Trail of Bits analyzed dozens of audit findings and real-world exploits to identify seven recurring failure patterns in Uniswap v4 hook development. The Cork ($12M) and Bunni ($8.4M) exploits demonstrate that while the v4 PoolManager enforces protocol-level settlement invariants, application-specific hook code remains vulnerable to missing caller checks, unvalidated pool trust, accounting bugs, hook timing errors, permission bit mismatches, callback blocking, and state mutation during nested callbacks. These patterns serve as a secure-development checklist for builders and a review framework for auditors.
Uniswap v4
1 post
Building secure Uniswap v4 hooks