Girder on Robinhood Chain

Uniswap v4 Hook Contract 0x90133e0e529c6bed8acd750bf4cd1850a9a520cc on Robinhood Chain · Custom pricing · Verified contract

Volume (24h)
$631
Value locked (TVL)
$0
All-time volume
$631
Pools using this hook
1
Swaps (24h)
20 (9 traders)
Total swaps
20

What it does

Girder is an ERC-20 whose ETH/token pool charges a fixed ETH toll (75 to 500 bps) on every home-pool swap, which is booked to four hoppers that their bearers can withdraw, so every trader in either direction pays the toll while liquidity providers are not tolled because the hook has no liquidity callbacks.

This read was written for the hook 0x607e…e0cc on Robinhood Chain and reused here: the two share a code shape, so constants such as fees, owners and addresses can differ.

How it works step by step

  • Is the ERC-20 token itself and the hook of its own ETH/token pool; the full supply of one billion tokens is minted to the deployer (the Gantry) once at construction and never minted again
  • On every swap through the home pool, sheds a toll in ETH (75 to 500 bps, fixed at deployment) that is booked as an ERC-6909 claim held by the hook inside the PoolManager rather than paid out immediately
  • Splits each booked toll across four hoppers: 80% to the rigger side (further split by commonsBps between the rigger and commons hoppers), 10% to the guild hopper, and the remainder to the gantryman hopper
  • Lets each hopper's bearer call empty() to withdraw the entire booked ETH balance of that hopper to the bearer address via PoolManager unlock/take
  • Rejects any pool other than the single ETH/this-token pool with fee 0 and tick spacing 1; all other hook callbacks revert with SlotUnused
Swap behaviour
Swaps through the home pool are tolled in ETH. For buys with exact ETH input and sells with exact ETH output the toll is taken in beforeSwap from the ETH figure; for the other two directions (buys with exact token output, sells with exact token input) the toll is computed from the ETH actually moved and taken in afterSwap. Swaps that touch any other pool revert. Buyers and sellers both pay the toll in ETH, so every swap through the home pool pays more than the base pool price alone.
Liquidity behaviour
No liquidity callbacks; add and remove liquidity hooks all revert with SlotUnused, so liquidity can only be managed through the PoolManager directly subject to the pool's own rules.
Fee behaviour
The pool itself has a static fee of 0; the hook charges a separate ETH toll of tollBps (75 to 500 bps, immutable) on each swap. The toll is booked to the four hoppers in fixed proportions: 80% rigger side (split by immutable commonsBps between rigger and commons), 10% guild, remainder gantryman.
Owner & admin controls
Ownership is renounced in the constructor, so owner() returns zero and no owner-only function is reachable. No pause, no fee change, no upgrade mechanism, no parameter setters. tollBps, commonsBps, the bearers, and the metadata URI are fixed at deployment (metadataURI is a public variable with no setter visible in the ABI). The four hopper bearers are the only privileged actors and each can only withdraw its own hopper.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

beforeInitialize: validates the one allowed home pool and records it. beforeSwap: quotes and books the ETH toll for legs priced in ETH and returns a before-swap delta to take it. afterSwap: quotes and books the toll for legs priced in the token using the ETH actually moved, and returns an after-swap delta; it also reverts if an up-front-tolled leg moved the wrong ETH amount. beforeSwapReturnDelta and afterSwapReturnDelta: allow those deltas to take the toll from the trader's flow.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: No owner remains, so no single key can change fees, pause swaps or upgrade logic. The only privileged actors are the four immutable hopper bearers, who can withdraw only the ETH booked to their own hopper.

Risk to user funds: The hook holds ETH tolls as ERC-6909 claims inside the PoolManager and can take up to tollBps of each home-pool swap; it cannot move pool liquidity beyond that toll and cannot block swaps except via the LegUnderfilled and FigureOffScale reverts.

Security findings

  • [info] Toll is taken from every home-pool swap via return deltas: beforeSwapReturnDelta and afterSwapReturnDelta let the hook take ETH from trader flow up to tollBps (75 to 500 bps), which is by design and bounded by immutable parameters.
  • [medium] Hopper bearers withdraw booked ETH: Each of the four bearer addresses can call empty() to pull the full ETH balance of its hopper; if a bearer key is compromised the booked tolls for that hopper can be drained, and the bearer for hopper 0 (rigger) and the rigger/commons split control most of the flow.
  • [low] Relies on decoded behaviour for unlock and burn accounting: empty() and unlockCallback() burn ERC-6909 claims and take ETH from the PoolManager; correctness depends on the PoolManager accounting matching _hopper totals, which the code asserts but was reasoned about from decoded bytecode rather than audited against the PoolManager.
  • [low] Afterswap revert on underfilled legs: afterSwap reverts with LegUnderfilled if an up-front-tolled leg did not move the exact ETH the quote assumed, so such swaps fail rather than being mis-tolled; this can block some trades under unusual pool states.
  • [info] Immutable parameters and renounced ownership: tollBps, commonsBps, bearers and the pool key are fixed; the hook cannot be re-rated, re-pointed or paused after deployment.

Contract details

Verified source
Yes (Girder)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
7,614 bytes
Upgradeable proxy
No
Detected patterns
erc20, moves-currency, ownable, return-delta, self-unlock, tax

Pools using Girder