Uniswap Labs launched aggregator hooks on Ethereum, Base, and Robinhood Chain on October 22, enabling its web app and API to route swaps through external liquidity venues including Curve, Fluid, and PancakeSwap. The company says seven external sources are live at launch, covering more than 90% of DEX activity on the three chains.
Competing Claims on Hook Security
The expansion comes amid a dispute over Uniswap v4 hook safety. In September, trading aggregator 0x published research examining 84,163 hooks across six chains, classifying 19.4% as safe, 54.2% as malicious, and 26.4% as "likely malicious." The study documented malicious hooks that quote one price during requests but execute at different prices, with some trades delivering as much as 50% less than quoted.
0x cited specific examples: one Base hook recorded 6,516 fills and $143,037 in fees, while a BNB Chain hook recorded 4,879 fills and $18,592. The research also described hooks that detect quoting environments and return different execution prices at settlement.
Uniswap's Response and Mitigation Steps
Uniswap founder Hayden Adams rejected the criticism, characterizing the issue as a "skill issue" and arguing that users should not route trades to bad hooks. He promoted Uniswap's own API as a way to reach broad liquidity at competitive prices while avoiding malicious hooks.
Uniswap updated its routing guidance on October 16, stating that its router automatically considers most eligible hooks and requires manual allowlisting for hooks that use certain permissions or specified address prefixes. The guidance notes that approval is a routing decision and leaves security audits outside its scope.
An OpenZeppelin audit released October 8 documented optional per-hop slippage checks on the router. These supplemental checks work alongside the router's existing minimum-output and maximum-input thresholds, though they can be omitted by passing an empty maxHopSlippage array.
Unresolved Questions
0x has questioned whether Uniswap's protections are sufficient. Engineer Duncan Townsend alleged that at least one malicious hook sat on Uniswap's allowlist, and director of engineering Philip Liao cited a Robinhood Chain transaction allegedly routed through Uniswap's interface in which a malicious hook took 4.8% of one routing leg.
The new adapters integrate Uniswap-developed integrations, distinct from the third-party hooks analyzed in 0x's research. Whether Uniswap screens the pools behind its adapters or vets the adapters themselves remains unconfirmed. External liquidity appears as Uniswap v4 pools through the adapters, and routes generate fees that contribute to UNI burns.
Execution-quality data and independent audits of the exact deployments will provide evidence of how well Uniswap's safeguards function in practice.
