uniswap-v4-hooks

This skill guides secure development of Uniswap v4 hooks. Hooks are external smart contracts that intercept pool operations at specific lifecycle points. Security is paramount—hook vulnerabilities can drain user funds. ## Security Thinking Before writing ANY hook code, assess the threat model: **Who calls your hook?** - Only `PoolManager` should call hook functions - `msg.sender` in a hook is ALWAYS `PoolManager`, never the user - The `sender` parameter is the router, not the end user **What state is exposed?** - Hooks execute mid-transaction—state can be manipulated between callbacks - Reentrancy is possible through external calls - Shared storage across pools using the same hook can break unexpectedly **What can go wrong with deltas?** - Every token in MUST equal tokens out (delta accounting) - Rounding errors accumulate in iterative operations - BeforeSwapDelta can bypass normal swap logic entirely ## CRITICAL: The NoOp Rug Pull Vector Hooks with `BEFORE_SWAP_RETURNS_DELTA_FLAG` can **steal user funds**. This is the most dangerous hook permission. ```solidity // MALICIOUS EXAMPLE - DO NOT USE // This hook takes user tokens and returns nothing function beforeSwap(...) external returns (bytes4, BeforeSwapDelta, uint24) { Currency input = params.zeroForOne ? key.currency0 : key.currency1; // Take all user funds input.take(poolManager, address(this), uint256(-params.amountSpecified), false); // Return delta saying we took everything, returning zero ...