Access control hook on BNB Chain

Uniswap v4 Hook Contract 0x1c64e5216d3f7043c1df217193b4399d61c00fcf on BNB Chain · Access control

Volume (24h)
$0
Value locked (TVL)
$239
All-time volume
$0
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

An owner-upgradeable hook that can change any swap or liquidity amount and lets the owner withdraw funds, so every trader and LP relies fully on the owner's trust, even though no specific fee was identified.

How it works step by step

  • Upgradeable (UUPS) hook on BNB Chain with nearly all swap and liquidity callbacks enabled, including return-delta permissions.
  • Owner can upgrade the implementation code at any time.
  • Owner can withdraw any ERC20 tokens or BNB held by the hook, and has an extra owner-gated function that appears to take tokens out of the PoolManager via an unlock callback.
  • Most decoded callbacks look like simple view stubs in the current implementation, but the exact swap logic cannot be confirmed from bytecode.
Swap behaviour
Swaps call the hook before and after execution, and the hook is allowed to change swap amounts through return deltas. Whether the current code takes any fee could not be confirmed from bytecode.
Liquidity behaviour
The hook runs on both adding and removing liquidity and can change those amounts through return deltas. The current callbacks appear to be view-only, but because the contract is upgradeable, a future version could block or tax withdrawals.
Fee behaviour
No explicit fee rate was found in the bytecode, and any fee taken through return deltas is uncapped and unknown.
Owner & admin controls
The owner can upgrade the implementation, transfer ownership, withdraw any tokens or BNB the hook holds, and call an owner-only function that pulls currency out of the PoolManager. None of these powers has any cap.

Enabled Uniswap v4 callbacks

beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity, afterRemoveLiquidity, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta, afterAddLiquidityReturnDelta, afterRemoveLiquidityReturnDelta

beforeSwap/afterSwap: run on every swap; swap return deltas: can change swap input/output; before/afterAddLiquidity: run on deposits; before/afterRemoveLiquidity: run on withdrawals; liquidity return deltas: can change deposited or withdrawn amounts.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, medium confidence).

Who controls it: A single owner key controls upgrades and withdrawals with no visible timelock or limits. In the worst case, the owner could change the code to seize swap amounts or trap LP funds.

Risk to user funds: Swap amounts and liquidity deposits or withdrawals can all be modified, with no fee cap the owner is bound by. LP principal could be locked or reduced after an upgrade.

Security findings

  • [high] Upgradeable hook with full delta and withdrawal permissions: The owner can swap in new code that, through the enabled return deltas and remove-liquidity callbacks, could take swap tokens or block or tax LP withdrawals.
  • [medium] Owner token withdrawal: withdrawToken and withdrawETH let the owner move any balance held by the hook to any address.
  • [medium] Owner-gated PoolManager take: An unnamed owner-only function triggers unlock and take, which can move currency out of the PoolManager under the owner's direction.

Contract details

Verified source
No
Bytecode size
130 bytes
Upgradeable proxy
Yes
Detected patterns
erc20, moves-currency, ownable, return-delta, self-unlock, upgradeable

Pools using Access control hook