1) 54% of Uniswap V4 hooks are malicious but the scariest bugs are not the obvious scams they are the subtle accounting errors in legitimate hooks that pass every audit checklist Here are the 7 failure patterns every V4 builder needs to know 1) Anyone can call your hook Hook callbacks are external functions. If you don’t check the caller, an attacker calls them directly with malicious parameters. Fix: use BaseHook + onlyPoolManager modifier The Cork exploit (~$12M) happened because an untrusted path reached hook logic 2) Pool creation is permissionless Anyone can deploy a pool with your hook address. If you trust a user-supplied PoolKey without validation, the attacker controls the currencies Fix: allowlist pools by PoolId. Never trust a PoolKey you didn’t create. 3) Custom accounting leaks value silently The PoolManager only checks that deltas settle to zero at the end of a session. Your internal accounting can still be wrong Bunni exploit ($8.4M): rounding bug in idle-balance accounting. 44 tiny withdrawals drained the pool. Settlement invariant passed every time. 4) beforeSwap sees pre-swap state. afterSwap sees post-swap state Code that is correct in one hook is unsafe in the other putting logic that needs the final swap result in beforeSwap is one of the most common bugs in V4 hook audits 6) The hook address IS the API Permission bits are encoded in the deployed address itself. If afterSwapReturnDelta bit is missing: Your hook records a fee PoolManager ignores the delta Every swap reverts with CurrencyNotSettled() Keep getHookPermissions() in sync with what your hook actually does. 6) Optional code can block exits If reward distribution or oracle reads revert inside afterRemoveLiquidity: Users cannot exit their positions Funds are locked Wrap optional code in try/catch. Never let cleanup logic block a safe exit. 7) State changes between callbacks beforeSwap and afterSwap run in the same tx. If your hook calls external contracts in between, shared storage can change mid-sequence Key temporary state by PoolId + caller clear it after use Test nested swaps across pools that share the same hook. 8) The PoolManager guarantees settlement. It does not guarantee your hook is correct Security responsibility for: Authorization → you Pool validation → you Value accounting → you External integrations → you Full breakdown by @nisedo_ at Trail of Bits: blog.trailofbits.com/2026/07…