Security
What the hook can and cannot do, and the risks that remain.
Permissions
The hook requests three callbacks: beforeInitialize to reject pools that were not listed, beforeSwap to return the fee and afterSwap to update volatility. It requests no return-delta permissions, so it cannot alter swap amounts or take tokens. It never holds user funds.
Roles and limits
| Role | Can | Limit |
|---|---|---|
| Admin | List markets, queue config changes, set calendar days | 24h delay on live configs, 5% cap in bytecode, two-step transfer |
| Keeper | Post reference prices, set temporary overrides | 15-minute reference expiry, 6-hour override limit, floor and cap |
| Guardian | Clear overrides and references | Can only remove, never set |
Worst case from a stolen key: fees mispriced within a market's floor and cap. Principal stays out of reach.
Testing
The Hardhat suite runs 41 tests against the real v4-core PoolManager with the hook at a mined CREATE2 address: calendar edges including DST switches and holidays, the fee charged on real swaps against quoteFee, volatility and drift surcharges, override expiry, config delay, access control and distributor claims. No external audit has been completed yet. If one runs, its report goes on this page.
Risks that remain
- Price movement can cost LPs more than fees earn.
- A defect in an immutable hook cannot be patched in place. A fixed hook means new pools and a migration.
- The calendar can miss an unscheduled closure until the admin key updates it.
- A keeper outage removes drift pricing until it returns. The calendar and volatility terms keep running.
- Tokenized stocks depend on their issuer, who can pause transfers.
- Robinhood Chain, its RPC or this website can go down.
Report vulnerabilities privately through a DM to @lonemifi. Do not post details in public.