PaperlayerView exact revision on arXiv

Source-linked AI summary

An Empirical Study of Undisclosed Charges in Hook-Based Decentralized Exchanges

Kai Ma, Tianle Sun, Shun Zhou, Boyao Yang, Ningyu He, Haoyu Wang

arXiv:2610.36682v1cs.CR

TL;DR

Hook deductions can bypass standard pool-fee displays, while prior Hook-AMM studies leave their prevalence, frequency, and cost open. This study combines bytecode analysis with historical settlement reconstruction to measure those charges across production deployments. It finds charging capability in 24.30% of registered Hooks and records $3.97M in Hook revenue, supporting disclosure of Hook deductions alongside standard fees.

  • Problem

    Hook deductions can bypass standard pool-fee displays, and existing Hook-AMM studies leave their prevalence, frequency, and trader cost open.

    Source: §1 · p. 1

  • Method

    The study reconstructs Hook settlement adjustments from bytecode, checks pool permissions, and analyzes historical settlements to measure charge use and economic impact.

    Source: §1 · p. 2, §3.1 · p. 3

  • Results

    24.30% of registered Hooks can impose additional charges, and historical accounting records $3.97M in Hook revenue.

    Source: §10 · p. 11

  • Takeaways & Limitations

    Fee disclosure should itemize additional Hook deductions alongside standard fees and reconcile quoted breakdowns with actual settlement.

    Source: §10 · p. 11, §8 · p. 11

    Economic-burden bounds use a conservative step bound M=2,000,000 based on monotonic price progression through the protocol’s finite tick range.

    Source: §7 · p. 10

Abstract

from arXiv · show

Many decentralized exchanges use automated market makers (AMMs) to trade assets against liquidity pools. Modern AMMs allow third-party contracts, called Hooks, to customize this process. However, Hooks can impose additional deductions that fee breakdowns based on standard pool parameters do not itemize. We present, to the best of our knowledge, the first large-scale empirical study of the production Hook ecosystem, focusing on these undisclosed settlement charges. Our study covers 7,873 Hook deployments, 50,011 pools, and 296M pool events on Uniswap v4 and PancakeSwap Infinity across Ethereum and BNB Smart Chain (BSC) through August 1, 2026. We develop a bytecode analysis that reconstructs how Hooks change traders' payments and receipts, separating charges from exchanged assets and standard fees. We then reconstruct historical settlements to measure charging frequency and economic burden. We find that direct settlement adjustment is the dominant Hook capability, supported by 71.37% of registered Hooks. Charging capability is widespread and often exercised: 24.30% of Hooks can impose undisclosed deductions, and these deductions occur in 59.23% of accounted swaps involving such Hooks. These charges generate millions of dollars in revenue, with $3.97M recorded across Hooks with available token prices. These findings reveal a gap between standard fee displays and actual trading costs, motivating explicit disclosure of Hook deductions alongside standard fees.

1 Introduction

Hooks customize AMM settlement and can deduct additional amounts that standard fee displays do not itemize. The study measures how widespread these charges are, how often they occur, and what they cost traders.

1 Introduction

  • Hooks can deduct additional amounts beyond standard pool fees, which standard-parameter fee displays do not separately itemize.The HXIC example retains 269K HXIC, or 18% of the core output, while the trader receives the quoted output.Source: §1 · p. 1, Figure 1 · p. 1
  • Existing Hook-AMM studies focus on architectural overviews or general security evaluations, leaving charge prevalence, frequency, and cost open.Deployment counts alone do not show how widely Hooks are used; measurement also requires pool activity and settlement reconstruction.Source: §1 · pp. 1–2
  • The study analyzes 7,873 registered Hooks and 50,011 Hook-enabled pools on Uniswap v4 and PancakeSwap Infinity across Ethereum and BSC through August 1, 2026.It combines bytecode analysis, pool-configuration checks, and historical settlement reconstruction.Source: §1 · p. 2
  • 24.30% of registered Hooks can impose additional charges; their pools account for 34.55% of Hook-enabled pools but 2.69% of recorded TVL.The study also records $3.97M in Hook revenue; among accounted Uniswap v4 swaps involving charging-capable Hooks, charges occur more often on BSC than Ethereum (75.76% vs. 43.53%), but mean charges per priced swap are lower (below $0.41 vs. $8.17).Source: §1 · p. 2

2 Background

Hook callbacks can adjust settlement amounts beyond the core exchange. The paper distinguishes these adjustments from standard fees and exchanged assets to identify additional, unitemized deductions.

Hook-Based AMM Architecture

  • PoolManager contracts maintain pool state and execute operations, while attached Hooks customize them through callbacks such as beforeSwap and afterSwap.Pool permissions determine which callbacks run, and return-delta permissions determine whether adjustments affect settlement.Source: §2 · p. 2

Swap Fees and Hook Charges

  • Standard swap fees are included in the core exchange calculation and recorded in swapDelta, while callback returns can further adjust the user’s final payment or receipt.The PoolManager combines callback adjustments into hookDelta and subtracts it from swapDelta; a positive output-side adjustment reduces the user’s receipt.Source: §2 · p. 2

Undisclosed Settlement Charges

  • Undisclosed settlement charges are unitemized Hook deductions beyond exchanged token amounts and standard pool fees.Because they bypass standard pool-fee parameters, fee breakdowns based on those parameters omit them.Source: §2 · pp. 2–3
  • The HXIC example retains 269K HXIC above the quoted output and returns that amount as a settlement adjustment, leaving the trader with the quoted 1,227K HXIC.The standard fee breakdown omits the 269K HXIC charge.Source: §2 · p. 3

3 Methodology & Implementation

The methodology reconstructs Hook settlement adjustments from deployed bytecode, separates candidate charges from exchanges and standard fees, and checks whether charges are feasible and collectible. The implementation supports proxies and validates core swap amounts when needed.

3.1 Methodology

  • The pipeline resolves Hook implementations, reconstructs callback effects into net hookDelta, then identifies candidate charges and tests their feasibility and collection.It separately checks deployed pool permissions and historical use.Source: §3.1 · p. 3
  • Callback summaries retain path conditions, state updates, external calls, and returned adjustments recovered through symbolic execution of callback bytecode.For proxy Hooks, execution uses implementation code while modeling proxy storage.Source: §3.1 · p. 3
  • When swap callbacks share inputs or storage, the reconstructor links their summaries, substitutes state written by beforeSwap into afterSwap, and discards incompatible paths.It also links beforeSwap’s amount changes to the core swap amounts used by afterSwap.Source: §3.1 · pp. 3–4
  • Only adjustments enabled by return-delta permissions contribute to net hookDelta; standard-fee lpFeeOverride is excluded, and opposing adjustments can cancel.The charge identifier searches swap and liquidity paths separately and records the required callbacks and permissions.Source: §3.1 · p. 4
  • The identifier separates exchanged amounts from candidate deductions, then tests whether a candidate can be positive under reconstructed execution conditions.Partial replacements are treated as exchanges in specified cases; positive afterSwap deductions can remain candidates even when the net adjustment is negative.Source: §3.1 · p. 4
  • For candidates dependent on core swap amounts, validation checks that the pool can produce those amounts and that the Hook collects the charge in the same execution.It uses synthetic pools for specified Uniswap v4 paths or seeded joint execution for selected BSC paths; unresolved, unvalidated, and timed-out paths remain unresolved.Source: §3.1 · p. 4, §3.2 · p. 5

3.2 Implementation

  • The implementation analyzes bytecode without requiring verified source code and uses a custom 256-bit symbolic EVM executor to recover callback returns.Proxy resolution covers common minimal-proxy, clone, and EIP-1967 proxy forms.Source: §3.2 · p. 4
  • Symbolic pool fields are constrained to protocol-valid values, including currency ordering, tick spacing, fee bounds, and callback permissions.The valid constraints differ by platform and include PancakeSwap Infinity CL packed-parameter and price-limit conditions.Source: §3.2 · p. 5

4 Data Collection

The dataset covers four Hook-based platform configurations on Ethereum and BSC from their respective PoolManager deployments through August 1, 2026. It combines pool and activity events with traces and settlement-reconstruction candidates.

4 Data Collection

  • The dataset contains 50,011 Hook pools and 7,873 registered Hooks across Uniswap v4 on Ethereum and BSC and PancakeSwap Infinity CL and Bin pools on BSC.Observation begins January 23, 2025 for Ethereum v4, January 21, 2025 for BSC v4, and March 6, 2025 for Infinity, ending August 1, 2026.Source: §4 · p. 5
  • Call traces were retained for 2,146,387 of 6,907,077 successful transactions with receipts (31.08%), and historical charge analysis also used targeted trace collection for 1,913 charging Hooks.Across 2,175,181 candidate transactions, settlement reconstruction completed for 2,165,434 and left 9,747 without an analyzed result.Source: §4 · p. 5
  • Reported TVL values were summed for 49,378 of 50,011 pools, with missing or invalid values treated as unknown.The $114.260M total covers Hook pools on Ethereum and BSC; the $906.62M protocol total includes pools without Hooks across all chains.Source: §4 · p. 5

5 RQ1: Hook Ecosystem Characterization

Across four platforms, the study characterizes Hook deployments, liquidity, activity, code inspectability, upgradeability, and capabilities. Settlement adjustment is much more common than standard LP-fee management, while pool counts only weakly track recorded activity.

5 RQ1: Hook Ecosystem Characterization

  • 21.23% of code-resolved Hooks share bytecode; singleton-bytecode pools hold 99.3% and 99.4% of Uniswap TVL, while code shared across two to five deployments holds 62.0% in PancakeSwap CL and 99.7% in Bin.These shares differ across the four platform configurations.Source: §5 · p. 6, Figure 3 · p. 6
  • The top ten Hooks account for 63.81% of recorded Hook-transaction pairs, and transaction counts correlate weakly with attached pool counts (Spearman ρ=0.145).Figure 4 ranks Hooks by activity per platform and compares transaction counts with attached pools.Source: §5 · p. 6, Figure 4 · p. 6
  • 38.12% of registered Hook addresses have verified source; among bytecodes deployed over 100 times, all 355 Ethereum deployments are verified and none of the 250 BSC deployments are.Of 49 upgrades after pool creation, 10 have source and runtime evidence of rule changes, 11 show controlled runtime differences, and 28 establish implementation replacement only.Source: §5 · p. 6
  • The team classified 7,082 deployments using reachable callback paths under each pool configuration, retained multiple labels when supported, and generated evidence cards for 6,463 recovered bytecodes.Labeling required implementation evidence, not function names or event signatures alone; cards summarize callbacks, settlement and state effects, external calls, guards, and supporting evidence.Source: §5 · pp. 6–7
  • 71.37% of registered Hooks can directly adjust settlement amounts, compared with 6.15% that can adjust standard LP-fee rates.The study calls the former capability custom accounting.Source: §5 · p. 7

6 RQ2: Undisclosed Charge Prevalence

The study identifies which Hooks can impose additional settlement charges and measures their historical occurrence. Charging capability is common, spans many pools but little recorded TVL, and its charging paths are enabled in most associated pools.

6 RQ2: Undisclosed Charge Prevalence

  • 24.30% of registered Hooks can impose undisclosed settlement charges; all 100 uniformly sampled static positives passed the authors’ audit.The identified deployments span 1,427 unique bytecodes.Source: §6 · p. 8
  • 1,791 charging-capable Hooks (93.62%) were assigned trade-amount-based charge categories; 1,595 used percentage cuts with constant or stored rates.The percentage-cut group comprises 917 constant-rate and 678 stored-rate Hooks.Source: §6 · p. 8
  • 34.55% of Hook-enabled pools are served by charging-capable Hooks, but those pools hold 2.69% of recorded ecosystem TVL.The study reports $3.072M in available TVL across 16,798 of these pools.Source: §6 · p. 8
  • 97.91% of pools attached to charging-capable Hooks permit the identified primary charging paths through their callback and settlement-adjustment permissions.The remaining 362 pools lack at least one required permission.Source: §6 · p. 8
  • 1,389 sampled operations had confirmed deductions, 441 had no hookDelta charge, and 123 remained unresolved; the category-matching analysis confirmed charges in 876 of 1,533 checked Hooks (57.14%).The supplementary sample checks historical swap deductions regardless of a Hook’s primary category.Source: §6 · p. 8
  • 2,482,619 of 2,505,716 eligible swaps were accounted (99.08%), establishing whether each incurred a deduction beyond exchanged tokens and standard pool fees.The remaining 23,097 swaps could not be separated into exchanged tokens and charges or fully reconstructed across state-changing external calls.Source: §6 · p. 9

7 RQ3: Economic Burden Analysis

The study measures Hook revenue and trader costs separately, then compares Hook charges with standard pool fees. Across platforms, charges are concentrated, sustained, and can exceed standard fees, while charging frequency and per-swap costs vary by platform.

RQ3: Economic Burden Analysis

  • $0.17 was the median and $2.79 the mean additional cost across 1,426,116 fully priced charging swaps; the maximum was $9,793.97.Coverage was 91.24% on Ethereum Uniswap v4, 99.79% on BSC Uniswap v4, and 99.95% on PancakeSwap CL.Source: §7 · p. 10, Figure 9 · p. 10
  • 53.04% of recorded revenue came from seven Hooks earning at least $100K each, and the top ten accounted for 59.02%.Priced charges occurred in 65 consecutive weeks from May 2025 through August 1, 2026.Source: Figure 6 · p. 9, Figure 7 · p. 9, Figure 8 · p. 9
  • 75.76% of accounted swaps on BSC Uniswap v4 involved charges versus 43.53% on Ethereum, while mean costs were below $0.41 versus $8.17.The relative-cost analysis uses a narrower sample requiring a valid one-asset-in, one-asset-out core exchange and fully matched deductions.Source: §7 · p. 10
  • 99.01% of the 302 replayed swaps with positive standard fees and comparable prices had Hook charges exceeding standard fees.The exact replay covered 456 swaps with comparable prices; 154 had zero standard fees.Source: §7 · p. 10
  • 75.01% of comparable positive-rate charging swaps had Hook charges higher than standard fees, based on bounds across 110,198 swaps.The bounds classify 82,665 as higher, 27,497 as lower, and 36 as indeterminate.Source: §7 · pp. 10–11
  • $3.97M in recorded revenue accrued across 1,044 priced Hooks, with 25.16% recorded as protocol claims.Direct token transfers contributed 74.84%; the total covers $3,965,281.97 across 1,244,343 transactions.Source: §7 · pp. 9, 11

8 Discussion

The discussion argues that fee displays should itemize Hook deductions alongside standard fees and reconcile expected with actual settlement. It also cautions that exposure assessments depend on activity, frequency, cost, and the study’s measurement scope.

Fee Disclosure and Monitoring

  • Fee interfaces should itemize Hook deductions alongside standard fees and show expected payment and output, with post-trade accounting reporting actual deductions.Pre-trade simulation could estimate components for trade inputs and simulated state; both stages require separating charges from exchanged amounts in settlement adjustments.Source: §8 · p. 11
  • Monitoring should track Hook upgrades because trading rules can change at existing Hook addresses.Source: §8 · p. 11

Interpreting Economic Exposure

  • Pools attached to charging-capable Hooks comprise 34.55% of Hook-enabled pools but hold only 2.69% of recorded TVL.Pool counts weakly track observed transactions, and higher charging frequency can accompany lower per-swap costs.Source: §8 · p. 11

Limitations and Scope of Inference

  • The measurements cover four platforms through August 1, 2026, and dollar totals exclude charges without accepted historical prices.The omitted swaps may differ systematically; $3.97M is recorded revenue, not a strict lower bound, and bounded execution or unresolved dependencies can miss charging paths.Source: §8 · p. 11
  • The study measures deductions outside standard pool-fee accounting, without determining malicious intent or disclosure across all interfaces.Source: §8 · p. 11

9 Related Work

Related work spans smart-contract analysis, DeFi measurement, and Hook-enabled AMM research. This study distinguishes itself by connecting Hook behavior to settlement costs and measuring their prevalence and economic burden.

Smart Contract Program Analysis

  • Prior smart-contract analyses inspect source or bytecode, explore concrete states, or model fund flows for specific security and user-facing tasks.The paper’s analysis links shared inputs and state across Hook callbacks to reconstruct settlement effects and separate charges from exchanges and standard fees.Source: §9 · p. 11

Smart Contract and DeFi Empirical Studies

  • Prior DeFi studies examine DEX execution, MEV, flash-loan exploits, price manipulation, and traditional AMM design, while this study measures additional settlement costs imposed by Hooks.Source: §9 · p. 11

Hook-Enabled AMM Ecosystems

  • Early Hook overviews describe permissions and fees, while Oh and Lee categorize structural threats and evaluate deployed Hooks through dynamic simulation.This study instead measures undisclosed-charge prevalence and economic burden across Uniswap v4 and PancakeSwap Infinity using bytecode analysis and historical settlement reconstruction.Source: §9 · p. 11

10 Conclusion

The study combines bytecode analysis and historical settlement reconstruction to measure undisclosed Hook charges on Uniswap v4 and PancakeSwap Infinity. It identifies widespread charging capability and recorded revenue, highlighting that quoted-output fulfillment alone does not establish fee transparency.

Conclusion

  • 24.30% of registered Hooks had charging capability, and historical accounting recorded $3.97M in Hook revenue.Source: §10 · p. 11
  • Hook deductions bypass standard pool-fee accounting and can remain unitemized even when traders receive quoted output.Source: §10 · p. 11
  • Fee disclosure should itemize additional Hook deductions alongside standard fees and reconcile quoted breakdowns with actual settlement.Source: §10 · p. 11
Loading 2610.36682v1…