TruthMarketHook on Base

Uniswap v4 Hook Contract 0x1cfead8e66cebc5e51093dfd247ad34f841740c4 on Base · Fee sharing · Verified contract

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
196
Swaps (24h)
2 (2 traders)
Total swaps
5,336

What it does

Hook that records the pool tick around each swap to drive an external order manager, optionally validates swaps through an external contract, and can skim a percentage of the unspecified-side swap amount as a fee sent to a fee collector.

How it works step by step

  • In beforeSwap it reads the current tick from the pool's slot0 and saves it in transient storage.
  • In afterSwap it reads the new tick and calls orderManager.movePoolTick(key, fromTick, toTick, sqrtPriceX96) so an external order system can react to the price move.
  • If a swapValidator is set, afterSwap calls validateAfterSwap on it, and a revert there would revert the swap.
  • If feeNumerator is non-zero, it charges feeNumerator/10000 of the unspecified-currency amount, mints that amount as ERC-6909 claims to the feeCollector, and returns it as the afterSwap delta so the swapper pays it.
  • Calls feeCollector.trackPoolFee to record the fee per pool and emits FeeCollected.
Swap behaviour
beforeSwap only stores the pre-swap tick and returns a zero delta with no fee override. afterSwap optionally runs the external validator, notifies the order manager of the tick move, and then, if the fee rate is non-zero, takes a fee from the unspecified side of the swap via the return delta.
Liquidity behaviour
No liquidity callbacks.
Fee behaviour
The pool's LP fee is not changed (beforeSwap returns fee 0 with no override flag). On top of it, the hook takes feeNumerator/10000 of the unspecified-token amount (default 0, the comment suggests 36 for 0.36%) through the afterSwap return delta. The fee is minted as ERC-6909 claims to feeCollector, which tracks it per pool. There is no upper bound on feeNumerator in the code.
Owner & admin controls
Holders of DEFAULT_ADMIN_ROLE (set to the constructor's _admin, and able to grant or revoke the role) can call setFeeRate with any value, setFeeCollector (non-zero address), setSwapValidator (any address, zero disables) and setOrderManager (non-zero address). There is no pause, timelock or upgrade mechanism in this contract.

Enabled Uniswap v4 callbacks

beforeSwap, afterSwap, afterSwapReturnDelta

beforeSwap records the pre-swap tick in transient storage. afterSwap validates the swap, informs the order manager of the tick change and computes the fee. afterSwapReturnDelta lets the hook take the fee from the swapper's unspecified-side amount.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: The admin role holder can raise the swap fee without limit, redirect fees to any address, replace the order manager and swap validator with arbitrary contracts (which can revert and halt swaps), and grant admin to others. No timelock or delay is present in this contract, although the admin address itself could be a multisig or timelock.

Risk to user funds: The hook does not custody tokens beyond minting fee claims to the feeCollector. It can take a fee from swappers via return delta, which is unbounded by the admin's fee setting, and can block swaps through reverting external calls. It does not touch LP positions, since no liquidity callbacks are enabled.

Security findings

  • [high] Uncapped admin-set fee: setFeeRate stores any uint256 with no maximum, and afterSwap takes mulDiv(amount, feeNumerator, 10000) via the return delta. An admin could set a rate of 100% or more of the unspecified amount, making swaps cost far more or revert.
  • [medium] Swaps depend on external admin-replaceable contracts: afterSwap calls orderManager.movePoolTick and, if set, swapValidator.validateAfterSwap without try/catch. A reverting, malicious or buggy contract, which the admin can swap in, would block every swap on pools using this hook.
  • [medium] Swapper-paid fee redirected to configurable collector: The fee is minted as ERC-6909 claims directly to feeCollector, which the admin can change to any non-zero address, and trackPoolFee is called on that address. The fee goes to whoever controls that address.
  • [medium] Admin can censor swaps through the validator: The swap validator receives the sender, params, delta and hookData and can revert, so the admin can effectively block or filter specific swappers or swap types.
  • [info] Debug import and unused role definitions: The source imports forge-std console and a Roles library with operator, pauser and timelock roles, but only DEFAULT_ADMIN_ROLE is used. Admin power therefore sits in a single role with no timelock.

Contract details

Verified source
Yes (TruthMarketHook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
6,179 bytes
Upgradeable proxy
No
Detected patterns
dynamic-fee, return-delta

Pools using TruthMarketHook