Access control hook on Base

Uniswap v4 Hook Contract 0xf0930639457a2e64b4fa08fabe055b8dc840cac0 on Base · Access control

Volume (24h)
$3.09K
Value locked (TVL)
$9.50K
All-time volume
$228.00K
Pools using this hook
5
Swaps (24h)
404 (116 traders)
Total swaps
12,798

What it does

A Uniswap v4 hook that gates liquidity provision to whitelisted providers and runs band-based logic on swaps, managed through role-based access control.

How it works step by step

  • Restricts addLiquidity and removeLiquidity to addresses in a liquidityProviders whitelist
  • Stores per-index tick values and band data in contract storage
  • Runs beforeSwap and afterSwap callbacks that read this band data
  • Uses OpenZeppelin-style AccessControl with DEFAULT_ADMIN_ROLE and a ROLE_EXCHANGE role
  • Exposes batch setter functions that update band and tick storage
Swap behaviour
beforeSwap and afterSwap run on every swap; afterSwap reads tick-band data stored in the hook, but the exact effect on pricing or fees is not fully determined.
Liquidity behaviour
beforeAddLiquidity and beforeRemoveLiquidity are enabled; the hook appears to restrict liquidity operations to whitelisted liquidity providers (NotLiquidityProvider error and a liquidityProviders mapping are present).
Fee behaviour
Uses the pool's static fee as far as can be determined; no fee-setting function identified.
Owner & admin controls
Role-based access control with DEFAULT_ADMIN_ROLE managing grantRole, revokeRole and renounceRole; addProvider and removeProvider manage a whitelist of liquidity providers; the batch setters (0x3a82d650, 0x66c95354) are gated by roles; no pause or upgrade mechanism identified.

Enabled Uniswap v4 callbacks

beforeAddLiquidity, beforeRemoveLiquidity, beforeSwap, afterSwap

beforeAddLiquidity checks whether the sender is an approved liquidity provider; beforeRemoveLiquidity performs a similar check; beforeSwap and afterSwap run on each swap, with afterSwap reading per-band tick data stored in the hook.

Security & trust assessment

Risk level: medium (decoded bytecode, low confidence).

Who controls it: Accounts holding DEFAULT_ADMIN_ROLE can grant or revoke roles and add or remove liquidity providers, so a privileged key can decide who may add or remove liquidity in the pool.

Risk to user funds: The hook does not appear to take custody of tokens directly; its main effect is on who may add or remove liquidity. Its effect on swap outcomes cannot be fully determined from the bytecode alone.

Security findings

  • [medium] Permissioned liquidity: Liquidity add and remove functions are gated by a provider whitelist, so only approved addresses can provide or withdraw liquidity through this hook.
  • [medium] Admin-controlled access: The admin can change the provider whitelist and role assignments at any time, with no timelock visible in the bytecode.
  • [info] Band-based swap logic not fully decoded: Swap callbacks read and write tick-band storage, and the exact pricing or fee effect cannot be confirmed without source.

Contract details

Verified source
No
Bytecode size
8,139 bytes
Upgradeable proxy
No

Pools using Access control hook