GPOHooks on Base

Uniswap v4 Hook Contract 0x6cabe2fd9fb60c5afcab7de732b0a224fc382eec on Base · Fee sharing · Verified contract

Volume (24h)
$1.68
Value locked (TVL)
$9.56K
All-time volume
$12.00K
Pools using this hook
1
Swaps (24h)
24 (1 traders)
Total swaps
10,753

What it does

GPO hook that charges a fixed 10% USDC fee on swaps, sends that fee to a multisig-controlled owner contract, and permanently locks the initial full-range GPO/USDC liquidity.

How it works step by step

  • Deploys the GPO ERC-20 token with a fixed supply of 100,000,000 tokens and pairs it with USDC in a Uniswap v4 pool with zero static fee.
  • Mints the full GPO supply into a single full-range position from startingTick to MAX_TICK, callable once by the deployer.
  • Takes a 10% USDC fee on swaps through beforeSwap and afterSwap return deltas and transfers it to the GPO Owner.
  • Locks liquidity permanently after minting: further adds revert and removals always revert.
  • Blocks external pool initialization and donations.
  • Rejects ETH via receive and fallback.
Swap behaviour
On swaps where USDC is the fee currency, beforeSwap or afterSwap takes 10% of the USDC amount from the PoolManager to the GPO Owner and adjusts the swap delta accordingly, emitting UsdcFeeCollected; swaps proceed without the fee if the pool lacks sufficient USDC.
Liquidity behaviour
beforeAddLiquidity reverts unless called during the hook's own mintLiquidity flow. afterAddLiquidity sets liquidityLocked to true, after which all adds revert. beforeRemoveLiquidity always reverts, so liquidity is permanently locked once minted over the full range [startingTick, MAX_TICK].
Fee behaviour
Charges a 10% fee in USDC on swaps where USDC is the swap-fee currency, taking it from the PoolManager and paying it to the GPO Owner contract's owner. Pool static fee is 0; the hook's fee is implemented through beforeSwap and afterSwap return deltas, applied only when the PoolManager holds enough USDC.
Owner & admin controls
No owner or admin functions on the hook itself; it is described as ownerless and immutable. mintLiquidity can only be called by the deployer once (guarded by liquidityLocked). Fee revenue is sent to gpoOwner.owner(), a Ownable2Step contract owned by a multisig, which can transfer ownership but the hook has no function to change its recipient.

Enabled Uniswap v4 callbacks

beforeInitialize, beforeAddLiquidity, afterAddLiquidity, beforeRemoveLiquidity, beforeSwap, afterSwap, beforeDonate, beforeSwapReturnDelta, afterSwapReturnDelta

beforeInitialize reverts to block external pool initialization; beforeAddLiquidity restricts liquidity additions to the hook itself; afterAddLiquidity locks liquidity permanently; beforeRemoveLiquidity always reverts; beforeDonate reverts to disable donations; beforeSwap and afterSwap take the USDC fee and return a delta; beforeSwapReturnDelta and afterSwapReturnDelta allow the hook to adjust swap amounts for the fee.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: No privileged key on the hook. The multisig controlling GPOOwner receives all collected USDC fees and can change the fee recipient via Ownable2Step ownership transfer, but cannot alter the fee rate, pool parameters or liquidity, which are fixed in bytecode.

Risk to user funds: The hook takes USDC from the PoolManager on swaps and can effectively change the amounts traders receive via return deltas. It holds the full-range liquidity position NFT, which is permanently locked. It cannot move user funds beyond the fixed fee, and it blocks liquidity removal and donations by design.

Security findings

  • [info] Permanent liquidity lock: Liquidity is permanently locked via afterAddLiquidity and beforeRemoveLiquidity reverting, so LPs cannot exit; the full-range position is held by the hook.
  • [info] Mandatory 10% USDC swap fee via return deltas: The 10% fee is taken from the PoolManager's USDC balance and sent to the GPO Owner, and the hook returns deltas that alter swap accounting, so traders pay an extra 10% on USDC-side swaps.
  • [low] Fee silently skipped when pool USDC is low: If the PoolManager's USDC balance is below the fee amount, the fee is silently skipped and the swap proceeds without it, which is a behavioural edge case rather than a exploit.
  • [low] Fee recipient controlled by external multisig: The fee uses a grossed-up formula for exact output, and the constructor-deployed GPOOwner address is fixed, so changes to the fee recipient depend entirely on the multisig's Ownable2Step actions.

Contract details

Verified source
Yes (GPOHooks)
Compiler
solc 0.8.30+commit.73712a01
Bytecode size
8,290 bytes
Upgradeable proxy
No
Detected patterns
moves-currency, return-delta

Pools using GPOHooks