Malicious Uniswap v4 Hooks Manipulate Swap Quotes, Study Finds

Liquidity aggregator 0x observed a sharp rise in malicious Uniswap v4 hooks that present favorable swap quotes but execute at much lower prices. In the most extreme cases, users received up to 50% less than the quoted amount.

Scope of the Analysis

0x examined 84,163 hooks across six blockchains using static analysis, dynamic analysis, and settled‑trade observations. The dataset, as of September 11, classified 19.4% of hooks as safe, 54.2% as malicious, and 26.4% as likely malicious.

Impact on Trades

Malicious routes were found to deliver up to half the quoted amount, though this represents a maximum shortfall rather than an average outcome. One Base hook trading the ETH/NVDAc pair recorded 6,516 fills, with 3,946 charged fills and fees ranging from 0% to 18% (median 18%). The hook collected $143,037 in fees by September 11.

How Hooks Work

Uniswap v4 hooks are optional external contracts that can execute before or after a swap, allowing custom logic such as dynamic fees or accounting. Because the code is written by third parties, it can be malicious or cause unintended effects. A malicious hook can win a routing comparison by appearing more attractive during quote generation, then settle for a worse price.

Industry Response

Routing providers are adapting. KyberSwap’s Smart Settlement prepares multiple candidate pools and selects the best on‑chain at execution, aiming to prevent quote manipulation. 0x reports that it routes 81.92 million trades and $42.67 billion in volume through September 14, with roughly 70% of transactions interacting with Uniswap liquidity.

Implications for Users

Wallets and aggregators must decide which pools to include in simulations and when to exclude suspicious sources. Excluding malicious hooks may make quoted prices appear less competitive, but can protect users from adverse execution. Transparency about vetted liquidity and expected quote‑settlement gaps could become a standard feature for DeFi interfaces.