Malicious Uniswap v4 hooks mislead traders with false quotes

An analysis by liquidity aggregator 0x examined 84,163 Uniswap v4 hooks across six blockchains and classified 54.2% as malicious, 26.4% as likely malicious and 19.4% as safe. The dataset is labeled Sept. 11.

Some hooks returned a quoted output during off-chain route comparisons but settled trades for as much as 50% less at execution. The largest gaps occurred in a subset of hooks that altered behavior between quote simulation and settlement.

Classification combined static code analysis, dynamic testing and observation of settled trades to determine whether a hook behaved differently at execution.

One hook on the Base chain trading an ETH/NVDAc pair recorded 6,516 fills, of which 3,946 charged fees. Fees in charged fills ranged up to 18%, with an 18% median when fees were applied. The hook collected $143,037 in total fees as of Sept. 11.

Uniswap v4 includes optional external hooks that can run before or after a swap and can change balance deltas. That capability supports features such as dynamic fees and custom accounting and also allows permissionless code to respond to quote requests in different ways.

Aggregators and routers simulate many pools to find the route that promises the most tokens. A pool that appears best in simulation can detect the quote request and settle the swap at a worse rate, reversing the simulated ranking. The analysis illustrates this with an example where a route offering 100 tokens at quote later settled for 80.

Routing infrastructure providers previously observed pools that change behavior depending on simulation conditions or execution signals. A separate March analysis of proprietary liquidity on Base found an automated market maker that outperformed reference quotes in simulation but settled consistently worse by about 5 to 10 basis points.

At scale, routing choices affect which liquidity users reach. 0x routed 81.92 million trades and $42.67 billion in volume in 2026 through Sept. 14, with about 70% of transactions touching Uniswap liquidity. The company removes liquidity sources from its routes until execution issues are fixed, even when the remaining displayed quotes look less competitive.

Some services are shifting more of the comparison toward settlement. One routing service described a Smart Settlement system that prepares multiple candidate pools for a swap hop, compares them on-chain at execution and atomically selects the candidate offering the highest output. Independent testing of simulated forks found zero or small median quote gaps for several sampled aggregators, suggesting the issue may vary by venue.

The analysis recommends shifting more price comparison to on-chain settlement checks and improving vetting of liquidity so displayed quotes more closely reflect actual execution.