Cyber Risks · Trail of Bits Blog

Nicolas Donboly

Summary: Trail of Bits blockchain security engineer Nicolas Donboly published a post identifying seven recurring failure patterns in Uniswap v4 application and hook code, including missing caller checks and accounting bugs that still satisfy the PoolManager's settlement invariant. A separate post describes how Sui's Move language replaces Solidity's callbacks and runtime checks with a "hot potato" model that enforces flash loan repayment at the language level.

Bottom line: Seven recurring hook failure patterns, including accounting bugs that pass the PoolManager's settlement check, mean a contract can look settled and still be wrong - the invariant is not the same as correctness.

Read the original at Trail of Bits Blog ↗