Spot on Robinhood Chain

Uniswap v4 Hook Contract 0xe5488f6166a93521ba306e48e901586136ff50cc on Robinhood Chain · Dynamic fee · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
5
Swaps (24h)
0 (0 traders)
Total swaps
2

What it does

A Uniswap v4 hook that sets dynamic fees from oracle volatility and surge events, charges protocol and undisclosed hidden fees on swaps, and reinvests collected fees into a full-range liquidity position managed by a separate liquidity manager.

This read was written for the hook 0xfcc8…d0cc on Robinhood Chain and reused here: the two share a code shape, so constants such as fees, owners and addresses can differ.

How it works step by step

  • Sets per-swap dynamic fees from oracle-derived base fee plus a linearly decaying surge fee, or a policy-owner manual fee
  • Records TruncGeo oracle observations and tracks tick movement caps to trigger surge fees
  • Takes protocol POL share plus a hidden flat 0.10% of input amount as ERC6909 claims on every swap
  • Routes accrued fees to FullRangeLiquidityManager and attempts reinvestment into a full-range position after each swap
  • Initializes dynamic fee pools and rejects pools that do not use dynamic fees
Swap behaviour
On every swap beforeSwap applies a dynamic fee override (manual or base plus surge), records oracle observations, and for exact-input swaps takes a fee via return delta. afterSwap updates cap and surge state and for exact-output swaps takes the fee via return delta; then it attempts reinvestment of pending fees.
Liquidity behaviour
Hook does not use afterAddLiquidity or afterRemoveLiquidity callbacks. Liquidity is managed by the FullRangeLiquidityManager, which holds a single full-range position per pool, mints ERC6909 shares to depositors, and reinvests accumulated fees into that position in afterSwap when reinvestment is not paused and the price is within tolerance of TWAP.
Fee behaviour
Swap fee is base fee plus surge fee from DynamicFeeManager, or a manual fee override set by the policy owner. Base fee is derived from oracle maxTicksPerBlock times a factor, clamped between min and max. Surge fee decays linearly after oracle cap events. On top of the LP fee, the hook takes a protocol fee (POL share of the swap fee) plus a hidden flat 0.10% of the trader's input amount on every swap, minted as ERC6909 claims to the FullRangeLiquidityManager.
Owner & admin controls
Policy owner (PoolPolicyManager owner, checked via msg.sender == policyManager.owner()) can pause or unpause reinvestment via setReinvestmentPaused, and can deposit to and withdraw from the FullRangeLiquidityManager through depositToFRLM and withdrawFromFRLM. The policy owner can also set manual fees per pool, which overrides the dynamic fee, and set protocol POL share up to 44000% of fees. The FRLM policy owner can sweep excess tokens and ERC6909 claims, withdraw protocol-owned liquidity, set reinvestment TWAP and tick tolerance, and the FRLM contains owner-restricted helper functions that transfer tokens and NFTs to a hardcoded address. Contract ownership is not upgradeable via proxy in the decoded surface.

Enabled Uniswap v4 callbacks

afterInitialize, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

afterInitialize: validates dynamic fee pools, initializes policy, oracle and fee state. beforeSwap: sets the dynamic fee override, records the pre-swap tick in transient storage, records oracle observations, and for exact-input swaps takes the hook fee via return delta. afterSwap: updates cap state and surge in DynamicFeeManager, takes the fee for exact-output swaps via return delta, and attempts reinvestment. beforeSwapReturnDelta and afterSwapReturnDelta: allow the hook to take a portion of swap amounts as fees.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, medium confidence).

Who controls it: The policy owner can set manual fees up to 10%, change POL share up to 44000%, pause reinvestment, move protocol-owned liquidity via FRLM withdrawals, sweep excess tokens and ERC6909 balances to any recipient, and the FRLM contains owner-gated functions that move tokens and NFTs held by the contract to a fixed external address. A compromised owner key could drain protocol-owned balances and redirect fees.

Risk to user funds: The hook takes fees from every swap via return deltas and mints claims to the FullRangeLiquidityManager, which holds pooled liquidity and pending fees. The owner can pause reinvestment, withdraw protocol liquidity, sweep excess tokens and ERC6909 claims, and the FRLM has hardcoded owner-only functions that send contract-held tokens and NFTs to an external address. Traders are charged an undisclosed additional 0.10%.

Security findings

  • [high] Undisclosed hidden swap fee: Every swap takes an additional flat 0.10% of the trader's input amount, labeled hidden in source comments, on top of the disclosed dynamic fee and POL share. This is not visible through the pool's fee parameter and is charged to traders without explicit surfacing.
  • [high] Hardcoded owner-only drain functions in FRLM: FullRangeLiquidityManager exposes owner-only withdrawAllMyTokens and withdrawMyNft functions that transfer all ERC20 balances or any NFT held by the contract to a hardcoded address, bypassing the normal accounting and protocol-owned liquidity logic.
  • [high] Broad owner control over fees and funds: Policy owner can set POL share up to 44000% (440,000,000 PPM) and a manual fee up to 10%, and can withdraw protocol-owned liquidity and sweep excess balances, allowing centralized extraction of fees and LP value.
  • [medium] Return-delta fee capture: Hook takes tokens through afterSwap and beforeSwap return deltas and mints ERC6909 claims to the liquidity manager, so it can hold and redirect a share of pool value on every swap.
  • [low] Complex reinvestment path in afterSwap: Reinvestment calls poolManager.unlock and multiple external token and position manager calls from within afterSwap; failures are caught and emitted, so swaps are not blocked, but reinvestment logic is complex and not easily auditable from the summary.

Contract details

Verified source
Yes (Spot)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
9,522 bytes
Upgradeable proxy
No
Detected patterns
dynamic-fee, oracle, return-delta

Pools using Spot