LendingHook on World Chain

Uniswap v4 Hook Contract 0xb6409396564740a856c3b404d498e4ddedc15040 on World Chain · Launchpad · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

A lending market hook that tracks supply and borrow positions per Uniswap v4 pool and liquidates undercollateralized debt during swaps, using an external oracle as the price reference.

How it works step by step

  • Records the initial tick and price per pool in afterInitialize.
  • Compares pool price to a Chainlink-style oracle on every swap and stops liquidations if deviation exceeds maxDeviation.
  • Updates a tick adjustment factor on each swap to track interest-like drift in debt ratios.
  • Marks debt ticks as liquidated and swaps their collateral through the pool manager when they fall below the liquidation limit.
  • Accepts supply and earn deposits via Permit2 and records them in internal mappings; borrow pays out token1 directly.
  • Mints an ERC721 position NFT on first supply.
Swap behaviour
afterSwap compares the pool price to the oracle; if the deviation is too large it only updates the tick factor and exits. Otherwise it liquidates debt ticks below the adjusted limit and swaps collateral through the pool manager.
Liquidity behaviour
No liquidity callbacks are enabled. Separate earn and supply functions pull tokens via Permit2 and record balances in internal mappings (liquidity, positionData), not in the pool.
Fee behaviour
Uses the pool's static fee. No fee is taken or shared by the hook.
Owner & admin controls
Owner (set in constructor) can call setOracle to change the oracle address and max deviation per pool, and modifyVaultVariables to overwrite any pool's vault state including tickAdjustmentFactor and topMostTick. No pause or upgrade mechanism is visible; the contract is not a proxy.

Enabled Uniswap v4 callbacks

afterInitialize, afterSwap

afterInitialize records the initial tick and price and sets lastTicks. afterSwap reads the oracle price, compares it to the pool price, updates the tick adjustment factor, and may liquidate debt ticks by swapping collateral through the pool manager.

Security & trust assessment

Risk level: high (verified source, medium confidence).

Who controls it: The owner can point the price oracle at any address, set maxDeviation, or overwrite vault variables including the tick adjustment factor and topMostTick, which changes which positions are liquidatable and the accounting for all users in that pool.

Risk to user funds: The hook holds deposited liquidity and collateral tokens, can swap pool funds during afterSwap to liquidate debt, and transfers borrowed token1 out. Anyone can overwrite vault state through modifyVaultVariables, and the owner can change the oracle, so user funds are exposed to manipulation.

Security findings

  • [high] Unrestricted vault variable overwrite: modifyVaultVariables is public and has no onlyOwner modifier, so anyone can overwrite any pool's vaultVariables including tickAdjustmentFactor, topMostTick and totals.
  • [high] Owner-controlled price oracle: Owner can set an arbitrary oracle via setOracle; getPrice trusts oracle answers without bounds, so a malicious or faulty oracle can trigger or block liquidations.
  • [medium] Incomplete bad debt handling: borrow transfers token1 out and absorbBadDebt contains an empty branch where collateral should be swapped, so bad debt is not actually absorbed and funds may be unbacked.
  • [medium] Core lending functions unimplemented: repay and withdraw are empty functions, so borrowers cannot repay or withdraw collateral through the hook.
  • [medium] Hook moves pool and user funds: The hook calls poolManager.swap and settles or takes tokens during afterSwap to liquidate positions, so it can move pool funds and collateral on every swap.

Contract details

Verified source
Yes (LendingHook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
22,490 bytes
Upgradeable proxy
No
Detected patterns
liquidity-management, moves-currency, oracle

Pools using LendingHook