[Security Audit] Hook External Code Security Considerations

[BinShao1988]

Security Audit Finding

Auditor: BinShao1988 (https://github.com/BinShao1988)
Date: 2026-03-14
Severity: Medium

Description

The Hook system allows external contracts to be called during pool operations. While this enables powerful customization, it introduces security considerations that integrators should be aware of.

Current State

Hooks are called without verification of their code:

if (key.hooks.shouldCallBeforeSwap()) {
    delta = key.hooks.beforeSwap(msg.sender, key, params, hookData);
}

Security Considerations

1. Malicious hooks can return incorrect delta values
2. Hooks can execute arbitrary operations during callbacks
3. Hook failures can cause transaction reverts

Suggestions

1. Add a security checklist for Hook developers
2. Provide example audited Hook implementations
3. Document the trust assumptions clearly

Recommended Security Checklist for Hooks

• Implement proper access control
• Validate all input parameters
• Handle edge cases gracefully
• Test for reentrancy scenarios
• Consider gas limits

References

• https://github.com/Uniswap/v4-core/blob/main/src/PoolManager.sol

---

This finding was part of a security audit conducted on popular Ethereum projects.

[linear]

PROTO-1258

[ItsViolet]

"Hooks are called without verification of their code"
T-that's the POINT of a hook. To allow for arbitrary computation before and after an event fires, and clients of the liquidity pool in Uniswap v4 are notified beforehand of such hooks (as you cannot activate or deactivate a hook after initialisation, only modify it)

If it wasn't arbitrary, we'd call it a guardrail, not a hook.