It’s time to get real about hooks.
This year 0x has routed 81.92 million trades and $42.67 billion in volume, with roughly ~70% of transactions touching Uniswap liquidity.
And we field dozens of requests to review and integrate v4 hooks every month, so we’ve seen the good and the bad. But lately, we’ve been seeing the ugly, too.
Hooks enable genuinely useful applications, including custom trading rules and liquidity management. Our argument isn’t that those use cases shouldn’t exist or that teams shouldn't build with them; it’s that permissionless hook behavior introduces significant new tradeoffs for trade execution and aggregation, especially when malicious pools can advertise quotes that don’t match what users ultimately receive.
In the last few weeks, 0x has seen an alarming increase in malicious Uniswap v4 hooks, designed to price swaps one way in quote requests and another way at the time of settlement. Malicious hooks use multiple patterns, but the result is the same: stealing from users by spoofing aggregators, wallets, and trading apps.
Here’s what we’ve observed onchain and what actions we’ve taken at 0x.
The problem with hooks: open to builders and bad actors
To start with the good, v4 hooks offered the AMM space an innovation layer: a way for builders to spin up AMMs with custom logic that can execute at key points in a pool’s lifecycle, such as before or after a swap or LP position changes. Hooks can be designed to do anything, deployed by anyone, and the moment they exist, they inherit the distribution of the most widely integrated liquidity venue in DeFi.
Therein lies the core tradeoff: the same design that gives legitimate builders more expressive control over liquidity and execution also makes it harder for aggregators to determine which pools can be trusted.
Beyond the friction this eliminated for builders, hooks also create infinite room for malicious behavior. A malicious hook doesn’t need to build a recognizable brand, convince users to visit a new interface, or bootstrap its own distribution. It only needs to make its pool look attractive to the systems that aggregate liquidity.
If an aggregator sees the best quote, it has a reason to route there. If a wallet or trading app relies on that aggregator, the malicious pool can be reached through the same infrastructure users already trust.
Malicious hooks
What we’ve seen over the last 18 months is an explosion of v4 hooks. Our analysis (leveraging static analysis, dynamic analysis, and observation of settled trades) of 84,163 hooks across 6 chains determined that only 19.4% are safe, 54.2% are malicious, and 26.4% are likely malicious.
Data as of 11 September 2026
The patterns vary — some operate like a dice roll, some inspect the EVM environment to detect quoting — but the underlying behavior is consistent: the price a route advertises is not the price a user can reliably expect to receive. We’ve observed trades routed through malicious v4 deliver as much as 50% less at execution than the amount quoted to the user.
Here are a few examples:
Hook: 0x800cef53c3fd41109dffec62e5251bdd7acba5c7
- Chain: Base
- Pair: ETH/NVDAc
- Total fills: 6,516
- Charged fills: 3,946 (60.6%)
- Fee range: 0-18%
- Median fee on all fills: 17.96%
- Median fee when charged: 18%
- Total fees charged (USD): $143,037
Data as of 11 September 2026
Hook: 0x141984423d1a28242b3dd8888c5b0daa7b13c880
- Chain: BNB
- Pair: USDT/WBNB
- Total fills: 4,879
- Charged fills: 1,619 (33.2%)
- Fee range: 0-12.8%
- Median fee on all fills: 0%
- Median fee when charged: 12.8%
- Total fees charged (USD): $18,592
Data as of 11 September 2026
The takeaway
Hooks were designed to make Uniswap more extensible, but they also opened up infinite opportunities for abuse. Permissionless extensibility comes with execution and trust tradeoffs that routers, apps, and users can’t ignore. This summer has shown that permissionless liquidity does not automatically mean trusted liquidity. As with the rise of propAMMs, the same flexibility that lets builders customize how swaps work also gives bad actors new ways to manipulate them. To that end, we believe:
- Routers need to ensure a pool’s quoted amount matches its actual execution behavior.
- Apps need controls for quickly removing suspicious routes.
- Users should know that the best displayed quote is only useful if the route behind it is safe.
And just as we have for the past decade, we’re taking concrete steps to keep our integrators and their users safe from the ever-changing cast of bad actors onchain. At 0x, we’ve taken several steps to prevent these pools from appearing in routes, including advanced detection techniques and extreme due diligence around pool vetting.
Thank you for building with 0x.
This blog was originally posted to 0x.org.
