Trail of Bits identifies seven recurring security failure patterns in Uniswap v4 hook development, drawing from audit findings and real-world exploits including Cork (~$12M) and Bunni ($8.4M). The patterns cover missing caller checks on hook callbacks, trusting unvalidated user-supplied PoolKey values, custom accounting bugs that satisfy settlement invariants while leaking value, placing logic in the wrong hook callback, address permission bit mismatches, non-essential code blocking core user flows, and shared state mutation between callbacks. Each pattern includes concrete fixes and real-world examples. The post concludes with an 8-item checklist for hook developers and 7 audit questions for reviewers.
Table of contents
What the PoolManager guarantees1. Anyone can call your hook2. Treating any pool as legitimate3. Custom accounting leaks value4. Right logic, wrong hook5. Address bits are part of the API6. Hook failures can block pool actions7. State can change during a callback sequenceBuilding secure hooksAuditing v4 hooksSecurity responsibilities for hook developers190 Impressions