- Uniswap Labs added aggregator hooks on Ethereum, Base, and Robinhood Chain on Oct. 22, routing swaps through seven external liquidity sources.
- Trading aggregator 0x reported in September that most third-party Uniswap v4 hooks it reviewed were malicious or likely malicious, based on its own classifications.
- Uniswap and Paradigm argue that aggregators should vet hooks, while 0x disputes whether Uniswap’s allowlist offers enough protection.
Uniswap Labs has begun routing swaps in its web app and API through outside liquidity from venues such as Curve, Fluid, and PancakeSwap. The launch comes as a public disagreement with the aggregator 0x continues over whether deceptive Uniswap v4 hooks expose traders to worse execution, and how much responsibility falls on the routing layer.
What Happened
On Oct. 22, Uniswap Labs turned on aggregator hooks across Ethereum, Base, and Robinhood Chain. The adapters that connect external pools were built by Uniswap Labs itself. At launch, seven external sources were live, which Uniswap says cover more than 90% of decentralized exchange activity on those three networks.
The dispute traces back to a September study by 0x of third-party hooks. In that research, published Sept. 14, 0x examined 84,163 hooks across six chains. As of Sept. 11, it classified 19.4% as safe, 54.2% as malicious, and 26.4% as “likely malicious.” The core concern is a pool that presents a favorable price when a router requests a quote, wins the route, and then behaves differently when the trade executes. 0x cited one Base hook with 6,516 fills and $143,037 in fees, and a BNB Chain hook with 4,879 fills and $18,592 in fees. The largest shortfall it reported was 50% below the quoted price. These classifications come from 0x itself.
Uniswap founder Hayden Adams responded on Sept. 15, calling the problem a “skill issue” and arguing that users should not route trades through bad hooks. He offered assistance to teams that struggle to screen hooks, defended v4 hooks as a source of innovation, and pointed people toward Uniswap’s API as a way to reach broad liquidity while avoiding malicious hooks. Dan Robinson of Paradigm, which is closely associated with Uniswap, made a sharper version of the same point, suggesting 0x’s post should have been titled “0x routing made a mistake.” Robinson spoke in his own name, not on behalf of Uniswap Labs.
0x has questioned the protections Uniswap describes. Engineer Duncan Townsend said 0x had already been using Uniswap’s allowlist and alleged that at least one malicious hook was on it. Philip Liao, 0x’s director of engineering, cited a Robinhood Chain transaction that he said was routed through Uniswap’s interface, in which a malicious hook captured 4.8% of one routing leg, or 1.2% of the overall trade.
Why It Matters
For traders, the central question is whether the price shown before a swap reflects what the swap delivers. Aggregated routes add a layer between the user and the pool, so a user may not know which hook is handling part of the trade. If the quote-versus-execution gap is real and recurring, the outcome depends heavily on how routers screen the pools they use.
For the broader market, the dispute highlights a division over responsibility. Uniswap and Paradigm say routers should vet hooks before treating them as liquidity, and they point to Uniswap’s hook-approval process as evidence that this already happens. 0x argues that the allowlist has not fully prevented malicious activity. Both positions affect how much weight developers and integrators place on third-party protections.
The expansion also changes the scale of the question. Uniswap says routes through the new adapters generate fees that contribute to UNI burns, so growth in external routing has a direct link to the protocol’s token mechanics. That gives the execution-quality question financial relevance beyond the individual trader.
Market Context
Uniswap’s routing guidance, updated on Oct. 16, says its router automatically considers most eligible hooks but requires manual allowlisting for hooks that use beforeSwap, afterSwap, delta-return, or dynamic-fee permissions, or specified address prefixes. The guidance treats approval as a routing decision and states that it does not cover security audits or guarantees. OpenZeppelin’s Oct. 8 audit of specific router and periphery changes documented optional per-hop slippage checks, which supplement the router’s existing minimum-output and maximum-input thresholds. Those per-hop checks can be bypassed by passing an empty maxHopSlippage array. The audit covered two specific pull requests rather than every route deployed through the new adapters.
The question also has an earlier precedent. In July, Enso investigated an Ethereum Curve USDC/USDT pool and found 129,070 successful swaps that delivered less than quoted. Enso estimated about $225,000 in gross quote overstatement and roughly $34,593 in attacker extraction. The pool’s behavior switched on and off before it went dormant. Curve is now one of the external sources available through Uniswap’s adapters. Whether that specific pool could be routed through the new integrations has not been confirmed.
0x has an interest in this debate because it competes with Uniswap’s router as an aggregator. The company says roughly 70% of its transactions touch Uniswap liquidity, which means changes to Uniswap’s routing layer directly affect its business. Readers should keep that context in mind when weighing the competing claims.
What to Watch Next
- Execution-quality data: Whether Uniswap publishes quote-versus-execution figures for routes through the new adapters.
- Default safeguards: Whether per-hop minimum-output checks become standard across the new integrations rather than optional.
- Independent audits: Whether reviews cover the exact deployments in use, not only the two pull requests examined so far.
- Adapter screening: Whether Uniswap confirms how it vets the pools behind its adapters, including any Curve pools that could be routed.
- Reproducible losses: Whether any deceptive pool is shown to reach users through an adapter or an allowlisted hook, which would move the dispute from argument to documented cases.
The debate is likely to be settled by data rather than rhetoric. Until more execution-level evidence is public, traders using aggregated routes will rely on screening practices that are only partly documented.
Source: original report