We manage your security to weather the AI storm →
Get a quote

Uniswap v4 hook audit

A hook can run inside every swap and liquidity change on its pool, and often holds the money itself. Guardian audits the hook, its settlement with the PoolManager, and the factories and routers that call it.

Get a quote Read the Gamma v4 hook report
10+ Public reports covering a Uniswap v4 hook
100+ Criticals and Highs in those reports
12 Criticals and Highs in Gamma's limit order hook
20M+ Fuzzing runs per invariant on that hook

Smart contract audits for

  • GMX
  • USDT0
  • LayerZero
  • Ethena
  • Synthetix
  • Jupiter
  • Yuga Labs
  • Orderly Network
  • Olympus
  • Limit Break
  • M0
  • Dolomite

Onchain · Uniswap v4 Hook Audit

What a hook smart contract audit covers.

  • Hook permissions and address mining The flags mined into the hook’s address, read against the callbacks it implements and the ones it leaves open, such as beforeInitialize and beforeDonate.
  • Callback access control Every hook callback and unlockCallback reachable only by the PoolManager, and every helper meant for the hook reachable only by the hook.
  • Pool creation and pool keys Who can create a pool with your hook or initialize it first, and currency order, since Uniswap sorts the pair by address.
  • beforeSwap and afterSwap Return values and returned deltas, ticks read after a swap, and the tick Uniswap reports when a swap ends exactly on a boundary.
  • Delta settlement Every delta resolved through sync, settle, take, mint and burn, and no logic that trusts the PoolManager’s balance mid-unlock.
  • Hook-owned liquidity and accounting Positions the hook holds for users, each user’s share, fee growth, and custom accounting replayed from Uniswap’s tick crossings.
  • Hooks that custody user funds Deposits, orders and ERC-6909 claims the hook holds: who can withdraw, and whether one user’s cancel can burn another’s funds.
  • Native ETH and token behavior Payouts to contracts that cannot receive ETH, blacklistable tokens, decimals and low prices, all inside a swap that must not revert.
  • Dynamic fees Fees set in beforeSwap or through updateDynamicLPFee, held under Uniswap’s cap, and who can change the parameters.
  • Reentrancy and unlock sessions Reentry through ETH and token callbacks, and attacker-opened unlocks that net debt against shared accounts.
  • Routers and msg.sender The sender a hook sees is the router, so identity checks and allowlists depend on routers the hook trusts.
  • Limit orders, JIT liquidity and MEV Fills across every tick crossing, keeper execution, liquidity added around a swap, and prices pushed before an order lands.

Covers limit order and order book hooks, JIT and dynamic-fee hooks, permissioned pools, launch hooks, and protocols that run their own accounting on v4 pools on Ethereum and L2s such as Base, Arbitrum and Unichain. Keepers that execute orders are reviewed alongside, in an Offchain Automation Pentest.

Get a Uniswap v4 Hook Audit

Public findings

Uniswap v4 hook vulnerabilities Guardian has found.

Each card links a finding in a public Guardian report. All were resolved, except the one marked partially resolved.

  1. C-06Gamma v4 Limit Orders · Critical

    The limit order hook’s beforeSwap and afterSwap had no check that the PoolManager was calling. Anyone could call them directly and execute or clear limit orders that no swap had filled.

    Callback access Read the finding C-06 in the Gamma Uniswap V4 Limit Orders report

  2. C-05Gamma v4 Limit Orders · Critical

    Execution burned a position’s liquidity, but its owner could still cancel afterwards. That cancel burned the next user’s liquidity in the same range, a permanent loss.

    Custody Read the finding C-05 in the Gamma Uniswap V4 Limit Orders report

  3. C-01Perp City · Critical

    Perp City replayed tick crossings after each v4 swap to run its own fee and funding accounting. When a zeroForOne swap started on an initialized tick, the replay skipped that boundary, so LP fees could be credited to the wrong range.

    Hook accounting Read the finding C-01 in the Perp City Protocol Review report

  4. M-06Trueo Uniswap V4 · Medium

    When the PoolManager held too little to pay a user, the hook’s unlockCallback neither paid them nor recorded a deferred claim. Its closing dust clear then wiped the owed amount for good.

    Delta settlement Read the finding M-06 in the Trueo Uniswap V4 report

  5. H-13Clanker · High · Partially resolved

    A fee collector meant for the hook inside an unlock was public. An attacker could open an unlock, take tokens against a shared PositionManager account, then call it so the pending LP fees paid off that debt, keeping the tokens.

    Unlock sessions Read the finding H-13 in the Clanker Protocol Review report

  6. H-03Trueo Uniswap V4 · High

    Filled orders paid out through poolManager.take() inside the swap. One owner who could not receive ETH, or was blacklisted by the token, made every order in the stack fail.

    Native ETH Read the finding H-03 in the Trueo Uniswap V4 report

  7. H-01Manifest · High

    A permissioned pool’s AuthHook identified users through the router’s msgSender(). With no list of trusted routers, any caller could report any address and pass the check.

    Routers Read the finding H-01 in the Manifest Finance Protocol report

  8. H-04Gamma Unilaunch · High

    Anyone could call PoolManager.initialize() with a pending pool’s parameters before the factory did. The factory call reverted, and the pool lived on without its limit order and dynamic fee setup.

    Pool creation Read the finding H-04 in the Gamma Unilaunch Launchpad and Limit Order Book report

  9. H-02Trueo Uniswap V4 · High

    On downward swaps, the hook dropped orders from its order book without executing or deferring them. A swapper could strip an order by moving the price down across its upper tick.

    Limit orders Read the finding H-02 in the Trueo Uniswap V4 report

  10. M-04Universal · Medium

    The JIT hook paid swaps from its ERC-6909 claims, capped at the PoolManager’s USDC balance. Wrapping a swap in take, swap and settle emptied that balance, so the merchant’s USDC paid for all of it.

    JIT liquidity Read the finding M-04 in the Universal Hook Contracts report

  11. M-03M0 v4 Hooks · Medium

    M0’s deployment config set the hook’s tick range assuming wrapped M would always be token0. Uniswap sorts the pair by address, so on Optimism and Unichain the same range bounded the price the wrong way.

    Pool keys Read the finding M-03 in the M0 Uniswap V4 Hooks report

Onchain · How it runs

Two teams, and your hook’s accounting written as code.

  1. 01 / Two teams

    Two independent teams, one scope.

    Team A pairs expert manual review with the fuzzing suite. Team B runs Helix across every corner. Each cross-checks the other.

    • Expert manual review
    • Competitive incentives
    • Cross-checked findings

  2. 02 / Helix AI Auditor

    Helix, the leading AI Auditor.

    Hundreds of parallel agents spend billions of tokens across the entire codebase. Only human-verified findings reach the report.

    • Billions of tokens
    • Human-guided context
    • Human-triaged findings

  3. 03 / Invariant fuzzing

    An invariant suite around your hook.

    Core safety properties become executable invariants, fuzzed across every reachable state. On a hook, those are its accounting and custody rules.

    • Position liquidity equals the users’ sum
    • The hook never holds funds
    • No profit from atomic swaps

  4. 04 / Hook permission review

    Every path to the pool, not just the hook.

    The flags in the hook’s address are read against the callbacks it implements. Pool creation, routers and direct PoolManager calls are each tested the way an attacker would use them.

    • Address flags and callbacks
    • Pools created with your hook
    • Routers and direct calls

The suite stays with your code for every later change. M0’s hook report lists 10 invariants, from “Pool tick must be 0 or 1 after swap” to its allowlist checks, each fuzzed more than 10 million times.

Get a Uniswap v4 Hook Audit

Published work

Uniswap v4 hooks Guardian has reviewed.

“Our audit with Guardian way exceeded expectations in terms of the number of vulnerabilities they were able to find and the level of service that they provided.”
BPGamma
“Guardian’s work helped us not only better secure our smart contracts, but also refine specs and assumptions of the system overall.”
HugoTenor

Resource Hub

Uniswap v4 hooks security: background reading.

Questions

Uniswap v4 hook audit questions

Uniswap v4 is audited. Does our hook need its own audit?

Yes. Uniswap v4 had nine audits by six firms, but they cover Uniswap’s contracts, not yours. Every finding above sat in a team’s own hook, factory, config or accounting code.

Why do hook permissions need their own review?

Uniswap reads a hook’s permissions from bits in its deployed address, which developers mine with a CREATE2 salt. Adding a permission later means redeploying to a newly mined address. Manifest’s AuthHook lacked beforeInitialize and beforeDonate, so unless the pool was initialized in the deployment transaction, anyone could set its starting price, and anyone could donate.

Which invariants do you fuzz on a hook?

Accounting and custody rules. In Gamma’s report, “Position’s total liquidity equals the sum of all user liquidities” failed under fuzzing. Tenor’s suite held “The PoolManagerHook contract should never hold any funds as everything should be in Uniswap” across 10M+ runs.

Do you audit PancakeSwap Infinity hooks too?

Yes. Reflex’s report covers backrun hooks for both Uniswap v4 and PancakeSwap Infinity, and Clanker’s protocol review covers token launches into Uniswap v4 and PancakeSwap Infinity CL pools. Launch mechanics have their own page: Token Launchpad Audit.

How long does a hook audit take?

Five auditors reviewed M0’s hooks from June 2 to June 4, 2025, and six reviewed Gamma’s limit order hook from March 5 to March 17, 2025. The review of Trueo’s order book hook, with partial fills and deferred execution, ran from August 22 to October 16, 2025.

What do we get at the end?

Human-verified findings with proof-of-concept tests, a review of your fixes, and the invariant suite, which stays with your code. The report also says when more review is needed: Gamma’s report recommended an independent review at a frozen commit before deployment.

Smart Contract Audit

Other engagements

Start now

Get a quote for your Uniswap v4 hook audit.

Get a quote