Likely custom pricing hook on Blast

Uniswap v4 Hook Contract 0xf77201b6322d0b4a9363a7e88f51971359a24088 on Blast · Custom pricing

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
18
Swaps (24h)
0 (0 traders)
Total swaps
1

What it does

An unverified hook with beforeSwap return deltas that appears to route swaps through external liquidity (a V2-style fee denominator and WETH are referenced), with an owner who can pause swaps, set per-pool fees and execute arbitrary calls.

This read was written for the hook 0x9a30…c088 on Arbitrum and reused here: the two share a code shape, so constants such as fees, owners and addresses can differ.

How it works step by step

  • Registers pools in a mapping and an array (allPools, getPoolCount, pools(bytes32)), with a default tick spacing and a 1:1 starting sqrt price constant.
  • Implements beforeSwap with return deltas, so it can take over swap pricing and settlement instead of using the pool's normal concentrated liquidity.
  • Exposes constants such as BPS, V2_FEE_DEN and weth, which suggests V2-style or WETH-based routing, but the exact mechanism cannot be confirmed from bytecode alone.
  • Has an unlockCallback, so it interacts with the PoolManager directly to move tokens during swaps.
  • Lets the owner set per-pool fees (setPoolFee), pause the hook (setPaused), transfer ownership (setOwner) and call execute(address,uint256,bytes) and another address/uint256/bytes function (0xbfd3da96).
Swap behaviour
beforeSwap is nonpayable and reads the owner/paused slot and the pool mapping. It reverts when paused (inferred from the paused flag being read there) and can return a delta that replaces or offsets the pool's own swap, so the hook's own accounting determines the trade amounts.
Liquidity behaviour
No liquidity callbacks are enabled in the permissions. The decoded beforeAddLiquidity and similar functions are only stubs from the standard hook interface and are not part of the active permissions.
Fee behaviour
The owner can set a fee per pool via setPoolFee(bytes32,uint24), and another function (selector 0xbefa61d5, uint24) appears to write a default fee stored next to the owner. The exact fee formula and where collected fees go cannot be determined from bytecode.
Owner & admin controls
A single owner (slot 0) can transfer ownership with setOwner, pause or unpause with setPaused, change fees with setPoolFee and the uint24 setter, and use execute(address,uint256,bytes) and 0xbfd3da96 to make arbitrary external calls. Also, 0x8ec6cd0d and 0x0aa87769 are owner-gated or state-writing functions whose purpose is unknown. No timelock or multisig is visible in the bytecode.

Enabled Uniswap v4 callbacks

beforeSwap, beforeSwapReturnDelta

beforeSwap is used to intercept swaps, apply the hook's fee and routing logic and check the pause flag. beforeSwapReturnDelta is used to let the hook return a delta that takes over some or all of the swap's token flows.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, low confidence).

Who controls it: The owner can pause swaps, change fees, transfer ownership and make arbitrary calls from the hook's address, so users depend fully on that key behaving honestly.

Risk to user funds: The hook can take or settle tokens through return deltas and unlockCallback, and the owner can move any assets or approvals held by the hook via execute. Pausing can also block swaps, though the bytecode does not show whether LP positions in the PoolManager can be blocked, as liquidity callbacks are not enabled.

Security findings

  • [high] Arbitrary call by owner: execute(address,uint256,bytes) is nonpayable and reads the owner slot, so the owner can make the hook call any address with any data and value. If the hook holds tokens or approvals, they could be drained.
  • [medium] Swaps can be paused: setPaused writes a bool that beforeSwap reads, so the owner can block all swaps on pools using this hook.
  • [medium] Owner-set pool fees without visible cap: setPoolFee takes a uint24 per pool and no upper bound can be confirmed from the decoded bytecode, so a very high fee may be possible.
  • [medium] Return-delta swap accounting: beforeSwapReturnDelta lets the hook change what traders pay and receive. Correctness depends on logic that cannot be audited without source.
  • [info] Unverified code: No source is available, so function purposes beyond the named selectors (for example 0xbfd3da96, 0x8ec6cd0d, 0x0aa87769) are unknown.

Contract details

Verified source
No
Bytecode size
20,733 bytes
Upgradeable proxy
No
Detected patterns
pausable, return-delta

Pools using Likely custom pricing hook