v4-security-foundations

Prevent reentrancy attacks in Uniswap v4 hooks by validating PoolManager access, avoiding tx.origin, and enforcing strict router allowlists. Safe data handling and delta accounting patterns ensure funds balance correctly and prevent malicious callbacks from draining user funds.

Decoding hookData in Uniswap v4 risks data exposure and unauthorized access if not properly validated. Mitigate these risks by verifying caller identity, applying router verification patterns, and safely decoding payload data to ensure only permitted routers trigger specific hook callbacks.

Verify PoolManager and router identity by implementing access control patterns that check msg.sender against allowed router addresses. Do not rely on tx.origin for verification, and ensure your hook validates the calling router to prevent unauthorized execution of before/after swap callbacks.

Handle fee-on-transfer tokens safely in v4 hooks by implementing accurate delta accounting and safe settlement patterns. Ensure your hook measures actual received token amounts rather than expected amounts to prevent accounting discrepancies and secure funds balance during swaps.

Secure Uniswap v4 hook points by consulting a permission flags risk matrix to understand risk levels for each callback. Prove correct guardrails are in place for before/after swap hooks and delta permissions to restrict unauthorized actions and mitigate potential fund drainage.

A Uniswap v4 hook security audit requires following a security checklist to validate PoolManager access, verify router allowlists, and check delta accounting. Review threat models and ensure safe data handling to confirm correct guardrails before deploying smart contracts.