THREAT OPS › Threat News › Building secure Uniswap v4 hooks
Building secure Uniswap v4 hooks
<p>Uniswap v4 hooks let developers add custom behavior to pools, including dynamic fees, custom accounting, and external integrations. This flexibility moves some security responsibilities into application and hook code.</p> <p>The Cork and Bunni exploits are two app-level incidents that show what can go wrong in that code. Together, they account for more than $20M in losses. Neither incident stem
Indicators of compromise
- https://www.cork.tech/blog/post-mortemurl
- https://solodit.cyfrin.io/issues/chat-points-manipulation-by-adding-liquidity-to-custom-pools-via-svfhook-contract-spearbit-none-semantic-layer-pdfurl
- https://blog.bunni.xyz/posts/exploit-post-mortem/url
- https://solodit.cyfrin.io/issues/jit-liquidity-penalty-can-be-bypassed-openzeppelin-none-openzeppelin-uniswap-hooks-v110-rc-1-audit-markdownurl
- https://solodit.cyfrin.io/issues/all-swaps-will-revert-if-the-dynamic-protocol-fee-is-enabled-since-hook-configsol-does-not-encode-the-afterswapreturndelta-permission-cyfrin-none-sorella-l2-angstrom-markdownurl
- https://developers.uniswap.org/docs/protocols/v4/securityurl
- https://www.trailofbits.com/contacturl