Building secure Uniswap v4 hooks

Summary: Trail of Bits analyzed dozens of audit findings plus public reports and the Solodit database to identify seven recurring failure patterns in Uniswap v4 hook and application code, including missing caller checks and accounting bugs that still satisfy the PoolManager's settlement invariant. The Cork exploit (~$12M, May 2025) and the Bunni exploit ($8.4M, September 2025) together account for more than $20M in losses, and neither stemmed from a flaw in the Uniswap v4 core protocol or the PoolManager.
What you should know: The Bunni attacker made 44 tiny withdrawals after pushing a pool's price tick with a flash loan, and every transaction passed the PoolManager's settlement check because the bug lived in BunniHook's internal accounting - the protocol-level invariant is not a safety net for the logic you add on top of it.

Read the original at Trail of Bits Blog ↗