return-delta

Pools using FlowstateC1Hook