DEX aggregator 0x has published a set of findings on Uniswap v4 Hooks, setting off a public exchange with Uniswap over where security responsibility should sit in a permissionless system.
On Sept. 14, 0x said it had analyzed 84,163 Uniswap v4 Hooks across six chains. As of Sept. 11, it classified 19.4% as safe, 54.2% as malicious, and 26.4% as suspected malicious. Uniswap founder Hayden Adams later responded on X, saying the existence of malicious Hooks is an unavoidable byproduct of an open system. He added that users trading through Uniswap’s official API and reviewed front ends would not be routed to those malicious pools, and argued that the issue lies with aggregator filtering rather than the v4 architecture itself.
0x says malicious Hooks use quote spoofing
0x described the attack pattern in specific terms. According to the firm, malicious Hooks display highly competitive quotes during the quoting or simulation phase, drawing an aggregator’s routing engine toward their pools. Once a trade is actually executed, the Hook can alter pricing parameters or inject punitive fees, causing the user to receive far less than the quoted amount.
0x called this pattern "Quote Spoofing." It said the technique can involve detecting the EVM execution environment to distinguish simulated calls from real transactions, acting only during live execution, rotating parameters to make malicious behavior harder to reproduce consistently, and charging hidden fees of as much as 18% on active trading pairs.
In the most extreme cases cited by 0x, users received 50% less than the quoted amount. The company said these malicious Hooks extracted hundreds of thousands of dollars from users who had set loose slippage tolerances.
0x says the issue affects its own routing business
0x also framed the problem as one that directly affects its platform. The company said that since the start of 2026, it has routed 81.92 million trades with total volume of $42.67 billion, and about 70% of that flow involved Uniswap liquidity. As one of the largest external distribution channels for Uniswap liquidity, 0x said it has a direct business incentive to address the issue because malicious Hooks damage user execution quality, which in turn affects its brand and trading volume.
Hayden Adams says application-layer filtering is the answer
Adams’ rebuttal had three main parts.
First, he argued that anyone can deploy malicious contracts on Ethereum and that this is not a problem unique to v4. Malicious ERC-20 tokens, honeypots, and rug-pull pools existed in large numbers in the v2 and v3 eras as well. In that view, Hooks are simply a new technical vehicle for the same kind of abuse, built on users’ default trust in onchain assets.
Second, he said Uniswap’s official front end and API only integrate reviewed Hooks. At the same time, Niko (@saintniko), a member of Uniswap’s product team, said users trading through the official Uniswap API would only interact with audited Hooks. Uniswap’s position is that the protocol layer remains open while the application layer already applies filtering.
Third, Adams said aggregators should be responsible for their own routing choices. If 0x’s routing engine integrated more than 80,000 unreviewed Hooks without discrimination, he argued, that points to a risk-control problem on the aggregator side. The comparison made in the source was that just as a stock exchange would not be responsible for off-exchange fraud, the Uniswap protocol should not bear responsibility for routing mistakes made by third-party aggregators.
The dispute is not just about the headline numbers
The source also noted an important qualification. The figure of 84,163 refers to the total number of Hooks analyzed, not the total number that users actually interacted with. That base includes many zombie Hooks that were deployed but may never have been routed any flow or seen real transactions.
So while the numbers are striking, they describe 0x’s view of the risk surface across the Hook ecosystem rather than a count of malicious pools that users definitely touched in practice.
A familiar DeFi argument returns with v4
Once the technical details and public sparring are stripped away, the disagreement points back to a long-running DeFi question: openness in a permissionless system inevitably invites malicious actors.
Uniswap v4’s Hook system represents one of the biggest architectural shifts in the protocol’s history. In v2 and v3, pool logic was fixed and pool behavior was determined by protocol code. In v4, pool behavior is opened to developers, allowing anyone to write custom logic and run arbitrary code before and after trades. The source said this has enabled innovations such as StablePair Hook for dynamic fees, DualPool Hook for idle-fund yield, and Permissioned Pools for compliance checks. It has also created room for abuse.
Uniswap’s position is that the value created by openness outweighs the losses caused by malicious behavior, and that security screening should happen at the application layer through front ends, APIs, and aggregators rather than through protocol-level restrictions on innovation. The source linked that logic to Ethereum’s own design philosophy: Ethereum does not block malicious contracts from being deployed, but wallets and front ends filter them.
0x takes a different view. If more than half of Hooks are malicious, it argued, then the burden placed on application-layer filtering has become unreasonable. In 0x’s telling, the protocol layer should at least provide better tools so downstream integrators can identify and isolate malicious Hooks more effectively. The company said it has already used detection systems and pool auditing to keep malicious pools out of its routing engine, but the cost of that arms race is rising.
Risk differs depending on how users trade
For users, the practical impact depends on the route they choose.
- Users trading through Uniswap’s official front end at app.uniswap.org face relatively low exposure to malicious Hooks, because Uniswap says its API only integrates reviewed Hooks.
- Users trading through third-party aggregators such as 0x, 1inch, and Paraswap face risk that depends on each aggregator’s Hook filtering capability. 0x said it has already built detection and blocking mechanisms, while the source said defenses vary across other aggregators.
- Users interacting directly with onchain contracts, including through Etherscan or custom scripts, are fully exposed to malicious Hook risk. The source described this as an advanced-user path and also the highest-risk scenario.
The self-protection principle given in the source is straightforward: check whether the trading interface you use has a filtering mechanism for v4 Hooks. If that is unclear, stick to Uniswap’s official front end. It also advised keeping slippage tolerance at a reasonable level, as 0x’s report said malicious Hooks mainly target users with loose slippage settings.