v4-hook-delta-accounting

Solid

Detect Uniswap V4 hooks that fail to settle currency deltas with the PoolManager. Every credit/debit a hook creates (BeforeSwapDelta, afterSwap hookDelta, take/mint, donate, settle/sync) is tracked in the manager's transient nonzeroDeltaCount; if the books aren't flat when unlock returns, the whole transaction reverts (CurrencyNotSettled), and mismatched take/settle/donate either strands hook funds in the manager or lets a swap leave with unpaid debt. Activate on hooks returning deltas, calling take/settle/mint/burn/donate, or custom unlockCallback accounting.

AI & Automation 38 stars 5 forks Updated 2 days ago MIT

Install

View on GitHub

Quality Score: 82/100

Stars 20%
53
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Uniswap V4 hook delta-accounting detection ## When this applies Trigger on any of: - Callbacks returning `BeforeSwapDelta` or a non-zero `int128` `hookDelta` from `afterSwap`/`afterAddLiquidity`/`afterRemoveLiquidity` - Calls to `poolManager.take`, `settle`, `sync`, `mint`, `burn`, `donate`, `clear` - Custom `unlockCallback` that moves currency in/out of the manager - Hooks that charge custom fees, skim, or rebate by adjusting deltas - `currencyDelta` reads, or accounting that must net to zero before `unlock` returns - Donations to a pool, or take/settle pairs that should balance ## Detection patterns ### Hook takes currency but never settles (HIGH) ```solidity function afterSwap(address, PoolKey calldata key, ..., BalanceDelta, bytes calldata) external override returns (bytes4, int128) { poolManager.take(key.currency0, address(this), feeAmount); // ← creates a -debt for the hook return (this.afterSwap.selector, 0); // ← returns 0 delta, never settles } ``` `take` debits the hook's currency balance in the manager; with no matching `settle`/returned delta, `nonzeroDeltaCount != 0` and the entire `unlock` reverts `CurrencyNotSettled` — every swap on the pool reverts. **Signal:** `take`/`mint` without a balancing `settle`/`burn` or a non-zero returned `hookDelta` accounting for it. ### Returned delta not backed by a real transfer (HIGH) ```solidity return (this.afterSwap.selector, int128(feeAmount)); // claims to owe the pool feeAmo...

Details

Author
iktok90-design
Repository
iktok90-design/ai-smart-contract-auditor
Created
1 weeks ago
Last Updated
2 days ago
Language
JavaScript
License
MIT

Bundled in these plugins

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Solid

v4-hook-reentrancy-via-unlock

Detect reentrancy in Uniswap V4 hooks via the PoolManager unlock/lock callback. V4 uses a singleton PoolManager with transient lock state; all pool mutations happen inside an unlockCallback. A hook that makes external calls during beforeSwap/afterSwap/before*Liquidity (to tokens with hooks, arbitrary routers, or user-controlled contracts) can be re-entered, and because the manager is already unlocked the attacker can recursively swap/modify liquidity against stale hook state. Activate on any V4 hook performing external calls inside a callback, or custom unlockCallback logic.

38 Updated 2 days ago
iktok90-design
AI & Automation Solid

v4-hook-permission-flags-mismatch

Detect Uniswap V4 hooks whose address-encoded permission flags don't match the callbacks the hook actually implements. In V4 the hook's permissions live in the low bits of its deployed address (mined via CREATE2 salt) and must agree with getHookPermissions(); a callback the hook implements but whose flag bit is unset is never invoked, and a flag set without a real implementation makes pool initialization revert in Hooks.validateHookPermissions. Activate on any BaseHook/IHooks contract, getHookPermissions overrides, or hook address mining.

38 Updated 2 days ago
iktok90-design
AI & Automation Solid

fee-on-transfer

Detect fee-on-transfer / deflationary / rebasing token accounting bugs — crediting the *passed amount* instead of the measured balance delta. Activate whenever code calls transfer/transferFrom and then credits, mints shares for, or records the literal amount argument, in deposits, AMM swaps, lending collateral, vaults, staking, or bridges — without measuring balanceAfter - balanceBefore.

38 Updated 2 days ago
iktok90-design