FlamingStarHook on Base

Uniswap v4 Hook Contract 0xdc8f0c4e5dbd7b8c96fb7b8e8eaac4dbf6b3c044 on Base · Fee sharing · Verified contract

Volume (24h)
$0
Value locked (TVL)
$23.09K
All-time volume
$236.42K
Pools using this hook
2
Swaps (24h)
0 (0 traders)
Total swaps
552

What it does

Charges a configurable fee (default 6%) on each exact-input swap in this pool, sending it to a fee recipient, and lets anyone trigger distribution of accumulated tokens to an artist and NFT holders.

How it works step by step

  • afterSwap rejects any swap with positive amountSpecified (exact output).
  • Computes fee = unspecified output amount * feeBps / 10000 (default 600 bps).
  • Calls poolManager.take to send the fee directly to feeRecipient.
  • Returns the fee as an afterSwap return delta so the trader receives less output.
  • distributeFees (public) burns all accumulated customERC20 to 0xdead and splits accumulated USDC 50/50 between the artist and NFT holders pro rata by NFT count.
  • emergencyWithdraw lets the owner move any ERC20 held by the hook.
Swap behaviour
Reverts on exact-output swaps. On exact-input swaps, takes feeBps of the output currency to feeRecipient and returns the same amount as a return delta reducing the trader's received output.
Liquidity behaviour
No liquidity callbacks.
Fee behaviour
Takes a configurable fee (default 600 bps, i.e. 6%) of the unspecified output currency on every exact-input swap and sends it directly to feeRecipient via poolManager.take; the same amount is returned as a return delta to adjust the trader's output. feeBps has no upper bound check.
Owner & admin controls
Owner (Ownable) can change feeRecipient, artistAddress, usdcAddress, customERC20Address, nftCollection and feeBps (no cap on feeBps, so the owner can set fee to 100% or more), can transfer or renounce ownership, and can call emergencyWithdraw to move any ERC20 held by the hook to any address. No pause and no upgrade mechanism found.

Enabled Uniswap v4 callbacks

afterSwap, afterSwapReturnDelta

afterSwap: enforces exact-input only and computes and takes the fee after each swap. afterSwapReturnDelta: returns the fee amount so the swapper's final balance is reduced by the fee.

Security & trust assessment

Risk level: medium (verified source, high confidence).

Who controls it: The owner can set feeBps to any value, redirect all fee revenue by changing feeRecipient, and drain any token balance held by the hook via emergencyWithdraw. Owner can also make swaps revert in effect by setting feeBps very high so the return delta exceeds the output amount.

Risk to user funds: The hook does not custody swapper principal; it takes a fee on each swap and forwards it to feeRecipient. Fee balances and any tokens sent to the hook are held by the contract until distributeFees or emergencyWithdraw is called, and the owner can withdraw them. A malicious or compromised owner can set a punitive feeBps to make swaps extract nearly all output.

Security findings

  • [high] Unbounded fee rate controlled by owner: setFeeBps has no maximum bound, so the owner can set the fee to 100% or higher, causing swappers to receive nothing or causing the swap to fail.
  • [medium] Owner can withdraw any hook-held token: emergencyWithdraw lets the owner transfer any ERC20 held by the hook to any address, including tokens accrued for artist and holder distribution.
  • [medium] Mutable distribution and recipient addresses: Fee recipient, artist, USDC, custom ERC20, and NFT collection addresses are all mutable by the owner, so distribution destinations can be changed at will.
  • [info] Exact-output swaps disabled: Hook blocks exact-output swaps by reverting when amountSpecified is positive, which may break routers that expect exact-output support.
  • [low] Unbounded gas in holder distribution: distributeFees is callable by anyone but uses unbounded loops over minted NFTs (O(n^2) holder deduplication), so gas cost grows with supply and may make distribution fail for large collections.

Contract details

Verified source
Yes (FlamingStarHook)
Compiler
solc 0.8.26+commit.8a97fa7a
Bytecode size
9,708 bytes
Upgradeable proxy
No
Detected patterns
dynamic-fee, ownable, return-delta

Pools using FlamingStarHook