Access control hook on Base

Uniswap v4 Hook Contract 0x00a53696701060195587323dd0a120ba3352c088 on Base · Access control

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

An unverified hook that checks an address list before swaps and can take an unknown amount from swaps, while LPs can always withdraw freely.

How it works step by step

  • Runs a check before every swap and can change swap amounts using a return delta.
  • Calls the PoolManager's take function during swaps, meaning it can pull tokens out of the swap flow to some recipient.
  • Keeps an address-to-yes/no list that is read during swaps and can be updated through two unnamed functions, which looks like an allowlist or registry.
  • Tracks two counters that are updated on each swap, possibly a swap count or a running total of tokens taken.
  • Never runs on liquidity adds or removals, so LPs can withdraw freely.
Swap behaviour
Before each swap the hook checks an address list and may take tokens from the swap through a return delta, so traders could receive less or pay more. The size of any deduction and who receives it cannot be confirmed from bytecode alone.
Liquidity behaviour
No liquidity callbacks; LPs can add and withdraw freely.
Fee behaviour
The hook can take an unknown amount from swaps via the PoolManager. The rate, any cap, and the recipient cannot be confirmed without verified source.
Owner & admin controls
Two unnamed functions write to the address list, probably to add or remove entries, but who can call them is not visible in the decoded data. No fee-setting function was identified.

Enabled Uniswap v4 callbacks

beforeSwap, beforeSwapReturnDelta

beforeSwap: checks the address list and updates counters before each swap; beforeSwapReturnDelta: lets the hook adjust swap amounts and take tokens.

Security & trust assessment

Risk level: medium, estimated (decoded bytecode, low confidence).

Who controls it: Whoever controls the list-updating functions may change which addresses are allowed or affected during swaps. Their exact access control is unknown.

Risk to user funds: The hook can deduct an unverified amount from swap amounts. LP principal stays in the PoolManager and cannot be locked or drained by this hook.

Security findings

  • [medium] Unverified swap deduction: The hook can take tokens from swaps through a return delta, but the amount and any cap cannot be verified from bytecode.
  • [low] Possible trader gating: An address yes/no list is read during swaps and can be changed, which may let someone allow or block certain swappers.
  • [info] LP withdrawals unrestricted: Remove-liquidity callbacks are disabled, so the hook can never block or charge LP withdrawals.

Contract details

Verified source
No
Bytecode size
1,503 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, return-delta

Pools using Access control hook