Access control hook on Base

Uniswap v4 Hook Contract 0x9571f4406def6071068ee92767c4eaf0dbfb3ae0 on Base · Access control

Volume (24h)
$0
Value locked (TVL)
$0
All-time volume
$0
Pools using this hook
1
Swaps (24h)
0 (0 traders)
Total swaps
0

What it does

A credential-gated, pausable hook on an upgradeable proxy that applies an admin-set dynamic fee to every swap and can pause swaps and LP withdrawals, so only approved traders and LPs can use the pool.

How it works step by step

  • Gates swaps, liquidity changes and donations on a single approved pool using a policy and credential system (issuers, executors, nonces, expiring credentials).
  • Lets privileged roles pause specific actions (swap, add liquidity, remove liquidity, donate) by action type.
  • Sets and updates a dynamic LP fee for the pool based on an admin-configured policy; zero fees are rejected.
  • Checks NFT position ownership through the position manager when liquidity is added or removed.
  • Runs behind an upgradeable proxy with timelock, policy admin and emergency roles, plus a seal function.
Swap behaviour
Before each swap the hook checks that the pool is approved, the policy is active, the swap action is not paused and the caller holds valid credentials, otherwise the swap reverts. It may set a dynamic fee; it cannot take tokens from swaps through return deltas.
Liquidity behaviour
Adding and removing liquidity are checked against pause state, policy and position ownership. Because the remove-liquidity check is enabled and the remove action can be paused, LP withdrawals can be blocked.
Fee behaviour
Uses a dynamic LP fee set by the hook from an admin-configured policy, and zero fees are not allowed. The exact fee range cannot be confirmed from bytecode, and fees go to LPs through normal pool accounting.
Owner & admin controls
Admin, timelock and emergency roles can pause or unpause each action type (including removals), add or remove issuers and executors, configure fee policies and the policy contract, and seal the configuration. The proxy owner can upgrade the implementation, and no fee caps are visible in the bytecode.

Enabled Uniswap v4 callbacks

beforeInitialize, afterInitialize, beforeAddLiquidity, beforeRemoveLiquidity, beforeSwap, afterSwap, beforeDonate

beforeInitialize: restricts pool creation to the approved pool and initializer; afterInitialize: records the pool and sets the initial fee; beforeAddLiquidity: checks credentials, pause state and position; beforeRemoveLiquidity: checks pause state and position and can block withdrawals; beforeSwap: enforces credentials, pause state and policy, and applies the fee; afterSwap: post-swap policy checks; beforeDonate: restricts donations to allowed addresses.

Security & trust assessment

Risk level: high, estimated (decoded bytecode, medium confidence).

Who controls it: The policy admin, timelock, emergency role and proxy upgrader control pausing, credentials, fee policy and code upgrades. At worst they can halt swaps and block LP withdrawals.

Risk to user funds: The hook cannot directly take swap or LP tokens because return deltas are disabled. However, LP principal can be locked by pausing removals or through an upgrade, and the swap fee cap is unknown.

Security findings

  • [high] LP withdrawals can be paused: The remove-liquidity action can be paused, and beforeRemoveLiquidity is enabled. This lets privileged roles make withdrawals revert and trap LP principal.
  • [medium] Upgradeable proxy with remove-liquidity hook: An implementation upgrade could change withdrawal gating at any time. Return deltas are disabled, so an upgrade cannot take swap or LP tokens via deltas.
  • [medium] Permissioned trading: Swaps and liquidity changes require valid credentials from approved issuers. Credentials can expire or be revoked.
  • [low] Dynamic fee with unknown cap: The admin-configured policy sets the fee. Zero is disallowed, but the upper bound is not verifiable from bytecode.

Contract details

Verified source
No
Bytecode size
1,018 bytes
Upgradeable proxy
Yes
Detected patterns
dynamic-fee, upgradeable

Pools using Access control hook