Malicious Uniswap v4 Hooks Raise DeFi Trading Risks

0x has warned that malicious Uniswap v4 Hooks can use quote spoofing to mislead traders and DeFi aggregators. A Hook may display an attractive price during simulation, then change pricing parameters or add hidden fees when the transaction executes. 0x reported fees of up to 18% in some cases, while extreme trades delivered as much as 50% less than quoted. The firm said hundreds of thousands of dollars may have been extracted from users with loose slippage settings. Since the start of 2026, 0x has routed 81.92 million trades worth $42.67 billion, with about 70% involving Uniswap liquidity. It identified 84,163 Hooks across six blockchains, although the total includes contracts that may never have interacted with real users. Its assessment classified 19.4% as safe, 54.2% as malicious and 26.4% as potentially malicious. Uniswap co-founder Hayden Adams rejected the suggestion that the risk is a flaw unique to Uniswap v4. He said malicious tokens, honeypots and rug-pull pools also existed in earlier versions. Uniswap says its official front end and API route only through reviewed Hooks, while third-party aggregators such as 0x, 1inch and ParaSwap are responsible for their own screening and routing controls. The dispute highlights the trade-off in Uniswap v4’s permissionless Hook design. It supports customised pool logic and innovation but creates additional security risks for aggregators and users. Traders should prefer trusted interfaces, check execution data and avoid excessively loose slippage settings. Malicious Uniswap v4 Hooks are a direct risk to trade execution, although the reports do not establish a protocol-wide failure or a clear long-term impact on UNI’s price.