Utility hook on Base

Uniswap v4 Hook Contract 0x3a6abb626fac79c804401ecfa14dc0d461f3e888 on Base · Utility

Volume (24h)
$0
Value locked (TVL)
$0.40
All-time volume
$0.70
Pools using this hook
3
Swaps (24h)
0 (0 traders)
Total swaps
254

What it does

An owner-managed, upgradeable hook that gates which pools and addresses may swap or add liquidity and can hold and settle tokens on behalf of the pool.

How it works step by step

  • Records each initialized pool in an on-chain registry (poolIds, poolKeyOf, poolCount) during beforeInitialize.
  • Restricts swaps to allow-listed pools and whitelisted addresses via beforeSwap.
  • Uses beforeSwapReturnDelta to settle part of swap amounts through the hook.
  • Provides deposit and withdraw entry points that move tokens through the PoolManager using an unlock callback.
  • Lets the owner sweep residual token balances and upgrade the implementation through UUPS.
Swap behaviour
beforeSwap checks pool allowance and whitelist status and can return a balance delta, so the hook may take or supply part of the swap amounts.
Liquidity behaviour
beforeAddLiquidity is enabled and the hook exposes deposit, withdraw and a self-unlock path (unlock, modifyLiquidity, settle, take, mint, burn), suggesting it manages its own liquidity position through the PoolManager. Whether adds are restricted to whitelisted addresses cannot be confirmed without source.
Fee behaviour
No fee logic is evident from the decoded functions; the hook does not appear to set a dynamic fee and uses the pool's configured fee.
Owner & admin controls
Owner (storage slot 0) can transfer ownership via setOwner, set and remove whitelist entries via setWhitelisted and setWhitelistedBatch, allow or disallow pools via setPoolAllowed, sweep tokens via sweep, and upgrade the implementation via upgradeToAndCall (UUPS, implementation slot present).

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, beforeSwap, beforeSwapReturnDelta

beforeInitialize: records newly initialized pools (pool registry, poolIds, poolKeyOf, poolCount). beforeAddLiquidity: likely gates liquidity additions. beforeSwap: checks whether the pool is allowed and the sender is whitelisted, and can return a delta (beforeSwapReturnDelta) so the hook can take over part of the swap settlement.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, medium confidence).

Who controls it: The owner can add or remove whitelisted addresses, enable or disable pools, sweep tokens held by the hook, and replace the implementation through UUPS upgrades. A malicious or compromised owner could redirect hook-held funds or change swap behaviour for all pools.

Risk to user funds: The hook can hold tokens (deposit/withdraw, settle/take, sweep) and can take part of swap deltas via beforeSwapReturnDelta. The owner can sweep those balances or upgrade the logic, so user funds held by the hook are under owner control, and swaps on allowed pools can be gated or altered.

Security findings

  • [high] Upgradeable implementation controlled by owner: The proxy uses UUPS upgradeToAndCall and an implementation slot, so the owner can replace the logic at any time, changing behaviour for all pools using this hook.
  • [high] Owner can sweep hook-held tokens: sweep(address,address,uint256) lets the owner move tokens the hook holds, which can include funds left by users or pool settlement.
  • [medium] Return delta with access-controlled swaps: beforeSwapReturnDelta is enabled, so the hook can take a portion of swap amounts; combined with owner-controlled whitelisting and pool allow-listing, swaps can be restricted or redirected.
  • [low] Single-step ownership transfer: Ownership is transferable via setOwner without a two-step process observed in the decoded functions, so a wrong address would permanently lose control.
  • [info] Unverified source: Source is unverified; behaviour is inferred from selectors and storage reads/writes, so the precise logic of the hooks is uncertain.

Contract details

Verified source
No
Bytecode size
163 bytes
Upgradeable proxy
Yes
Detected patterns
access-control, erc20, erc6909-claims, moves-currency, ownable, return-delta, self-unlock, upgradeable

Pools using Utility hook