How Does Uniswap V4 Work?
Uniswap V4 is the latest version of the world's largest decentralized exchange. Its headline feature is 'hooks' — customizable plugins that developers can attach to trading pools to add features like dynamic fees, limit orders, and custom trading strategies. V4 also consolidates all pools into a single smart contract (reducing costs by up to 99% for pool creation) and supports native ETH trading. With $640M in TVL, V4 is still ramping up adoption alongside the established V3.
TVL
$708M
Sector
DEX
Risk Grade
B-
Value Grade
B
Core Mechanisms
Market Structure/AMM/Singleton Architecture
NovelAll pools consolidated into a single PoolManager contract, eliminating per-pool contract deployments and reducing gas costs
Singleton architecture concentrates all liquidity and pool logic in one contract. Reduces gas by ~99% for pool creation but increases systemic risk — a bug in PoolManager affects all pools.
Market Structure/AMM/Hook System
NovelPermissionless hooks allow arbitrary smart contract code to execute at 8 lifecycle points: before/after initialize, swap, modify position, and donate
Hooks are the defining V4 innovation. They enable dynamic fees, custom oracles, limit orders, and novel trading mechanisms. However, 36% of analyzed hooks were found potentially vulnerable to attacks.
Market Structure/AMM/Custom Accounting
NovelHooks can take full custody of pool assets via custom accounting, controlling deposits, withdrawals, and delta resolution
Custom accounting is the most dangerous V4 feature. Unlike vanilla hooks, custom accounting hooks control underlying liquidity — any bug is likely catastrophic.
Market Structure/AMM/Concentrated Liquidity
Inherited from V3: LPs allocate capital within custom price ranges for capital efficiency
Same concentrated liquidity model as V3, with the same IL and JIT liquidity risks, but enhanced by hooks that can modify behavior.
Value Capture/Fee Models/Dynamic Fees via Hooks
Hooks can implement dynamic fee structures that adjust based on market conditions, volatility, or custom logic
Dynamic fees enabled by hooks replace V3's static fee tiers. Can optimize for LPs but also introduce complexity and potential manipulation.
Market Structure/AMM/Flash Accounting
Transient storage-based flash accounting where balances are tracked temporarily within a transaction, settled at the end
Flash accounting reduces gas for multi-hop swaps by deferring settlement. Uses EIP-1153 transient storage for efficiency.
Governance/Voting/Token-weighted Voting
UNI token governance inherited from Uniswap governance framework
Same UNI governance as V2/V3. Protocol fee switch and governance parameters apply to V4.
Market Structure/AMM/Native ETH Support
V4 supports native ETH pools directly, eliminating the need for WETH wrapping
Native ETH support reduces gas costs and simplifies UX, but introduces different security considerations than WETH-based pools.
How the Pieces Interact
Any developer can deploy hooks that execute arbitrary code during swaps. Malicious or buggy hooks can steal LP funds, manipulate prices, or deny service. Users may not realize the hook attached to their pool is unaudited. The Cork Protocol $11M hack demonstrated this exact vector.
Custom accounting hooks take full control of pool assets, enabling sophisticated logic but creating a single point of failure. A bug in custom accounting logic can drain the entire pool's liquidity — these hooks effectively become the custodians of all deposited assets.
All V4 pools share the same PoolManager contract. While this reduces gas costs, a critical vulnerability in the PoolManager would expose all pools simultaneously, potentially putting the entire $640M+ TVL at risk in a single exploit.
Dynamic fee hooks could be engineered to front-run or sandwich trades by adjusting fees in real-time based on pending transaction data. This creates new MEV vectors beyond traditional sandwich attacks.
The permissionless hook ecosystem means most hooks will be unaudited or poorly audited. Users interact with pools without understanding the security posture of the attached hook. Aggregators may route through pools with vulnerable hooks unknowingly.
What Could Go Wrong
- Permissionless hooks execute arbitrary code on every swap, enabling novel attack vectors with 36% of analyzed hooks found potentially vulnerable
- Custom accounting hooks take full custody of pool assets, meaning a single hook bug can drain entire pool liquidity
- Cork Protocol $11M exploit (May 2025) demonstrated real-world hook access control failures in production
Malicious Hook Drains Pool via Custom Accounting Exploit
ElevatedTrigger: A popular hook with custom accounting contains a subtle vulnerability that goes undetected through audits, and is exploited once the pool accumulates significant liquidity
- 1.A hook with custom accounting gains adoption, attracting $50M+ in liquidity due to attractive yields or features — Significant capital is deposited in pools controlled by the hook's custom accounting logic
- 2.Attacker discovers a vulnerability in the hook's delta calculation or callback validation — Attacker can credit themselves with assets they never deposited or drain pool assets through manipulated callbacks
- 3.Attacker executes the exploit, draining all assets from pools using the vulnerable hook — LPs lose their entire deposit; the hook's pools are emptied
- 4.Market panic spreads to other V4 pools as users fear similar vulnerabilities in their hooks — V4 TVL drops 30-50% as LPs withdraw to avoid potential hook exploits
Risk Profile at a Glance
Overall: B- (32/100)
Lower score = safer