DEX aggregator 0x just lobbed a grenade into one of DeFi’s most watched experiments. In a report published on September 14 titled “Uniswap v4 hooks were a mistake,” the team laid out findings from an extensive analysis of the customizable hook system that Uniswap introduced in its fourth major protocol version. The conclusion was blunt: the feature has become a breeding ground for quote-spoofing attacks that drain unsuspecting traders.
Uniswap founder Hayden Adams fired back, framing the problem as an inherent reality of permissionless systems rather than a design flaw specific to v4. The exchange marks one of the sharpest public disagreements between two major DeFi infrastructure players in recent memory, and it touches on a tension that has simmered for years: how much openness is too much?
The numbers behind the critique
0x analyzed 84,163 hooks deployed across six blockchain networks. The results were not pretty. Only 19.4% of those hooks were classified as safe. A full 54.2% were flagged as outright malicious, with another 26.4% categorized as “likely malicious.” That means roughly four out of five hooks operating in the wild could pose a risk to users.
The attack vector is straightforward but effective. Malicious hooks are designed to quote one price when an aggregator or router checks the rate, then settle the trade at a materially worse price. Some of the worst offenders charged hidden fees as high as 18%, and in extreme cases, users experienced losses up to 50% compared to the price they were initially shown. One specific hook operating on Base reportedly extracted approximately $143,037 in fees during its active period.
The scale of the problem matters because of how much volume flows through these pipes. In 2026, 0x routed approximately 81.92 million trades totaling $42.67 billion, with roughly 70% of that volume touching Uniswap liquidity.
Adams’ defense: this isn’t new
Hayden Adams responded by arguing that malicious smart contracts have existed in every version of Uniswap, not just v4. The permissionless nature of the protocol means anyone can deploy anything, and that includes bad actors. His core point: the existence of malicious hooks doesn’t indict the hook architecture itself any more than the existence of scam tokens indicts the ERC-20 standard.
Adams also drew a line between the protocol layer and the application layer. The Uniswap API, he noted, only integrates hooks that have been reviewed, meaning users interacting through official Uniswap interfaces should be shielded from the worst actors. The implication was clear: if aggregators like 0x are routing through unvetted hooks, that’s an aggregator-side curation problem, not a protocol-side design problem.
The deeper tension in DeFi design
Uniswap v4 hooks were introduced as a way to make the protocol radically customizable. Developers could attach modular logic to liquidity pools, enabling features like dynamic fees, custom oracles, on-chain limit orders, and more exotic trading mechanisms. The vision was compelling: turn Uniswap from a single product into a platform.
For aggregators, the 0x report effectively serves as a call to action. Any platform routing through Uniswap v4 pools now faces pressure to implement more aggressive hook-verification pipelines. That could mean whitelisting approaches, simulation-based pre-trade checks, or on-chain reputation systems that score hooks based on historical behavior.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
