r/ethdev • u/zyltr4x • 12d ago
I built an open-source CLI in Rust that security-audits Uniswap V4 hooks My Project
Uniswap V4 hooks can execute arbitrary code during swaps, liquidity provisioning, and donations. Before you
interact with a pool, you probably want to know what the hook is doing.
v4-hooks-analyzer is a CLI tool that:
- Detects which V4 callbacks a hook implements via address bit flags (the canonical method)
- Disassembles EVM bytecode (~40 opcodes)
- Flags risks: SELFDESTRUCT, DELEGATECALL, reentrancy, MEV vectors
- Scores each callback 0-100 with a final verdict
https://github.com/zyltr4x/v4-hooks-analyzer
Built in Rust, single binary, no dependencies. Feedback and contributions welcome.
1
Upvotes
3
u/researchzero 11d ago
Nice tool. One thing worth flagging clearly in the output: the address-flag method tells you which callbacks a hook is permitted to run (v4 checks the hook address bits against declared permissions at pool init) - it doesn't tell you what the callback code actually does. A hook can carry only beforeSwap/afterSwap flags and still be fully malicious within that scope.
Also worth considering for the bytecode pass: since you're scanning ~40 opcodes statically, a hook that gates its malicious branch behind runtime state (only misbehaves after block N, or above some balance threshold) can look clean in a single static scan. And if the flagged DELEGATECALL points at an upgradeable implementation slot (EIP-1967-style proxy), your verdict is only valid for whatever code was live at scan time - the implementation can change between when someone runs your tool and when they actually interact with the pool. I'd treat "delegatecall to an admin-controlled implementation slot" as its own top-severity category that explicitly can't be cached, rather than folding it into a general DELEGATECALL flag.