Author: 0x
Compile: Deep潮 TechFlow
DeepChain Summary: Uniswap v4’s Hooks were originally an innovative mechanism designed to enable customizable plugins for AMMs. However, 0x’s analysis of over 84,000 Hooks across six blockchains revealed that only 19.4% were deemed secure, with more than half identified as malicious. Some liquidity pools offer enticing “best prices” during quoting, but upon settlement, users receive up to 50% less than expected.
When permissionless liquidity begins to be exploited maliciously, this article addresses not just a vulnerability in Uniswap, but a more fundamental question: Can on-chain best prices still be trusted directly?
It's time to address the issues with the hooks mechanism.
This year, 0x has routed 81.92 million trades with a trading volume of $42.67 billion, approximately 70% of which accessed Uniswap's liquidity.
We receive dozens of reviews and requests to integrate v4 hooks every month, and we’ve seen both good and bad ones. But recently, we’ve also started seeing some ugly things.
Over the past few weeks, 0x has observed a dramatic increase in the number of malicious Uniswap v4 hooks—these hooks quote one price during the request phase but settle at a different price. While the techniques used by malicious hooks vary, the outcome is always the same: stealing funds from users by deceiving aggregators, wallets, and trading applications.
Here is what we observed on-chain and the steps 0x has already taken in response.
The issue with hooks: open to both builders and malicious actors
First, the good: v4 hooks introduce a layer of innovation to the AMM space—developers can deploy AMMs with custom logic that executes at key moments in a pool’s lifecycle, such as before or after swaps, or when LP positions change. Hooks can be designed to do anything and deployed by anyone; once deployed, they automatically inherit the reach of DeFi’s most integrated liquidity venue.
Beyond saving developers friction, hooks also open up limitless possibilities for malicious behavior. A malicious hook doesn’t need to build a reputable brand, convince users to visit a new interface, or establish its own distribution channels—it only needs to make its liquidity pool appear attractive to systems that aggregate liquidity.
As soon as the aggregator sees the "best quote," it has reason to route the trade there. If a wallet or trading app relies on this aggregator, users are already trusting the same infrastructure to direct their trades to that malicious pool.
Malicious hooks
Over the past 18 months, we have observed explosive growth in v4 hooks. Our analysis of 84,163 hooks across six chains—combining static analysis, dynamic analysis, and observations of settled transactions—reveals that only 19.4% are safe, 54.2% are malicious, and 26.4% are likely malicious.
These techniques vary—some randomly harvest like rolling dice, while others check the EVM environment to detect “this is a quote.” But the underlying behavior is consistent: the price advertised through routing does not equal the price the user actually receives. We have observed that transactions routed through malicious v4 hooks result in users receiving up to 50% less than the quoted amount when executed.
Here are a few examples:
Hook address: 0x800cef53c3fd41109dffec62e5251bdd7acba5c7
- Chain: Base
- Trading pair: ETH/NVDAc
- Total number of trades: 6,516
- Number of fees: 3,946 (60.6%)
- Fee range: 0–18%
- Median fee for fully filled orders: 17.96%
- Median fee rate at charging: 18%
- Total fees collected (USD): $143,000
Hook address: 0x141984423d1a28242b3dd8888c5b0daa7b13c880
- Chain: BNB
- Trading Pair: USDT/WBNB
- Total number of trades: 4,879
- Number of fees: 1,619 (33.2%)
- Fee range: 0–12.8%
- Median fee for fully filled orders: 0%
- Median fee rate at charging: 12.8%
- Total fees collected (USD): $18,600
Conclusion
Hooks were designed to make Uniswap more scalable, but they have also opened up endless possibilities for malicious behavior. This summer has proven that permissionless liquidity does not equate to trustworthy liquidity. Just as the rise of propAMMs demonstrated, the flexibility that allows developers to customize swap mechanisms has also provided bad actors with new ways to manipulate markets. Based on this, we believe:
- The router must ensure that the amount quoted by the liquidity pool matches its actual performance during execution.
- The application must have the ability to quickly delist suspicious routes.
- Users should understand: "Best displayed quotes" are only truly meaningful when the underlying routing is secure.
As we have done for the past decade, we are taking concrete steps to protect our integrators and their users from the ever-changing actors on-chain. At 0x, we have implemented multiple measures to prevent these pools from appearing in routing results, including advanced detection technologies and extremely rigorous due diligence on liquidity pools.
Thank you for building with 0x.