What happened
Our solver checked a swap and got a green light. The real transaction failed with InsufficientOutput, after spending roughly one million gas. Five of six sampled failures had the same cause: the pool charged more than the simulation showed. (Replay evidence)
The trick was simple. A Uniswap V4 hook can set a pool's fee and read the transaction's gas price. In our zero-gas-price calls, these hooks returned a low fee. With a real transaction's gas price, they returned a higher one. Replaying the same transaction in both settings reproduced the mismatch. (Fee probes)
| Hook | Simulation fee | Real transaction fee |
|---|---|---|
H1 · 0x0d83…e880 | 0–0.20% | 14% |
H2 · 0x62d4…4080 | 0% | 1.8947–4.90%, depending on the hop |
H3 · 0x349c…80c4 · control | 0% | 0% |
A router that trusts the cheap quote may choose the pool. The higher fee then reduces the output. If the user's minimum is no longer met, the swap reverts; if it still passes, the swap completes at the worse price.
source: fee_step.csv
How much it cost
In the September 4 snapshot, three confirmed bait pools processed 1,003 swaps with about 238,334 USDG in USDG-side volume. Their estimated fees totalled 6,419 USDG. These are historical measurements, not live totals. (Pool totals)
The estimate multiplies each swap's USDG-side amount by its recorded fee rate. It is not a measurement of fees withdrawn. The 17 distinct callers are contract addresses, often routers—not a count of individual users.
We found the pools in a census of 21,661 dynamic-fee pools and 2,203 hooks. Only four incident-related hooks were tested on Robinhood Chain; three showed the mismatch. Untested hooks have no verdict. (Browse the census)
source: cumulative_bait_fees.csv
Who collected the fees
The extra charge went to liquidity providers through normal Uniswap LP fee accounting. We found no hook claim transfers in the 993 swap transactions checked. (Accounting checks, mechanism evidence)
Each pool's observed liquidity traced to one owner. Across the three pools there were two owners: 0x22d5…2527 and 0x9924…9699. For two hooks, deployment and pool creation traced to those same owners. The third hook's deployment could not be established. (Ownership evidence)
USDG withdrawals are visible, but they mix deposited capital with fees. We cannot label the entire withdrawal as profit. (Withdrawal records)
It also appeared on other chains
Ethereum had one matching hook, with roughly 136 USDC in observed volume. Arbitrum had a cluster of six hooks that quoted 0.3% at zero gas price; higher-gas-price probes returned 50–53.3%. Some results depended on the probe context. (Cross-chain results, hook details)
We found no mismatch among the hooks we could test on Unichain, Optimism, or Avalanche. Some calls failed or pools lacked liquidity, so those hooks remain undecided. Base and Polygon scans were incomplete in this snapshot; BNB was not scanned.
This technique has been reported before. Our contribution is tracing this cluster from the quote mismatch to the fee records and liquidity owners. Prior reports and sources give the background.
What this means for users
A quote is an estimate. The minimum output is the protection. A direct swap may complete at a worse price if it still meets that minimum. Otherwise it reverts, and whoever submitted the transaction pays the gas.
With an intent, the user signs an order with a minimum output and an expiry. A solver submits the fill. If settlement cannot deliver the signed minimum, the fill reverts and the solver pays that transaction's gas. This protects the agreed floor; it does not guarantee the best available price.
For solvers, the practical fix is to simulate with a realistic gas price and caller, then check again before submitting. A zero-gas-price quote is not enough. (Replay evidence)
Check the evidence
Open the pool explorer to compare quoted and real-context fees, inspect individual pools, or run a fresh probe. The article and census use a fixed snapshot; a live probe may differ.
The research notes contain the method and limits. Download the fee data, swap records, or cross-chain summary to check the numbers.