uniswap-v4-hooks

This skill guides secure development of Uniswap v4 hooks. Hooks are external smart contracts that intercept pool operations at specific lifecycle points. Security is paramount—hook vulnerabilities can drain user funds.

Security Thinking

Before writing ANY hook code, assess the threat model:

Who calls your hook?

• Only PoolManager should call hook functions
• msg.sender in a hook is ALWAYS PoolManager, never the user
• The sender parameter is the router, not the end user

What state is exposed?

• Hooks execute mid-transaction—state can be manipulated between callbacks
• Reentrancy is possible through external calls
• Shared storage across pools using the same hook can break unexpectedly