Uniswap v4 hooks were a mistake

This year 0x has routed 81.92 million trades and $42.67 billion in volume, with roughly ~70% of transactions touching Uniswap liquidity.

And we field dozens of requests to review and integrate v4 hooks every month, so we’ve seen the good and the bad. But lately, we’ve been seeing the ugly, too.

In the last few weeks, 0x has seen an alarming increase in malicious Uniswap v4 hooks, designed to price swaps one way in quote requests and another way at the time of settlement. Malicious hooks use multiple patterns, but the result is the same: stealing from users by spoofing aggregators, wallets, and trading apps.

Here’s what we’ve observed onchain and what actions we’ve taken at 0x.

‍

The problem with hooks: open to builders and bad actors

To start with the good, v4 hooks offered the AMM space an innovation layer: a way for builders to spin up AMMs with custom logic that can execute at key points in a pool’s lifecycle, such as before or after a swap or LP position changes. Hooks can be designed to do anything, deployed by anyone, and the moment they exist, they inherit the distribution of the most widely integrated liquidity venue in DeFi.

Beyond the friction this eliminated for builders, hooks also create infinite room for malicious behavior. A malicious hook doesn’t need to build a recognizable brand, convince users to visit a new interface, or bootstrap its own distribution. It only needs to make its pool look attractive to the systems that aggregate liquidity.

If an aggregator sees the best quote, it has a reason to route there. If a wallet or trading app relies on that aggregator, the malicious pool can be reached through the same infrastructure users already trust.

‍

Malicious hooks

What we’ve seen over the last 18 months is an explosion of v4 hooks. Our analysis (leveraging static analysis, dynamic analysis, and observation of settled trades) of 84,163 hooks across 6 chains determined that only 19.4% are safe, 54.2% are malicious, and 26.4% are likely malicious.

The patterns vary — some operate like a dice roll, some inspect the EVM environment to detect quoting — but the underlying behavior is consistent: the price a route advertises is not the price a user can reliably expect to receive. We’ve observed trades routed through malicious v4 deliver as much as 50% less at execution than the amount quoted to the user.

Here are a few examples:

Hook: 0x800cef53c3fd41109dffec62e5251bdd7acba5c7

• Chain: Base
• Pair: ETH/NVDAc
• Total fills: 6,516
• Charged fills: 3,946 (60.6%)
• Fee range: 0-18%
• Median fee on all fills: 17.96%
• Median fee when charged: 18%
• Total fees charged (USD): $143,037

‍

Hook: 0x141984423d1a28242b3dd8888c5b0daa7b13c880

• Chain: BNB
• Pair: USDT/WBNB
• Total fills: 4,879
• Charged fills: 1,619 (33.2%)
• Fee range: 0-12.8%
• Median fee on all fills: 0%
• Median fee when charged: 12.8%
• Total fees charged (USD): $18,592

‍

The takeaway

Hooks were designed to make Uniswap more extensible, but they also opened up infinite opportunities for abuse. This summer has shown that permissionless liquidity does not automatically mean trusted liquidity. As with the rise of propAMMs, the same flexibility that lets builders customize how swaps work also gives bad actors new ways to manipulate them. To that end, we believe:

• Routers need to ensure a pool’s quoted amount matches its actual execution behavior.
• Apps need controls for quickly removing suspicious routes.
• Users should know that the best displayed quote is only useful if the route behind it is safe.

And just as we have for the past decade, we’re taking concrete steps to keep our integrators and their users safe from the ever-changing cast of bad actors onchain. At 0x, we’ve taken several steps to prevent these pools from appearing in routes, including advanced detection techniques and extreme due diligence around pool vetting.

Thank you for building with 0x.

‍