Uniswap V4

Uniswap v4 is the fourth major version of the Uniswap DEX, introducing programmable liquidity via hooks and live across multiple EVM chains including all chains in scope (Ethereum, Arbitrum, Avalanche, BNB Chain, Base, OP Mainnet, Polygon). ### Protocol identification

• Name: Uniswap v4
• Category: Decentralized exchange (DEX), automated market maker (AMM) with concentrated liquidity and programmable hooks
• Website / App: v4-specific portal at v4.uniswap.org (protocol site, not primary truth).
• Docs: Uniswap v4 section in Uniswap developer docs covering protocol overview, concepts (hooks, flash accounting, unlock), interfaces and SDK.
• Launch date: Mainnet launch and multi-chain rollout on 31 January 2025 after nine audits, a large security competition and a bug bounty program.
• Chains (within user scope): As of mid‑2026, Uniswap v4 is live on Ethereum, Arbitrum, Avalanche, Base, BNB Chain, OP Mainnet, Polygon together with several other networks (Blast, Ink, Soneium, World Chain, Zora).
• Native token: Uses the existing UNI governance / fee token of the Uniswap ecosystem (not newly introduced with v4). (On‑chain confirmation: Not verifiable as of 2026‑09‑04.) ### Main contract / addresses Public documentation focuses on interfaces rather than listing all chain-specific addresses, but identifies the IPoolManager as the core pool management contract and IHooks as the standard hook interface. Aggregator infrastructure (e.g., Moralis) confirms v4 support on the requested chains, but does not give authoritative core addresses. On‑chain contract addresses and explorer verification status for IPoolManager and related core contracts on each chain: Not verifiable as of 2026‑09‑04. ### Fork lineage & design changes
• Lineage: Uniswap v4 is an official continuation of Uniswap v3 by the same protocol team, not an external fork.
• Key technical changes vs. v3:
• Hooks: External contracts that can run custom logic before/after pool events (initialization, swaps, liquidity changes, donations), enabling dynamic fees, custom oracles, MEV-aware mechanisms, etc.
• Flash accounting: Balances are settled at transaction end, allowing more complex intra-tx operations.
• Unified single PoolManager instead of separate per‑pool contracts, improving gas efficiency and extensibility. ### Audits & security history
• Uniswap v4 underwent nine independent audits, the largest security competition in DeFi to date, and a bug bounty up to $15.5m before launch.
• Hooks are explicitly documented as adding new security considerations; each hook is a separate contract that must be audited individually.
• No documented history of malicious modifications in forks of Uniswap v4 specifically was found; however, numerous Uniswap v2/v3 forks historically introduced insecure or malicious changes. Direct evidence for v4-specific malicious forks: Not verifiable as of 2026‑09‑04. > Contradiction callout: One secondary source claims a June 2023 “launch” for v4, but primary Uniswap communications and multiple independent analyses place the production launch on 31 January 2025; the 2023 date refers to early code release / announcement, not mainnet availability.

Uniswap v4 looks like a live product, not just a landing page: the official site exists, the developer portal has active v4 protocol and SDK documentation, and the docs include deployment addresses plus guides for swapping, liquidity management, and pool state access. The docs also expose an API/reference surface with swap-building endpoints, so there is an open developer API rather than only a marketing site. Product maturity is moderately high, but not fully verifiable from web-only evidence: the project states v4 is live across multiple chains and available on Uniswap Labs products, and the docs page references interactive API endpoints and chain deployments.

However, live deposit/withdrawal UX quality, broken-link rates, fake metrics, and template-sign detection are not verifiable as of 2026-09-04 from the available web evidence alone. The protocol appears to be the real Uniswap project, because the developer and blog pages are under Uniswap’s own domains and consistently reference v4, SDKs, deployments, and Uniswap Labs products.

Uniswap v4 has an active bug bounty program. It launched on 2024-11-26 and covers vulnerabilities in the Uniswap v4 core and periphery contracts, with reports required within 24 hours of discovery and kept confidential until resolution. The published reward schedule caps at $15.5M for critical vulnerabilities, with $1M for high-risk and $100,000 for medium-risk findings; some low-risk findings are discretionary.

The program excludes third-party contracts/apps, issues already identified in audits, and issues already known internally. Publicly disclosed materials do not show finalized bounty results, so results are not verifiable as of 2026-09-04.

Assessment (as of 2026-09-05) Uniswap v4 core is non-custodial, permissionless and non-upgradeable; it does not require a custodian, CEX/MM, bridge, RWA issuer/SPV, stablecoin, LST/restaking protocol, or external oracle for its base AMM function. Primary dependency risk — hooks and pool assets. Any pool may attach an external hook that executes around initialization, liquidity changes, swaps and donations. Hooks can implement custom pricing, dynamic fees, custom accounting, oracle logic, lending integrations and cross-chain dependencies. Consequently, risk is pool-/hook-specific rather than a single protocol-wide exposure.

Failure modes include manipulated or stale oracle data, external-contract reverts, altered collateral/liquidity conditions, delayed cross-chain messages, incorrect deltas and mispriced trades. Oracle and manipulation risk. v4 does not mandate an oracle; however, hooks may create custom oracles, and thin-liquidity pools remain vulnerable to short-window price manipulation and MEV. Spot prices or TWAPs derived from a specific pool should not be treated as robust collateral/oracle inputs without liquidity and manipulation-resistance analysis. Bridges and cross-chain exposure. The listed deployments do not by themselves establish a canonical bridge dependency. Bridge-wrapped assets, sequencers, and cross-chain hooks can introduce depeg, message-delay, censorship or insolvency risk, but chain- and pool-level balances are Not verifiable as of 2026-09-05 because Dune MCP/on-chain verification is unavailable. > Contradiction / data limitation: DeFiLlama’s “Uniswap” entry aggregates v1–v4 and other products across many chains; it is not a v4-only exposure measure.

Therefore its TVL and chain percentages cannot be used to calculate Uniswap v4 counterparty exposure. No active dependency failure was confirmed from the available sources; on-chain incident status is Not verifiable as of 2026-09-05. Maximum exposure by stablecoin, LST/restaking, bridge, RWA or other counterparty is also Not verifiable as of 2026-09-05.

Uniswap v4 is non-custodial: users keep control of their wallets, and the protocol does not take custody of user assets. In the v4 architecture, assets are organized through a single PoolManager contract that holds all pool state and uses flash accounting; tokens are moved into the PoolManager during interactions and only the net result is settled at the end of a transaction. This means custody is not held by a third-party operator, but by the user’s own wallet until they interact with the protocol, and then by the protocol’s onchain contract logic during the transaction.

Withdrawal is not verifiable as paused as of 2026-09-06. Assets are not segregated into separate custodial accounts; they are pooled and accounted for within the protocol’s shared onchain contract system.

The v4 bug bounty is documented as up to $15.5M for critical issues, with tiered payouts for lower-severity findings; reports must be submitted promptly and kept confidential until resolution.

Cork Protocol’s Uniswap v4-based hook integration—not Uniswap v4 core or PoolManager—was exploited on May 28, 2025. The attacker combined rollover/price manipulation with missing authorization in CorkHook.beforeSwap and FlashSwapRouter logic, draining 3,761 wstETH from the wstETH:weETH liquidity vault. Affected parties were Cork LPs/users; ordinary Uniswap v4 PoolManager users were not directly drained.

Cork paused all markets, opened an incident-response war room, contacted the Uniswap Foundation, auditors, law enforcement and the attacker, and enabled withdrawals from four unaffected markets. The remediation plan included authorization changes, redesign, additional audits, formal verification, fuzzing and monitoring. As of July 22, 2025, Cork said most stolen funds had not been recovered and described only initial remuneration plans; no completed user reimbursement was disclosed.

Current status: remediation_in_progress, with recovery and stakeholder remuneration unresolved. This is an integration/hook incident, not a Uniswap v4-core exploit.

Bunni, a Uniswap v4 hook-based liquidity-management protocol, was exploited on September 2, 2025 across two pools: USDC/USDT on Ethereum and weETH/ETH on Unichain. Flash-loan-funded price manipulation and 44 repeated micro-withdrawals exploited a rounding/accounting flaw in BunniHubLogic.withdraw(), disproportionately reducing active liquidity and enabling a sandwich extraction. Reported user/protocol loss was approximately $8.4 million; Bunni’s post-mortem identified approximately $2.33 million in attacker profit.

Bunni paused operations, later enabled withdrawals only, offered a 10% bounty, contacted exchanges and law enforcement, and changed the vulnerable rounding direction while expanding invariant/fuzz testing. On October 23, 2025, Bunni permanently shut down because it could not fund a secure relaunch; users could withdraw remaining assets and the team planned a treasury distribution to token holders, but no completed reimbursement of the exploited loss was disclosed. Public reporting stated the stolen funds had been laundered through Tornado Cash.

Current status: unresolved; the protocol is discontinued and recovery/reimbursement of the exploit loss is not evidenced as completed.

Uniswap v4’s key management is organized around a single PoolManager contract that stores and manages all pool state, rather than one contract per pool. Each pool is identified by a PoolKey made up of currency0, currency1, fee, tickSpacing, and a hooks address; that key is hashed into the pool ID, so the hook binding is part of the pool’s identity. Operationally, users and integrators must unlock the PoolManager, perform actions through the callback flow, and then settle all deltas before the contract re-locks; this is the core control mechanism for swaps and liquidity changes.

For the protocol’s own architecture, this means there is no separate per-pool contract keying model in v4; instead, the singleton contract centralizes pool access control and accounting, while the hook address is the main per-pool extensibility point. Pool creation is permissionless, so “key management” is not an admin-gated registry in the usual sense; it is a deterministic composition of pool parameters plus callback hooks. One important nuance is that the hook address becomes fixed once the pool is initialized, although the hook contract’s own upgradeability depends on how that external contract is built.

As of September 5, 2026. The prior BSC finding is outdated: the official deployment registry now lists BNB Smart Chain. Canonical PoolManager addresses: Ethereum 0x000000000004444c5dc75cB358380D2e3dE08A90; Arbitrum 0x360e68faccca8ca495c1b759fd9eee466db9fb32; Avalanche 0x06380c0e0912312b5150364b9dc4542ba0dbbc85; BSC 0x28e2ea090877bf75740558f6bfb36a5ffee9e9df; Base 0x498581ff718922c3f8e6a244956af099b2652b2b; OP Mainnet 0x9a13f98cb987694c9f086b1f5eb990eea8264ec3; Polygon 0x67366782805870060151383f4bbff9dab53e5cd6. The registry links each address to an explorer. Architecture / privilege map: ``text User -> PositionManager / Universal Router -> PoolManager singleton | | | +-> Pool state + ERC6909 claims | +-> arbitrary pool Hook callbacks | owner -> setProtocolFeeController feeController -> set fees / collect accrued protocol fees ` PoolManager is a direct singleton implementation, not an identified proxy: the source inherits NoDelegateCall, and no pause, withdraw, or upgrade functions were found in the reviewed PoolManager source. Proxy admin type: Not verifiable as of September 5, 2026 (Dune unavailable; no decoded-event verification). The core has an owner through Owned; the owner can replace protocolFeeController`.

That controller can change bounded protocol fees and collect only protocolFeesAccrued, not arbitrary LP principal. No oracle or strategy admin exists in core; hooks may implement custom pricing, fees, oracle, custody, or pause logic and must be assessed individually. Users generally retain a non-admin exit path through liquidity removal and claims settlement, but a malicious hook can impair or economically manipulate a specific pool.

A compromised owner/controller could redirect accrued protocol fees, set maximum permitted protocol fees, or install a hostile fee controller; direct full-system draining is not evidenced. Timelock delay, live owner/controller addresses, renunciation status, emergency roles, and deployment-bytecode verification: Not verifiable as of September 5, 2026. Auditing evidence is strong at codebase level: public reports include OpenZeppelin, Trail of Bits, Spearbit, Certora, and ABDK, plus a large security competition.

Deployment-specific unresolved findings remain Not verifiable as of September 5, 2026.

Certora — Uniswap V4 Core verification report. Publication: September 5, 2024. Scope: v4-core formal verification plus manual review. Deployed-code coverage: Not verifiable as of September 4, 2026.

ChainSecurity – Arrakis Finance Uniswap v4 Module audit.

Published report; canonical Uniswap v4 core review and newest located report.

Published report; canonical Uniswap v4 core audit.

Published report; canonical Uniswap v4 periphery/router audit.

Published report; canonical Uniswap v4 core review.

Published report; canonical Uniswap v4 periphery and Universal Router.

Published draft report; canonical Uniswap v4 periphery.

Meta‑summary of Uniswap v4 audits from Certora blog and OpenZeppelin partnership article.

Uniswap v4 has undergone multiple audits; OpenZeppelin is the primary security partner and has run 11 audits across core, periphery, and related components since June 2024. As of today, bytecode-match vs deployed contracts is Not verifiable as of 2026-08-30.

• Core audit (Uniswap/v4-core)
• Date / timeline: 2024-05-27 to 2024-06-21.
• Scope: v4 core AMM contracts in the Uniswap/v4-core repo at commit d5d4957 (Solidity/Yul).
• Findings: 24 issues total; 1 critical, 3 medium; remainder low/info.
• Fix status: OpenZeppelin reports 18 resolved, 2 partially resolved, others acknowledged; all critical and medium issues reported in the later partnership recap as resolved.
• Coverage vs deployed code: Report is explicitly tied to a specific git commit; on‑chain bytecode matching and deployment set across Ethereum, Arbitrum, Avalanche, Base, Monad, OP Mainnet, Polygon is Not verifiable as of 2026-08-30.
• Periphery & Universal Router audit (Uniswap/v4-periphery + universal router)
• Date: 2024-08-30 report publication.
• Scope: v4 periphery contracts (e.g., pool manager interactions, wrappers) at commit df47aa9, and Universal Router at commit 4ce107d.
• Findings: 38 issues total; 1 critical, 1 high, 2 medium, remainder low/info.
• Key critical: Fee-stealing vector via the _increase function in periphery/universal-router; later recap confirms it was fixed.
• Fix status: 25 resolved, 1 partially resolved, others acknowledged; OpenZeppelin’s 2024 partnership note states the critical and high issues from core and periphery/Universal Router audits were successfully resolved.
• Coverage vs deployed code: Audit is commit‑specific; whether current deployed periphery/router on each chain exactly matches audited commits is Not verifiable as of 2026-08-30.
• Aggregate OpenZeppelin stats across Uniswap v4 components
• Issues across 11 audits: 101 total: 4 critical, 7 high, 17 medium, 57 low, 17 notes.
• Resolution: OpenZeppelin states these were addressed prior to launch, but per‑issue, per‑chain verification on deployed bytecode is Not verifiable as of 2026-08-30. Other firms (Certora, Trail of Bits, Spearbit, ABDK, Pashov Audit Group) Uniswap Labs and Certora report nine independent audits across these firms, but individual reports, severities, and bytecode coverage for each are Not verifiable as of 2026-08-30 based on available summaries.

Uniswap v4 Core Audit.

Uniswap v4 Periphery and Universal Router Audit.

Trail of Bits Security Review – Uniswap v4 Core.

Uniswap v4 is developed by Uniswap Labs, the same organization behind prior Uniswap protocol versions, founded and led by Hayden Adams; the team is fully public, US‑based, and operates a conventional venture‑backed software business rather than a purely anonymous web front. ### Founders & Key People

• Founder / CEO: Hayden Adams (inventor of the Uniswap protocol, former mechanical engineer at Siemens).
• Uniswap Labs leadership: Public org‑chart and profiles show roles including COO (e.g., Mary‑Catherine Lader), VP Engineering, product leads, legal and compliance heads, etc.
• Uniswap Foundation: Separate non‑profit stewarding governance, co‑founded by Devin Walsh and Ken Ng, with a larger public team across legal, finance, data science, governance, growth and ops. ### Prior Projects, Track Record, Hacks
• Adams created Uniswap in 2018, drawing on an automated market maker design from Vitalik Buterin; the protocol has since processed trillions in volume and become a core DeFi primitive.
• No credible records of protocol‑level founding‑team hacks or rug pulls; Uniswap has faced typical DeFi risks (LP losses, MEV, scam tokens), but not a catastrophic protocol exploit attributed to the core team. (Risk assessment based on public history and coverage; not on-chain verified.) ### Public vs Anonymous, Credibility
• Founder and senior team are fully doxxed, with LinkedIn, org charts, and regular media presence; Hayden Adams is widely covered in mainstream and crypto media.
• Backed by major venture firms (Paradigm, a16z, Polychain and others), indicating institutional due diligence and ongoing board‑level oversight. ### Legal Entity, Jurisdiction, Office
• Uniswap Labs operates as a US corporation, identified as a Delaware entity, with headquarters in New York City (Greater New York Area).
• Corporate office listings show a NYC mailing address and conventional contact details, consistent with a real operating business.
• The Uniswap Foundation is a distinct entity; public materials emphasize its role in governance and grants rather than protocol operation. ### Reality Check (Business vs Web Front)
• Evidence (corporate registrations, VC backing, named executives, physical office, media presence) supports Uniswap Labs as a substantive, onshore software company with a large public team, not an anonymous offshore shell.
• On‑chain verification of Uniswap v4 deployment and ownership structure is Not verifiable as of 2026‑09‑04 under current tool constraints.

Uniswap v4 and the broader Uniswap ecosystem currently have a strong technical and market reputation, but face non‑trivial regulatory, governance, and attack‑surface concerns that institutional users should treat as active risk factors. Founders & investors

• Uniswap was founded by Hayden Adams, with the protocol developed by Uniswap Labs.
• Early and ongoing investors include a16z crypto (Andreessen Horowitz) and Paradigm, plus Haun Ventures and Ribbit Capital, giving the project blue‑chip VC backing. Audits, security competitions, and bug bounty (v4‑specific)
• Uniswap v4 is marketed as “one of the most thoroughly reviewed codebases in DeFi,” with nine independent audits on core and periphery contracts by firms including OpenZeppelin, Spearbit, Certora, Trail of Bits, ABDK, and Pashov Audit Group.
• Certora reports that these firms collectively found and remediated multiple vulnerabilities, including critical issues, starting mid‑2024.
• A $2.35M security competition drew over 500 researchers with *no critical vulnerabilities reported*.
• A bug bounty program up to $15.5M, described as the largest in DeFi, remains active post‑deployment, which is a strong positive signal for ongoing security scrutiny. Regulatory and legal exposure
• In April 2024 the SEC issued a Wells notice to Uniswap Labs, alleging the Uniswap protocol was an unregistered securities exchange, that the interface and wallet functioned as unregistered brokers, and that UNI and LP tokens may be unregistered securities.
• Uniswap Labs publicly contested these theories in its Wells response, arguing the protocol is passive infrastructure and not an exchange under U.S. law.
• In February 2025, Uniswap Labs announced the SEC had closed its investigation with no enforcement action, reducing near‑term regulatory risk but not providing a legal safe harbor. Governance and reputational disputes
• Uniswap DAO governance has faced reputational controversy: MakerDAO founder Rune Christensen accused GFX Labs (a major Uniswap delegate) of a coordinated governance attack and labeled them a “crooked mercenary VC fund,” raising concerns about delegate incentives and conflicts of interest.
• The same governance thread flags potential violations of Uniswap Foundation’s conflict‑of‑interest guidelines, which is an unresolved reputational concern around DAO governance processes. Sentiment, criticisms, and unresolved concerns (v4)
• Market and developer sentiment around v4’s hook architecture is generally positive for flexibility, but risk analyses highlight that third‑party hooks significantly expand the attack surface: smart‑contract bugs, malicious pool logic, oracle and permissioning risks, and complex UX that can harm users and Uniswap’s reputation if exploits occur.
• As of the latest data, there are no public fraud, rug‑pull, or insolvency allegations against Uniswap Labs or the core protocol, but regulatory theory risk and governance‑delegate behavior remain active areas of scrutiny. Sanctions / OFAC
• Broader Uniswap reputation includes past criticism for delisting tokens amid regulatory pressure and navigating U.S. sanctions debates, but specific, verifiable v4‑related sanctions actions are Not verifiable as of 2026‑09‑04. For institutional DeFi use, Uniswap v4 is viewed as high‑profile, heavily audited, but with elevated governance and regulatory‑theory risk, plus additional smart‑contract and reputational risk from third‑party hooks.

Economic model — Uniswap v4 (reviewed September 5, 2026)

• Strategy/assets: General-purpose concentrated-liquidity AMM. LPs deposit ERC-20 token pairs into individual pools and receive swap fees; only in-range liquidity earns fees. Pools/hooks can implement custom curves, pricing, orders, dynamic fees, and accounting.
• Yield source: Primarily organic trader-paid swap fees. Subsidized yield is not native to v4; incentives may be added by individual pool or hook operators. Returns are not inherently market-neutral: LPs bear price exposure, range risk, and impermanent loss.
• Leverage/external exposure: No native lending, looping, leverage, restaking, or collateralized borrowing. External exposure is optional and hook-specific; hooks can hold or rehypothecate assets, creating additional counterparty and smart-contract risk.
• Lock-ups/withdrawals: No protocol-wide lock-up. LPs can modify or withdraw liquidity, but hooks may impose withdrawal penalties, gates, allowlists, or other custom mechanics.
• Fees/limits: Pool creators may set fees from 0%–100%; dynamic fees and separate hook fees are supported. Limits and gates are pool-/hook-specific, not standardized.
• Protocol revenue: DefiLlama reports approximately $76.41m fees over 30 days and $0 protocol revenue for the tracked v4 deployment. Documentation says v4 fee-adapter flows can be enabled through governance, but activation is not verified on-chain here. Contradiction/finding: fee generation is substantial, while tracked protocol revenue is currently zero.
• TVL: DefiLlama reports approximately $1.06bn, up 28.4% over 30 days. Requested chains total about $878.8m (~83%): Ethereum $697.85m, BSC $65.58m, Base $57.07m, Arbitrum $36.88m, Polygon $17.57m, OP Mainnet $2.92m, Avalanche $0.92m. Product-level TVL and Dune-vs-DeFiLlama reconciliation: Not verifiable as of September 5, 2026.
• APY: No protocol-wide APY; returns are pool-specific and highly volatile. DefiLlama displays 480.29% average supply APY across 1,841 pools, but this aggregator figure is skew-sensitive and not a sustainable base-case estimate. Historical APY volatility: Not verifiable as of September 5, 2026. organic_yield_pct: null leverage_ratio: null

As of 2026-09-05: Liquid reserves / treasury: null. Liabilities: null. Dune/on-chain balances: Not verifiable as of 2026-09-05. Dune MCP was unavailable for this run; therefore no chain-by-chain balance, composition, latest block height, USD valuation, or exposure percentage is asserted. Known addresses: The Uniswap Foundation publishes the following governance-controlled DAO treasury addresses, defined as the addresses owning the Uniswap v3 Factory on each chain—not as verified Uniswap v4 reserve vaults: Ethereum 0x1a9C8182C09F50C8318d769245beA52c32BE35BC; Arbitrum 0x2BAD8182C09F50c8312C32Be46CD; Avalanche 0xeb0BCF27D1Fb4b25e708fBB815c421Aeb51eA9fc; Base 0x31FAfd4889FA1269F7a13A66eE0fB458f27D72A9; BSC 0x341c1511141022cf8eE20824Ae0fFA3491F1302b; OP Mainnet/Optimism 0xa1dD330d602c32622AA270Ea73d078B803Cb3518; Polygon 0x8a1B966aC46F42275860f905dbC75EfBfDC12374. These are governance addresses, not proof of v4 custody or balances. Composition and custody: Not verifiable as of 2026-09-05.

Uniswap v4 routes pools through chain-specific singleton PoolManager contracts; pool reserves are pool-specific and are not an issuer-level treasury. The official ReservesLens can read a specified pool’s fee-excluded principal, but this does not produce an aggregate v4 treasury balance. Control / reserve policy / attestations: No verified v4-specific reserve policy, independent reserve attestation, or consolidated custody map was identified. Hook-reported reserves and effective liquidity may include externally deployed, rehypothecated, locked, or otherwise unavailable assets; the governance proposal explicitly states these reports are not proof of solvency, custody, or settlement ability. Finding: Do not treat the published DAO treasury addresses or hook/pool reserve figures as a verified Uniswap v4 reserve figure.

On-chain verification and aggregate valuation remain unresolved.

Uniswap v4 does not have a dedicated v4 token. It uses the existing Uniswap Protocol / Governance token: UNI. All tokenomics apply to UNI, not to a separate “Uniswap v4” asset. ### 1. Token basics

• Native token: Uniswap (UNI)
• Ticker: UNI
• Primary chain: Ethereum mainnet (ERC‑20). Wrapped/bridged UNI exists on Arbitrum, OP Mainnet, Polygon, BSC, Avalanche, Base, etc. via bridges.
• Canonical contract (Ethereum): 0x1f9840a85d5aF5bf1D1762F925BDADdC4201F984 ### 2. Supply, market cap, FDV Not verifiable as of 2026‑09‑04 via on‑chain Dune MCP (tool unavailable). Public analytics (e.g., major market data sites) show:
• Max/total supply: 1,000,000,000 UNI
• Circulating supply: ~590–600M UNI (stale data; ranges across sources)
• Market cap & FDV: depend on current price; figures from CEX/aggregator data only (not on‑chain). Treat as aggregator estimates, not on‑chain verified. ### 3. Token utility & governance role
• Governance: UNI controls Uniswap protocol parameters, treasury disbursements, fee switch decisions, and now cross‑chain deployments (including Uniswap v4) via Uniswap DAO governance on Ethereum.
• No hard protocol revenue share: UNI holders do *not* automatically receive trading fees. Instead, governance can enable a “fee switch” that redirects a portion of pool fees from LPs to the treasury or other destinations.
• Voting power: based on UNI balance and delegation; standard ERC‑20 + governance contracts. ### 4. Emissions, unlocks, allocations According to the original Uniswap token distribution announcement (protocol docs / blog, counted as unverified marketing claim unless cross‑checked):
• Allocations: approx. 60% community (including retroactive airdrop & liquidity mining), 21.51% team, 17.8% investors, 0.69% advisors.
• Vesting: team/investor/advisor allocations subject to multi‑year vesting starting 2020. Because Dune MCP is unavailable and we are not querying raw vesting contracts, whether specific cliffs/unlocks have executed on‑chain is Not verifiable as of 2026‑09‑04. ### 5. Holder concentration & control
• Top‑holder and insider concentration (team, investors, foundation wallets) is Not verifiable as of 2026‑09‑04 under current tool limits.
• UNI does not have arbitrary mint or blacklist functions in the ERC‑20 contract per public contract code review on Etherscan; minting is fixed to 1B supply.
• Fee switch and protocol parameters are controlled by Uniswap DAO governance contracts and timelock, not by the UNI token contract itself. ### 6. DEX liquidity & listings
• UNI is one of the most liquid DeFi tokens on Ethereum and major L2s, with deep pools on Uniswap v2/v3 and other DEXes, plus major CEX listings. Exact depth by chain/pair is Not verifiable as of 2026‑09‑04 without on‑chain tooling.

Under a BTC crash below $10,000, Uniswap v4’s core protocol design does not create balance-sheet leverage or direct debt exposure; it is a singleton AMM with hooks and flash accounting that settles token deltas at the end of each transaction. The main stress effect would therefore be market-activity shock, not solvency shock: lower trading volume, wider spreads, and potentially weaker fee generation across the supported chains (Arbitrum, Avalanche, BSC, Base, Ethereum, OP Mainnet, Polygon) if users and LPs withdraw liquidity. That chain-by-chain impact is Not verifiable as of 2026-09-04 because no chain-specific on-chain TVL/exposure data was provided and Dune verification is unavailable in this run.

The most relevant protocol-specific risk is hook risk. Because v4 allows arbitrary hook logic before/after swaps and liquidity operations, a stressed market can amplify any buggy or malicious hook behavior, including reverts during liquidity removal or settlement failures that can lock LP funds or disrupt pool operations. In other words, the BTC price level itself is not the direct failure mode; the failure mode is whether pools and hooks remain functional when volatility and flow spike.

For a stress memo, the practical assessment is:

• Protocol solvency: Not verifiable as of 2026-09-04.
• Direct BTC price exposure: None evident from the v4 architecture itself.
• Primary stress channels: liquidity withdrawal, fee compression, volatile rebalancing, and hook-induced operational failures.
• Cross-chain exposure split: Not verifiable as of 2026-09-04. If you need, I can turn this into a one-page risk note with sections for market, smart-contract, and liquidity risk.

For a 20% depeg of the largest collateral, a precise system-wide loss estimate is Not verifiable as of 2026-09-04 because no on-chain TVL, collateral composition, or per-chain position data was provided, and on-chain verification is unavailable in this run. Uniswap v4’s architecture uses a singleton PoolManager with flash accounting and internal net balances (“deltas”), so stress impact depends on the specific pools, hooks, and collateral assets deployed on each chain rather than on a single protocol-wide reserve pool. What can be said reliably is that Uniswap v4 is not natively a lending protocol; its core risk from a collateral depeg is indirect and pool-specific, arising through LP composition, hook logic, or any external credit/collateral integrations built on top of v4.

Certora’s threat-modeling note also emphasizes that v4 does not explicitly store pool reserves and relies on underlying pool state and solvency checks, which makes the exposure highly dependent on implementation details and integrations. Relevant stress interpretation:

• If the “largest collateral” refers to the most-used asset in a specific v4 pool, a 20% depeg would primarily impair that pool’s LP value and arbitrage dynamics, but the magnitude cannot be quantified here without pool-level balances.
• If the “largest collateral” refers to an external borrowing or CDP module built around v4 positions, then the loss would depend on the module’s liquidation thresholds and collateral ratios; however, no verified deployment data for the listed chains is available in this run.
• Any hook-specific credit or accounting bug can amplify losses beyond pure price depeg risk; the Cork exploit is an example of hook-implementation failure causing losses in a v4-based system. Because the question requires chain-by-chain exposure across Arbitrum, Avalanche, BSC, Base, Ethereum, OP Mainnet, and Polygon, and no verified per-chain TVL/exposure data is available here, the chain split is also Not verifiable as of 2026-09-04.

For Uniswap v4, a top counterparty insolvency is not a protocol-balance-sheet event in the usual sense: the core architecture is a singleton PoolManager with optional hooks, so the protocol does not appear to run a native credit book or insurer that would absorb a counterparty default. The likely loss path is therefore market/LP loss, not a protocol bailout: if a hook, wrapper, or external strategy depends on a defaulting counterparty, the shortfall is borne by the pool liquidity providers or by whichever external actor embedded that exposure; Uniswap’s core contracts only execute the pool logic and any attached hook logic. Impact path through the smart contracts is: PoolManager executes the swap/liquidity flow, calls the relevant hook before/after actions when enabled, and settles via the singleton accounting model; because hooks are external contracts, a loss or failure in a hook-based strategy propagates through that hook’s own state and any pool-level accounting it influences, rather than through an implicit protocol guarantee.

Uniswap explicitly warns that malicious or poorly implemented hooks can compromise pool security, which means compensation is not protocol-assured but depends on the specific hook design and any off-chain agreements. Who absorbs it: typically LPs in the affected pool, or the hook/operator if its own contract design includes reserves, insurance, or loss socialization; Uniswap v4 core does not document a native backstop for counterparty insolvency. Compensation: Not verifiable as of 2026-09-04 for a universal protocol-level mechanism; any reimbursement would have to come from the external hook, an affiliated vault/strategy, or discretionary off-chain remediation, not from a clearly documented v4 core insolvency module.

For the DAO/owners committed fraud stress scenario, I found no verifiable evidence that Uniswap v4’s DAO or owners have committed fraud. The strongest direct source says the Uniswap DAO owns uniswap.eth and that UNI holders can direct its timelock, which indicates governance control but not fraud. What *is* verifiable is a liability distinction: a court decision discussed in legal analysis held that Uniswap was not liable for fraud committed by anonymous third parties using the protocol, because creating software for a platform is not the same as perpetrating the fraud itself.

That supports the view that observed fraud risks around Uniswap v4 are more likely to arise from third-party hooks, integrations, or user-level attacks than from the DAO or owners directly. Security materials about v4 consistently frame the main risks as malicious or buggy hooks, permissioning mistakes, or accounting flaws in app-specific code, not intentional fraud by the DAO. I therefore classify “DAO/owners committed fraud” as Not verifiable as of 2026-09-04.

If you want, I can next assess the separate stress scenario of DAO governance capture or malicious parameter changes.

For Uniswap v4, the primary yield source negative 30d stress case is *not verifiable as of 2026-09-04* from the available web results. The retrieved sources describe v4’s architecture, hooks, flash accounting, and security considerations, but they do not provide chain-specific 30-day yield data or a verified negative-yield breakdown for Arbitrum, Avalanche, BSC, Base, Ethereum, OP Mainnet, or Polygon. What can be said reliably is that v4’s yield mechanics are highly dependent on hook logic and pool behavior, because hooks can attach custom code to the swap lifecycle and implement custom accounting via deltas.

The documentation also emphasizes that custom routers and liquidity flows must handle settlement, slippage, and rounding carefully, which makes stress-period performance more sensitive to implementation choices than in a purely passive design. For the requested stress scenario, the only direct stress-related evidence in the results is a research document stating that “stress windows remain the main weakness” for an adaptive v4 strategy, but that source is a project-style study rather than an on-chain protocol TVL/yield report, so it cannot be used to verify protocol-wide 30d yield negativity. Chain-by-chain status:

• Ethereum: Not verifiable as of 2026-09-04.
• Arbitrum: Not verifiable as of 2026-09-04.
• Avalanche: Not verifiable as of 2026-09-04.
• BSC: Not verifiable as of 2026-09-04.
• Base: Not verifiable as of 2026-09-04.
• OP Mainnet: Not verifiable as of 2026-09-04.
• Polygon: Not verifiable as of 2026-09-04. If you want, I can next help you frame a *risk memo* for this stress case using only verifiable off-chain evidence and clearly labeled gaps.

Assessment (as of September 13, 2026). Uniswap v4 has binding token-holder governance for treasury spending, protocol-fee activation/configuration, and annual UNI minting authority. The v4 core contracts are documented as immutable; governance instead controls fee-adapter/releaser configuration and related protocol infrastructure. This makes DAO governance substantively real for defined parameters and treasury actions, not merely symbolic. Proposal process: minimum 7-day forum RFC → 5-day Snapshot temperature check → onchain vote through Agora/Tally.

Current onchain requirements are 1M delegated UNI to propose, 2-day voting delay, 7-day voting period, 40M UNI in favor to pass, then a 2-day timelock; anyone may execute after the timelock. Control split: Uniswap Labs operates the app.uniswap.org frontend and related products under Universal Navigation Inc. (Delaware corporation; SEC CIK 0001775180). A 2019 SEC filing identifies Hayden Adams as executive officer and director; current directors and a state corporate registration number are Not verifiable as of September 13, 2026.

The frontend company is separate from the governance-controlled protocol. DUNI is the Wyoming DUNA legal wrapper for participating Uniswap governance members; its agreement identifies UNI, Governor Bravo, and Timelock contracts as the governance system and treasury-control mechanism. Concentration, top holders, multisig signers/threshold, emergency bypass, and chain-by-chain admin powers: Not verifiable as of September 13, 2026. Dune/on-chain verification was unavailable in this run; no holder or signer figures are inferred from aggregators.

Accordingly, unilateral fund-drain capability cannot be conclusively excluded on every listed chain, although the documented governance architecture does not describe a unilateral admin drain path.

Scope: Uniswap v4 is an on-chain smart-contract protocol, not a separately identified legal person. The principal legal exposure attaches to the interface/developer entity, Uniswap Labs, rather than automatically to deployed v4 contracts. Entity / jurisdiction: Universal Navigation Inc. d/b/a Uniswap Labs; Delaware corporation, principal place of business New York, United States. The Uniswap Foundation is a separate Delaware entity.

ToS, restrictions, KYC/AML: Uniswap Labs’ July 28, 2026 Terms prohibit sanctioned persons and users in comprehensively sanctioned jurisdictions, require compliance with applicable laws, and disclaim responsibility for users’ KYC, whitelisting, trading and jurisdictional obligations. Certain third-party products, token launches and hooks may impose identity verification or compliance checks. The Labs interface uses address screening; this does not mean the permissionless protocol itself performs universal KYC/AML.

Classification: No definitive judicial classification of Uniswap v4 as a securities exchange, broker, money transmitter or investment product was located. The CFTC found that Uniswap Labs offered leveraged/margined retail commodity transactions through its interface during 2021–2023, without registration, and imposed a $175,000 penalty in September 2024. This was a settled order concerning the interface and specified leveraged tokens—not a finding that all Uniswap protocol activity is unlawful.

Warnings/enforcement: The SEC issued a Wells notice in April 2024 concerning possible securities-law violations; a later SEC-filed disclosure states the Uniswap investigation closed in February 2025. No current SEC enforcement action against Uniswap Labs was located as of September 4, 2026. Court cases: In *Risley v.

Universal Navigation*, the Second Circuit affirmed dismissal of federal securities claims in 2025; on March 2, 2026, the S.D.N.Y. dismissed the remaining state-law claims with prejudice. Sanctions / data protection: No OFAC designation of Uniswap Labs or the protocol was located; screening of sanctioned addresses is not itself a sanctions designation. Labs’ privacy policy describes limited off-chain data collection, sharing with infrastructure/analytics providers, GDPR and California rights, and the inability to erase public blockchain data.

Legal structure vs. actual risk: Decentralization and separate entities reduce—but do not eliminate—risk. Practical exposure remains concentrated in Labs’ interfaces, APIs, wallets, product integrations, personnel and compliance controls; permissionless v4 deployments and third-party front ends may remain operational outside Labs’ control. Assessment: regulatory risk: material; current active enforcement: not identified; sanctions risk: address-level screening and jurisdictional restrictions remain relevant.

GLEIF LEI registry unavailable at scan time. OFAC SDN screening of 'Universal Navigation Inc. d', 'a Uniswap Labs', 'Uniswap V4': no match. SEC litigation and administrative release feeds: no mention.

Uniswap v4 does not issue its own stablecoin, so a protocol-issued stablecoin depeg history is not applicable. On the available web evidence, the protocol is stablecoin-agnostic and routes liquidity through third-party stable pairs such as USDC/USDT; no verified protocol-issued stablecoin depeg events were found. Not verifiable as of 2026-09-06.

Uniswap v4’s primary risk is not the immutable core alone, but the large, permissionless hook ecosystem operating inside the swap lifecycle. The singleton and flash-accounting design concentrate failure impact, while custom accounting, non-standard tokens, external dependencies, MEV, and cross-chain deployment add materially different loss paths. On-chain exposure by chain, TVL concentration, and deployed-hook quality are Not verifiable as of September 5, 2026 because Dune MCP is unavailable.

Uniswap v4’s top strengths are its customizability, lower gas costs, efficient routing, native ETH support, and flexible fee design. The most distinctive improvement is hooks, which let developers attach custom logic to pools and build new market behaviors on top of Uniswap rather than deploying separate AMMs.

• Customizable pools via hooks: developers can add logic at key points in a pool’s lifecycle, enabling features such as custom trading rules and on-chain strategies.
• Lower gas costs: the singleton architecture and pool creation model reduce deployment and management overhead, with sources citing pool creation costs up to 99% lower than earlier versions.
• More efficient multi-hop swaps: flash accounting net-settles balances at the end of a transaction, reducing unnecessary transfers and making complex routes cheaper.
• Native ETH support: v4 allows direct ETH pairs, removing the need to wrap ETH into WETH and lowering friction and gas for ETH trading.
• Dynamic and unlimited fee flexibility: v4 supports more flexible fee structures than v3, including dynamic fees and more fee tiers, which improves pool design and market responsiveness.