Execution integrity for Uniswap v4
The quote comes from eth_call. The charge happens in a transaction. A hook is arbitrary code that runs in both, and can tell them apart.
tx.gaspriceThey named one: 0x800cef53… on Base, an ETH/NVDAc pool: a median fee of 18% when it charged, and $143,037 taken.
Their analysis, their numbers. Cited, not reproduced here.
Skill issue, don’t route to bad hooks
Pointing integrators at the Uniswap API, which “avoids malicious hooks”. He is right, and this repo is an attempt to make that advice executable, because it leaves open the question an integrator actually faces: how do you know which ones are bad, at the moment you route?
PoolManager emits Swap between beforeSwap and afterSwap, so its amounts exclude whatever the hook takes in afterSwap. Measured on Base, for a hook taking exactly one percent:
Swap eventswap() return valueRead from the event, that hook appears to hand users an extra percent. It charges them. Any analytics built on Swap events under-reports exactly the hooks that take the most.
A uniform random sample of Base fills, each re-quoted against the state immediately before it. These are the hooks that survived their own measurement noise.
| Hook | Fills | Net charged | Median excess | In hooklist |
|---|---|---|---|---|
| 0xa5c4a1be…5a4145 | 36 | 22% | 99 bps | no |
| 0x1f91c998…e02acc | 782 | 11% | 400 bps | yes |
| 0x0d5d83c5…aba8cc | 41 | 17% | 45 bps | no |
| 0x985c14ba…ca2acc | 751 | 3% | 142 bps | yes |
Roughly half of all charged fills in this sample are measurement error, quantified and published beside the result rather than left for a reader to find. Charged and over-delivered counts per hook.
Static bytecode analysis, differential eth_call, and debug_traceCall were each scored against what hooks actually did to settled trades. Every one of them scored zero recall. Only re-quoting settled trades caught anything, and that works after someone has already been paid less than they were quoted.
A score tells you what a hook did last week. It cannot tell you what it is doing to your transaction right now.
Caught on mainnet
Fork Base at block 51,247,545 and send one identical swap twice, from two callers, into a pool behind hook 0xf54473f4…. Neither caller is known to the hook. Both were deployed seconds earlier.
Charged 707 bps more for the same trade. Sworn probed, saw what it was actually being offered, and settled on the hookless pool beside it for 17,438,404, recovering 672 bps.
The offline pipeline in this repo did not flag that hook. It saw a handful of charged fills against nearly as many over-delivered ones and correctly refused to call it a signal. A full re-quote of 10,000 fills, with a noise floor and a sensitivity sweep, missed a hook that one in-transaction probe caught immediately. That tells against this measurement as much as anyone else’s.
The solution
Every router today asks a hook a question off-chain, then acts on the answer on-chain. Those are two different calls, and a hook can answer them differently. Sworn makes the quote and the trade the same call.
contracts/src/SwornRouter.sol, verbatim
// 4. The assertion the whole design rests on.
if (execIn != amountsIn[chosen] || execOut != amountsOut[chosen]) {
revert Divergence(chosen, probed, executed);
}Both sides are checked, so a hook cannot quietly take more input either. That is the entire product. Everything below exists to make those four lines mean something.
To cheat Sworn a hook would have to answer the probe honestly and the execution dishonestly, which means telling them apart. Here is everything it could try.
tx.gasprice, tx.origin, block.*msg.sender, call depth, calldataprobing flag is read only after the last externally observable call.gasleft()A hook that wants to overcharge you has to overcharge the probe by the same amount, at which point Sworn routes around it and the hook earns nothing.
Twelve attacker capabilities, each with a working fixture in ToxicHooks.sol that tries the attack and fails.
For every measured fill, every other pool that could have filled the same trade was quoted against the same pre-fill state. Probing costs a fixed amount of gas and saves a proportion of the trade, so it pays above a trade size and not below it.
Only 7.3% of these fills pay out in a token this repo can value from the chain, and 2 candidate routes quoting implausible multiples were excluded as mispriced dust rather than counted as recovered value. Both are published so the dollar figures can be discounted accordingly.