Uniswap adds seven trading sources as 0x disputes its protection from malicious hooks

Uniswap Labs launched aggregator hooks on Ethereum, Base, and Robinhood Chain on Oct. 22, letting its web app and API route swaps through external liquidity from Curve, Fluid, PancakeSwap, and other venues.

The new adapters were developed by Uniswap Labs. In a separate September study of third-party hooks, trading aggregator 0x reported that malicious Uniswap v4 hooks quoted one price and settled at another, with some trades delivering as much as 50% less than quoted.

Uniswap's founder Hayden Adams rejected the criticism then, and the public record shows documented mitigations alongside unresolved disputes over whether they work.

0x's Sept. 14 research examined 84,163 hooks across six chains and, as of Sept. 11, classified 19.4% as safe, 54.2% as malicious and 26.4% as “likely malicious.”

A malicious pool shows a favorable price during a quote request, wins the route, and behaves differently at execution. One Base hook recorded 6,516 fills and $143,037 in fees, and a BNB Chain hook recorded 4,879 fills and $18,592.

The 50% shortfall is the largest reported outcome, and the figures are 0x's own classifications. 0x competes with Uniswap's router as an aggregator, and it says roughly 70% of its transactions touch Uniswap liquidity.

Uniswap's pushback

Adams replied on Sept. 15 saying that it was a “skill issue,” arguing that users shouldn’t route trades to bad hooks. He offered help to teams having trouble screening hooks and defended v4 hooks as a source of innovation.

He also promoted Uniswap's own API as a way to reach broad liquidity at competitive prices while avoiding malicious hooks.

Paradigm's Dan Robinson made the same argument in sharper terms, saying 0x's post should have been titled “0x routing made a mistake.”

He pointed to Uniswap's hook-approval process and said routers should vet arbitrary hooks before treating them as liquidity. Paradigm is closely associated with Uniswap, and Robinson spoke in his own name, separate from Uniswap Labs.

The shared position from Uniswap and Paradigm is that aggregators should vet which hooks they route to and that Uniswap's own router already does.

0x has also questioned that protection. Engineer Duncan Townsend said 0x already used Uniswap's allowlist and alleged that at least one malicious hook sat on it. The 0x study also describes hooks that detect quoting environments and return different execution prices.

0x director of engineering Philip Liao cited a Robinhood Chain transaction, allegedly routed through Uniswap's interface, in which a malicious hook took 4.8% of one routing leg, or 1.2% of the overall trade.

What Uniswap has documented

Uniswap updated its routing guidance on Oct. 16, saying its router automatically considers most eligible hooks and requires manual allowlisting for hooks that use beforeSwap, afterSwap, delta-return, or dynamic-fee permissions, or specified address prefixes.

The guidance says approval is a routing decision and leaves security audits and guarantees outside its scope.

OpenZeppelin's Oct. 8 audit of specific router and periphery changes documents optional per-hop slippage checks. Its resolved low-severity finding concerned an allowance to an arbitrary address in cross-chain bridging code.

Per-hop checks supplement the router's existing minimum-output and maximum-input thresholds. They can be omitted by passing an empty maxHopSlippage array.

The review covers two specific pull requests, rather than every deployed route through the new adapters.

What the expansion adds

Uniswap says seven external sources are live at launch, covering more than 90% of DEX activity on the three chains.

Quotes refresh every block, trades settle atomically in a single transaction, and users keep their existing approvals. External liquidity appears as Uniswap v4 pools through Uniswap-developed adapters, and routes through them generate fees that contribute to UNI burns.

The adapters are Uniswap's own integrations, a different surface from the third-party hooks 0x analyzed.

Enso's July investigation of an Ethereum Curve USDC/USDT pool found 129,070 successful swaps that delivered less than quoted. It counted about $225,000 in gross quote overstatement and an estimated $34,593 in attacker extraction. The pool's behavior switched on and off before it went dormant.

Curve is now an external source for Uniswap, and whether the Enso pool is routable through the new adapters is unconfirmed. The pertinent unknown is whether Uniswap screens the pools behind its adapters or vets the adapters themselves.

Where it goes from here

If Uniswap publishes execution-quality data, shows that per-hop minimum-output checks apply by default across the new integrations, and confirms independent audits of the exact deployments, the pushback gains evidence.

If a deceptive pool reaches users through an adapter or an allowlisted hook, the dispute with 0x moves from argument to reproducible losses, and seven new sources widen the surface where it can happen.

Traders using aggregated routes depend on screening that the public record documents in part, and the quote-versus-execution comparison for routed trades will show which outcome Uniswap's safeguards produce.