v4-security-foundations

A NoOp rug pull in Uniswap v4 hooks occurs when a malicious hook intercepts a swap and returns a NoOp state, effectively bypassing token settlement while manipulating delta accounting to extract pool liquidity. Properly verifying the caller and enforcing strict delta accounting prevents this critical vulnerability.

To prevent delta accounting mismatches in Uniswap v4 hooks, enforce strict settlement rules where all token deltas are fully reconciled before the lock closes. Applying pre-deployment security validation and using base hook templates ensures your custom contract correctly balances PoolManager interactions.

Uniswap v4 hook permissions for perpetual futures introduce risks like unauthorized caller access and fund drainage if misconfigured. Evaluating a threat modeling permission risk matrix for all 14 hook permissions identifies safe usage patterns to mitigate these vulnerabilities before mainnet deployment.

Auditing a Uniswap v4 hook before mainnet deployment requires running through comprehensive security checklists, verifying caller authentication, and checking gas budget guidelines. Pre-deployment security validation identifies critical attack vectors like missing PoolManager verification and delta accounting flaws.

Yes, this security guidance applies to custom AMMs, intent-based trading systems, and JIT liquidity systems interacting with the Uniswap v4 PoolManager. The threat modeling and permission risk assessments cover all PoolManager-interacting contracts to prevent fund-draining vulnerabilities.

Uniswap v4 hooks fail the PoolManager verification check when they lack caller authentication, allowing unauthorized contracts to execute privileged hook logic. Adding strict caller verification ensures only the designated PoolManager can trigger your hook callbacks, preventing unauthorized fund manipulation.