Likely custom pricing hook on BNB Chain

Uniswap v4 Hook Contract 0x051aae4d88ae17125971ba679cf5222e3f2e8088 on BNB Chain · Custom pricing

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
53
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

An owner-managed hook that tracks a list of pools and intercepts swaps with a custom-accounting return delta, letting the owner set per-pool fees and execute arbitrary calls from the hook.

How it works step by step

  • Registers pools (allPools, getPoolCount, pools mapping) and keeps a default tick spacing and a 1:1 sqrt price constant, which suggests it initializes pools itself via the pool manager.
  • Runs custom logic in beforeSwap and can return a delta, so it can take over or alter the swap amounts. It reads a mapping(address => bool) that looks like an allowlist or whitelist check.
  • Has an unlockCallback, so it calls the pool manager's unlock and performs its own accounting inside it.
  • Lets the owner set a per-pool fee through setPoolFee(bytes32,uint24) and a default fee through an unnamed uint24 setter.
  • Exposes owner-only execute(address,uint256,bytes) and another owner-gated function that takes (address,uint256,bytes), both of which look like generic call or transfer forwarders.
Swap behaviour
beforeSwap is nonpayable and reads the pool mapping and an address-to-bool mapping, likely to check pool membership and whether a caller or token is allowed. Because beforeSwapReturnDelta is enabled, it can return a specified/unspecified delta that changes what the swapper pays or receives. The exact pricing logic cannot be determined from the decoded bytecode.
Liquidity behaviour
No liquidity callbacks are enabled in the permissions. The liquidity-hook selectors are present in the dispatcher but only as view stubs, which is consistent with a base-hook interface.
Fee behaviour
The owner can set a fee per pool (setPoolFee) and a default fee (uint24 setter). How the fee is applied or whether it is taken through the return delta cannot be confirmed without source.
Owner & admin controls
A single owner (setOwner, owner) can transfer ownership, change per-pool and default fees, call a function that writes slot 5 (an address), call an address[] function that writes the pool registry, and run execute(address,uint256,bytes). The owner check appears to be a plain address comparison with no timelock or multisig visible.

Enabled Uniswap v4 callbacks

beforeSwap, beforeSwapReturnDelta

beforeSwap is used to apply the hook's own swap logic and pool checks. beforeSwapReturnDelta is used to return a delta that lets the hook adjust or replace the swap amounts and take or give tokens.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, low confidence).

Who controls it: The owner can change fees per pool, add or change registered pools or allowlists, transfer ownership and run arbitrary calls from the hook. This gives the owner strong control over swap economics and over any funds or approvals the hook holds.

Risk to user funds: The hook uses the pool manager's unlock and return deltas, so it can hold and move tokens during swaps, and execute lets the owner move whatever it holds. The owner could also block or tax swaps through fee settings or allowlist checks in beforeSwap. Exact custody and the size of balances held between transactions cannot be determined.

Security findings

  • [high] Arbitrary call execution by owner: execute(address,uint256,bytes) is gated by the owner slot and appears to forward arbitrary calls with value, so the owner can move any asset the hook holds or approvals it has.
  • [medium] Swap return delta controls amounts: beforeSwapReturnDelta is enabled, so the hook can take tokens from or redirect swap amounts. Combined with owner-set fees, a bad configuration could make swaps very costly.
  • [medium] Owner-set fees without visible bounds: setPoolFee(bytes32,uint24) and a default-fee setter are owner-only. No bound check can be confirmed from the decoded code.
  • [medium] Single EOA-style owner with transferable control: setOwner(address) changes ownership immediately with no two-step or timelock visible.
  • [info] Unverified source: Behaviour is inferred from selectors and the storage layout only. The large bytecode (14220 bytes) and the unlockCallback hold logic that could not be fully decoded.

Contract details

Verified source
No
Bytecode size
14,220 bytes
Upgradeable proxy
No
Detected patterns
return-delta

Pools using Likely custom pricing hook