A pool can now run its own code during your swap. That is power — and attack surface.

Uniswap V4 hooks are custom smart contracts attached to liquidity pools that intercept swaps, liquidity changes and donations. Explained: hook permissions, legit uses, malicious hook patterns, and how safety scanners inspect them.

In Uniswap V4, a hook is a smart contract attached to a liquidity pool that runs custom logic around pool events: before and after swaps, before and after liquidity is added or removed, and on donations. Hooks are what make V4 an extensible platform instead of a fixed AMM — and on chains like Robinhood Chain, where V4 liquidity dominates, understanding hooks is essential for safe trading.

How hooks work technically

When a pool is created it specifies a hook contract address. The hook's address bits declare which permissions it uses — for example beforeSwap, afterSwap, beforeAddLiquidity, afterRemoveLiquidity. During every swap, the V4 pool manager calls the declared callbacks. A hook can adjust amounts, charge dynamic fees, enforce allowlists, or revert the swap entirely under conditions it defines.

Legitimate hook patterns

• Dynamic fees that respond to volatility
• TWAP/time-weighted orders executed against pool flow
• On-chain limit orders encoded as hooks
• MEV internalization that rebates liquidity providers
• KY/allowlist gates for regulated assets

Malicious hook patterns (why scanners exist)

The same callback power enables abuse that classic token-contract scanners miss completely:

• Transfer-blocking sells: the hook lets buys through and reverts sells except for whitelisted addresses — the modern honeypot.
• Asymmetric fees: buy fee near zero, sell fee confiscatory (e.g. 90%), so the chart looks tradable until you exit.
• Balance manipulation between callbacks: a hook that snapshots or mutates balances between beforeSwap and afterSwap can skim output invisibly to naive quoters.
• Owner-mutable trap parameters: a pool that behaves honestly at launch and flips hostile when the owner updates hook state.

How Loxley AI scans hooks on Robinhood Chain

Loxley's safety stack is hook-first: permission-bit analysis, bytecode pattern detection for the malicious patterns above, pool-state verification, token-hook interplay scoring, and hook-aware quote simulation. Danger and critical verdicts hard-block unattended auto-buy; manual buyers see explicit warnings; sells are never blocked. Full detail in the hook scanner documentation.

FAQ

Is every hooked pool dangerous?

No. Hooks are neutral infrastructure. The point is that a hooked pool must be analyzed at the hook layer, while most multi-chain bots only scan the token contract.

Can a hook be upgraded after launch?

The hook address of a pool is fixed at creation, but hooks with owner-mutable state can change behavior. Scanners should flag mutable parameters as a risk factor.

Technical deep-dive →

Built for operators, not slippage goblins. Talk to us →