v4 Hook Security Foundations

Security-first guide for building Uniswap v4 hooks. Hook vulnerabilities can drain user funds—understand these concepts before writing any hook code.

Threat Model

Before writing code, understand the v4 security context:

Threat Area	Description	Mitigation
Caller Verification	Only `PoolManager` should invoke hook functions	Verify `msg.sender == address(poolManager)`
Sender Identity	`msg.sender` always equals PoolManager, never the end user	Use `sender` parameter for user identity
Router Context	The `sender` parameter identifies the router, not the user	Implement router allowlisting
State Exposure	Hook state is readable during mid-transaction execution	Avoid storing sensitive data on-chain
Reentrancy Surface	External calls from hooks can enable reentrancy	Use reentrancy guards; minimize external calls

All 14 hook permissions with associated risk levels: