Summary
Add a check_v4_hook_safety action that analyzes Uniswap V4 hook contract addresses to identify permission flags and assess security risks before users interact with hooked pools.
Motivation
Uniswap V4 hooks can be powerful but dangerous. The beforeSwapReturnDelta permission (bit 10) enables a known NoOp rug pull vector where a malicious hook can steal user funds by replacing swap logic entirely. Currently, agents have no way to warn users about hook risks before executing swaps.
Hook permissions are encoded in the contract address bits and can be decoded on-chain without needing ABIs or source code.
Proposed Actions
| Action |
Description |
check_v4_hook_safety |
Decode hook address permission bits and return a risk assessment |
get_pool_hook_info |
For a given token pair, check what hook (if any) is attached and its permissions |
Permission Flags to Decode
| Bit |
Permission |
Risk Level |
| 6 |
beforeSwap |
High |
| 7 |
afterSwap |
Medium |
| 10 |
beforeSwapReturnDelta |
CRITICAL |
| 11 |
afterSwapReturnDelta |
High |
| 2-5 |
Liquidity hooks |
Medium |
Implementation Notes
- Permission bits are encoded in the hook contract address (lowest 14 bits)
- Compare against known allowlisted hooks (Flaunch, Coinbase Verified Pools, etc.)
- Return structured risk score (Low/Medium/High/Critical)
- Could integrate with the existing swap actions to auto-warn before swapping through hooked pools
References
Summary
Add a
check_v4_hook_safetyaction that analyzes Uniswap V4 hook contract addresses to identify permission flags and assess security risks before users interact with hooked pools.Motivation
Uniswap V4 hooks can be powerful but dangerous. The
beforeSwapReturnDeltapermission (bit 10) enables a known NoOp rug pull vector where a malicious hook can steal user funds by replacing swap logic entirely. Currently, agents have no way to warn users about hook risks before executing swaps.Hook permissions are encoded in the contract address bits and can be decoded on-chain without needing ABIs or source code.
Proposed Actions
check_v4_hook_safetyget_pool_hook_infoPermission Flags to Decode
Implementation Notes
References