v4-security-foundations

Security-first guide for building Uniswap v4 hooks. Hook vulnerabilities can drain user funds—understand these concepts before writing any hook code. Before writing code, understand the v4 security context: All 14 hook permissions with associated risk levels: The BEFORE_SWAP_RETURNS_DELTA permission (bit 10) is the most dangerous hook permission. A malicious hook can: Before interacting with ANY hook that has beforeSwapReturnDelta: true : NoOp patterns are valid for: But each requires careful implementation and audit. v4 uses a credit/debit system through the PoolManager: The PoolManager tracks what each address owes or is owed. At transaction end, all debts must be settled. Every hook callback MUST verify the caller: Without this check: The sender parameter is the router, not the end user. For hooks that need user identity: Not all tokens behave like standard ERC-20s: Start with all permissions disabled. Enable only what you need: See references/base-hook-template.md for a complete implementation template.