0x said Uniswap v4’s open Hooks framework is turning into a new onchain attack surface, with some malicious pools using a quote-now, settle-later mismatch to extract value from user trades.
In the post, published by 0x and translated by TechFlow, the firm said Hooks were introduced as a way to add custom logic to automated market makers. But after analyzing 84,163 Hooks across six chains, 0x said only 19.4% could be classified as safe. It labeled 54.2% as malicious and said another 26.4% were likely malicious. Some trades routed through malicious v4 Hooks, it said, delivered as much as 50% less than users were originally shown at quote time.
0x says 70% of its trades touched Uniswap liquidity this year
0x wrote that it has routed 81.92 million trades this year, with total volume reaching $42.67 billion. About 70% of those trades touched Uniswap liquidity. The firm said it receives dozens of requests every month to review and integrate v4 Hooks, and that it has recently seen a sharp increase in malicious Uniswap v4 Hooks.
According to 0x, these Hooks present one price during quote requests and another during settlement. The techniques vary, but the result is the same: aggregators, wallets, and trading apps can be misled into sending users into malicious pools.
Hooks expand AMM design, but also lower the cost of abuse
0x described v4 Hooks as an innovation layer for AMMs. Developers can deploy AMMs with custom logic that runs at key points in a pool’s lifecycle, including before and after swaps or when LP positions change. Anyone can deploy a Hook, and once it exists, it inherits access to one of DeFi’s most widely integrated liquidity venues.
That same openness, 0x said, gives bad actors more room to operate. A malicious Hook does not need to build a brand, convince users to visit a new interface, or create its own distribution channel. It only needs to make its pool look attractive to systems that aggregate liquidity.
If an aggregator sees what appears to be the best quote, 0x said, it has reason to route the trade there. If a wallet or trading app depends on that aggregator, the same infrastructure a user already trusts can end up sending the trade to a malicious pool.
Analysis covered 84,163 Hooks across six chains
0x said v4 Hooks have grown rapidly over the past 18 months. Its analysis covered 84,163 Hooks across six chains and used static analysis, dynamic analysis, and observations from settled trades.
The firm’s breakdown was as follows:
- 19.4% classified as safe
- 54.2% classified as malicious
- 26.4% classified as likely malicious
0x said the tactics differ. Some take fees at random, while others inspect the EVM environment to detect whether they are being queried for a quote. But the underlying pattern is the same: the price advertised through routing is not the price the user actually receives.
In the transactions it observed, 0x said trades routed through malicious v4 Hooks sometimes left users with as much as 50% less than the quoted amount once execution was complete.
Two onchain examples on Base and BNB Chain
The post included two specific Hook examples.
Base: ETH / NVDAc
- Hook address: 0x800cef53c3fd41109dffec62e5251bdd7acba5c7
- Chain: Base
- Pair: ETH / NVDAc
- Total trades: 6,516
- Charged trades: 3,946, or 60.6%
- Fee range: 0–18%
- Median fee across all trades: 17.96%
- Median fee when fees were charged: 18%
- Total fees collected: $143,000
BNB Chain: USDT / WBNB
- Hook address: 0x141984423d1a28242b3dd8888c5b0daa7b13c880
- Chain: BNB
- Pair: USDT / WBNB
- Total trades: 4,879
- Charged trades: 1,619, or 33.2%
- Fee range: 0–12.8%
- Median fee across all trades: 0%
- Median fee when fees were charged: 12.8%
- Total fees collected: $18,600
0x lays out three takeaways and says it has acted
0x said Hooks were designed to make Uniswap more extensible, but they also opened the door to a broad set of abusive strategies. The post said this summer showed that permissionless liquidity is not the same thing as trustworthy liquidity. As with the earlier rise of propAMMs, giving developers the flexibility to customize swap mechanics also gives malicious actors new tools to manipulate markets.
Based on that, 0x said routers need to ensure that the amount quoted by a pool matches what the pool actually delivers at execution. Apps, it added, need controls that let them quickly remove suspicious routes. Users, meanwhile, should understand that a displayed best quote only matters if the route behind it is safe.
0x also said it is taking concrete steps to protect its integrators and their users from what it described as constantly evolving onchain attackers. Those measures include detection technology and extremely strict due diligence on pools, with the aim of keeping such pools out of routing results.
The article was signed 0x@0xProject.
