Liquidity aggregator 0x reported on September 14 that malicious Uniswap v4 hooks have increased in recent weeks, quoting one price while settling at another. In the most extreme trades observed, users received as much as 50% less at execution than the amount displayed in the quote.
0x examined 84,163 hooks across six chains using static analysis, dynamic analysis, and settled-trade observations. The dataset, labeled as of September 11, classified 19.4% as safe, 54.2% as malicious, and 26.4% as likely malicious.
How the Attacks Work
Liquidity aggregators search multiple pools, estimate outputs, and typically favor routes promising the most tokens. A malicious pool can win the order by appearing unusually attractive during comparison, then deliver less favorable execution.
One Base hook trading ETH/NVDAc showed 6,516 fills, including 3,946 charged fills. Fees ranged from 0% to 18%, with an 18% median when charged, collecting $143,037 in total fees as of September 11.
Uniswap v4 hooks are optional external contracts that execute before or after a swap. While this flexibility enables legitimate features such as dynamic fees and custom accounting, Uniswap warns that independent third parties write hooks and the code may be malicious or cause unintended consequences.
Broader Context and Response
In July, routing infrastructure provider Enso documented toxic pools, including a Polygon Uniswap v4 hook using execution-environment signals and an Ethereum Curve pool whose oracle behavior changed under simulation-like conditions. A March 0x study found related patterns in proprietary liquidity on Base, where one market maker beat a reference AMM in 100% of sampled quote-time observations but settled consistently worse, typically by 0.05% to 0.10%.
0x said it cuts off liquidity sources until execution issues are fixed, even when its displayed quotes then appear less competitive. ClearTrace's September 8 scorecard found zero or small median quote gaps for several sampled aggregators in Ethereum fork simulations.
Some systems are moving more of the comparison toward settlement. KyberSwap said its Smart Settlement prepares multiple candidate pools for a swap hop, compares them on-chain at execution, and atomically selects the candidate offering the highest output.
0x routed 81.92 million trades and $42.67 billion in volume during 2026 through September 14, with roughly 70% of transactions touching Uniswap liquidity. At that scale, routing decisions can shape which markets users can reach and what price they see.
