Spot on BNB Chain

Uniswap v4 Hook Contract 0xf1541a6c0e68aa90065be8ff61a99f0f2a9810cc on BNB Chain · Dynamic fee · Verified contract

Volume (24h)
$3.69K
Value locked (TVL)
$40
All-time volume
$103.44K
Pools using this hook
12
Swaps (24h)
102 (6 traders)
Total swaps
2,366

What it does

Spot is a dynamic-fee hook that sets each swap fee from oracle tick volatility and a surge premium, takes a protocol share of swap volume, and reinvests collected fees into a full-range liquidity position.

How it works step by step

  • Computes a dynamic LP fee per swap from oracle tick movement (base fee) plus a linearly decaying surge fee after capped moves
  • Allows the policy owner to override the dynamic fee with a manual value between 0.001% and 10%
  • Takes a configurable protocol share of swap fees (default 10%) via beforeSwap and afterSwap return deltas
  • Mints protocol fee claims as ERC6909 to the FullRangeLiquidityManager and notifies it of fee amounts
  • Reinvests accumulated protocol fees into a full-range position on a daily cooldown when price is near TWAP
  • Records oracle observations and tracks cap frequency to adjust the surge state
Swap behaviour
beforeSwap sets a dynamic fee (base plus surge, or a manual override) and records an oracle observation; on exact-input swaps it takes a protocol fee via return delta. afterSwap updates oracle cap state and surge tracking, takes a protocol fee on exact-output swaps, and attempts reinvestment.
Liquidity behaviour
No liquidity callbacks are enabled. Liquidity is managed by the separate FullRangeLiquidityManager contract, which can receive deposits, mint full-range positions and redeem shares. Protocol-collected fees are reinvested into a full-range position on a cooldown when the price is within a tolerance of the TWAP.
Fee behaviour
Each swap uses a dynamic LP fee equal to a base fee plus a surge fee. The base fee is derived from oracle tick movement times a base fee factor, clamped between pool min and max bounds (defaults 0.001% to 3%). The surge fee is a linear-decay premium set when the oracle detects a capped tick move, scaled by a multiplier. A manual fee override can replace the dynamic fee entirely. Additionally the hook takes a protocol share (default 10% of the fee) which is minted as ERC6909 claims to the liquidity manager rather than to the LP.
Owner & admin controls
Owner of PoolPolicyManager (the policy owner, checked via msg.sender == policyManager.owner()) can pause or unpause reinvestment via setReinvestmentPaused, deposit to and withdraw from the FullRangeLiquidityManager via depositToFRLM and withdrawFromFRLM, and the policy owner can set manual fees, base fee bounds, surge multipliers, decay periods, POL share percentage, and oracle caps through PoolPolicyManager. The FullRangeLiquidityManager also exposes withdrawProtocolLiquidity and sweepExcessTokens/sweepExcessERC6909 to the policy owner, and a withdrawAllMyTokens function that hardcodes a single owner address to receive any ERC20 balance held by the liquidity manager. The hook has no upgrade proxy in the source provided.

Enabled Uniswap v4 callbacks

afterInitialize, beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta

afterInitialize: validates the pool uses a dynamic fee, initializes policy, oracle and fee manager state for the pool. beforeSwap: reads the dynamic fee, records an oracle observation, sets the dynamic fee override, and optionally mints a protocol fee credit via return delta on exact-input swaps. afterSwap: updates oracle cap state and fee manager surge state, mints protocol fee credit on exact-output swaps, triggers reinvestment, and returns a hook delta. beforeSwapReturnDelta and afterSwapReturnDelta: allow the hook to take a share of the swap amount as protocol revenue.

Security & trust assessment

Risk level: high (verified source, high confidence).

Who controls it: The policy owner can set manual fees up to 10% on any pool, raise base fee maxima to 3% by default or higher within bounds, change surge multipliers up to 1000%, pause reinvestment, and withdraw protocol-owned liquidity and any tokens the FRLM contract holds through the hardcoded withdrawAllMyTokens function. A compromised owner key could drain protocol-owned liquidity and fees.

Risk to user funds: The hook can take a protocol share of swap amounts through return deltas and holds protocol-owned ERC6909 and ERC20 balances in the FullRangeLiquidityManager. The owner can withdraw those balances, including via the hardcoded withdrawAllMyTokens path, and can change fees to extract value from traders.

Security findings

  • [high] Hardcoded owner token sweep: The function withdrawAllMyTokens in FullRangeLiquidityManager transfers the entire balance of any ERC20 held by the contract to a hardcoded address, gated only by a msg.sender check against that same address. This is a privileged drain path that bypasses accounting.
  • [medium] Owner controls fees and protocol liquidity: The policy owner can call withdrawProtocolLiquidity and sweepExcessTokens, and can set manual fees up to 10% and surge multipliers up to 1000%, which can extract value from traders or drain protocol liquidity.
  • [low] Oracle manipulation surface: Dynamic fee and tick-cap logic relies on a single oracle and on pre-swap tick reads; the TWAP-based reinvestment guard limits but does not eliminate manipulation in low-liquidity pools.
  • [info] Hook takes a share of swap volume: The hook takes a protocol share of each swap via return delta and mints ERC6909 claims to the liquidity manager, which is a deliberate revenue flow from traders.
  • [info] No timelock visible: Verified source shows the policy owner is a single EOA or multisig owner with no timelock visible in the provided files.

Contract details

Verified source
Yes (Spot)
Compiler
solc 0.8.30+commit.73712a01
Bytecode size
9,467 bytes
Upgradeable proxy
No
Detected patterns
dynamic-fee, oracle, return-delta

Pools using Spot