RootedHook on Robinhood Chain

Uniswap v4 Hook Contract 0x8cd1b2373d25194aa565c6b394796d1036186acc on Robinhood Chain · Launchpad · Verified contract

Volume (24h)
$3.99
Value locked (TVL)
$16.43K
All-time volume
$706.31K
Pools using this hook
2
Swaps (24h)
1 (1 traders)
Total swaps
3,466

What it does

A Rooted launch hook that routes a fixed share of quote-token flow from every swap to a capital vault for launch funding, with anti-snipe limits and liquidity restricted to a designated vault.

How it works step by step

  • Enforces that only registered pools with the canonical 0.30% fee and tick spacing 60 can initialize against this hook.
  • Mints a 1% to 5% share of quote-token volume on buys and sells to a RootCapitalVault as ERC-6909 claims.
  • Blocks external liquidity providers, allowing only the designated liquidity vault to add or remove liquidity.
  • Blocks swaps before a configured launch-open time and caps buy output during the anti-snipe window.
  • Supports owner-enabled time-limited pass-through that disables contributions per pool or globally.
  • Writes fee-range TWAP observations to an external oracle on every swap when one is configured.
Swap behaviour
Exact-output swaps revert. Buys (quote in) and sells (quote out) during non-pass-through mode mint a contribution of contributionBps to the capital vault as an ERC-6909 claim: buys via beforeSwap return delta, sells via afterSwap return delta. Launch-open timing and buy maxTx limits are enforced, and buys must fully fill. Each swap also writes a fee-range TWAP observation if the oracle is set.
Liquidity behaviour
Only the registered liquidityVault address may add or remove liquidity; any other sender reverts with ExternalLiquidityForbidden. Hook does not alter liquidity amounts or ranges itself.
Fee behaviour
Pool LP fee is frozen at 3000 (0.30%) with tick spacing 60. On each buy during non-pass-through mode the hook mints an ERC-6909 claim of contributionBps (1% to 5%, deployer chosen at registration) of the quote token to the capital vault and returns a matching beforeSwap delta; on each sell it mints the same share of the quote-side delta to the vault in afterSwap. No protocol fee is taken from LP fees.
Owner & admin controls
Owner (Safe) can set global and per-pool pass-through (time-limited, up to 7 days) that disables contributions, rotate the registrar, set the fee-range TWAP oracle, transfer ownership (two-step), allowlist implementations and propose/execute UUPS upgrades after a 1 day timelock. Registrar can register pools, bind liquidity vault and configure anti-snipe parameters. Settlement capital vault owner can enable claim redemption and revoke principal creditors.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeRemoveLiquidity, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

beforeInitialize gates initialization to pools pre-registered by the registrar with the correct quote token and canonical fee/spacing. beforeAddLiquidity and beforeRemoveLiquidity restrict liquidity changes to the liquidity vault to block external JIT. beforeSwap enforces no exact-output swaps, launch-open timing and mints buy-side Root Contributions via return delta. afterSwap enforces launch timing and maxTx limits on buys, enforces full fill, writes a fee-range TWAP observation to an external oracle, and mints sell-side contributions via afterSwap return delta.

Security & trust assessment

Risk level: high (verified source, high confidence).

Who controls it: The owner can enter pass-through to suspend contributions for any pool for up to 7 days, reassign the registrar to register arbitrary pools, change the TWAP oracle that is called on every swap (a malicious oracle could revert all swaps), and upgrade the implementation after a 1 day delay to arbitrary allowlisted code, which could redirect or seize contributed claims and pool-related funds. Swaps can be blocked by an oracle revert or a broken upgrade.

Risk to user funds: The hook takes contribution claims from every buy and sell as ERC-6909 credits to the capital vault and can take return deltas from swaps; it does not hold pool liquidity itself. Contributed quote tokens can be moved from the capital vault by its owner and registered principal creditors, and an owner-triggered upgrade could change this flow. Users can be blocked from swapping by pass-through or a bad oracle.

Security findings

  • [high] Upgradeable proxy controlled by a single owner: Owner can push any allowlisted implementation via UUPS after a 1 day timelock, so the hook logic (including settlement of contribution claims and liquidity access) can be changed without user consent.
  • [medium] Owner-set oracle can block all swaps: afterSwap calls an externally set feeRangeTwapOracle.write on every swap with no try/catch; a reverting or malicious oracle, set by the owner, halts all swaps for every pool bound to this hook.
  • [medium] Owner can suspend Root Contributions: Owner can enable pass-through for any pool, removing contribution minting for up to 7 days; pass-through also bypasses contributions while still enforcing maxTx and full fill.
  • [medium] Registrar and liquidity vault concentrate control: Registrar can register pools and set anti-snipe parameters; liquidity vault is a single address that is the only allowed LP, so a compromised vault or registrar controls liquidity access for that pool.
  • [info] Hook takes a share of swap flow via return deltas: Hook takes contributions as ERC-6909 claims on the pool manager and returns deltas, so contribution amounts are taken from swapper inputs and outputs per fixed bps; capital vault redemption and principal creditors can move the resulting quote-token balance.

Contract details

Verified source
Yes (RootedHook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
130 bytes
Upgradeable proxy
Yes
Detected patterns
dynamic-fee, launchpad, liquidity-management, mev-protection, oracle, ownable, return-delta, upgradeable

Pools using RootedHook