Limit orders hook on World Chain

Uniswap v4 Hook Contract 0x59d6637eccab06e0efbc176ab2c292ab66ec5040 on World Chain · Limit orders

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
2
Swaps (24h)
0 (0 traders)
Total swaps
1

What it does

A lending market hook that lets users supply collateral, borrow against it, and triggers liquidations of under-collateralised positions on swaps, using a Chainlink oracle as a price check.

This read was written for the hook 0x8b40…d040 on World Chain and reused here: the two run the same code.

How it works step by step

  • Records the starting tick and price per pool on initialization.
  • Compares the Uniswap pool price against a Chainlink oracle price on every swap.
  • Liquidates borrower debt ticks below the adjusted liquidation limit by swapping collateral through the pool.
  • Lets users supply collateral and borrow currency1 from the hook, tracked as NFT-based positions.
  • Accepts earn deposits from lenders and tracks them per pool and receiver.
Swap behaviour
afterSwap checks Uniswap price against the oracle, updates the tick adjustment factor and, if the price is within deviation, liquidates debt ticks past the liquidation limit by performing a forced zeroForOne swap through the pool.
Liquidity behaviour
No liquidity callbacks. Lending positions are tracked via supply, borrow, earn and repay accounting outside of pool liquidity; supply and earn pull tokens through Permit2 and borrow transfers currency1 out to the borrower.
Fee behaviour
No fee logic; the hook does not charge or share fees and uses the pool's static fee.
Owner & admin controls
A single owner address (set in constructor) can call setOracle to change the oracle address and max deviation per pool; modifyVaultVariables is public with no onlyOwner modifier, so anyone can overwrite vault variables; no pause, upgrade proxy or ownership transfer was found.

Enabled Uniswap v4 callbacks

afterInitialize, afterSwap

afterInitialize records the starting tick and initial price for each pool. afterSwap reads the new tick, compares Uniswap price to a Chainlink oracle price, updates the tick adjustment factor, and liquidates under-collateralised debt ticks by swapping collateral through the pool manager.

Security & trust assessment

Risk level: high, estimated (verified source, medium confidence).

Who controls it: The owner can point the price feed at any oracle and set maxDeviation, which controls when liquidations run. Because modifyVaultVariables is unrestricted, any caller can rewrite topMostTick, tickAdjustmentFactor and totals, which could corrupt liquidation and debt accounting.

Risk to user funds: The hook holds borrowed and supplied tokens in its own balance and transfers borrowed currency1 out on borrow. Liquidations can sell user collateral through the pool, and wrongly set oracle or vault variables can cause unfair liquidations or stuck debt for users.

Security findings

  • [high] Unrestricted vault variable overwrite: modifyVaultVariables has no access control and is public, letting any address overwrite vaultVariables for any pool.
  • [high] Oracle dependency for liquidations: afterSwap and absorbBadDebt divide by priceX96 and the oracle answer is trusted directly; a stale or manipulated Chainlink feed, or a zero price, drives liquidation decisions.
  • [medium] Owner-controlled oracle and deviation: The owner can change the oracle address and maxDeviation at any time with no timelock, and getPrice returns a value derived from an unchecked oracle answer.
  • [medium] Incomplete liquidation and repayment paths: absorbBadDebt computes collateral to absorb but the swap body is empty, and repay and withdraw are empty stubs, so bad debt is not actually cleared.
  • [medium] Forced liquidation swaps affect pool price: afterSwap liquidations swap collateral through the pool with an unbounded sqrtPriceLimit near MIN_SQRT_PRICE, which can move the pool price and impact LPs.

Contract details

Verified source
No
Bytecode size
23,324 bytes
Upgradeable proxy
No
Detected patterns
moves-currency

Pools using Limit orders hook