Zoo Finance's UniswapV4 hook exploited for ~$27K via pricing curve approximation error and fee-tracking mismatch allowing profitable sandwich swaps.
Security & Exploits ·
Zoo Finance's UniswapV4 hook was exploited for approximately $27,000 through a combination of pricing approximation and reserve-tracking errors. The vulnerable hook used a nonlinear logarithmic price curve but approximated execution prices with a simple midpoint average, introducing directional bias where T→VT swaps slightly overpaid the swapper while VT→T swaps underpaid the pool. An attacker chained more than 20 alternating swaps within a single callback, exploiting the accumulated rounding error across multiple round trips to generate profit.
The vulnerability was compounded by a mismatch in fee handling: the hook tracked reserves using pre-fee input amounts but computed swap outputs from post-fee amounts. This inflation of virtual reserves without corresponding real token inflows caused the pricing formula to continue offering favorable rates as liquidity drained. The VTSwapHook deployments across multiple chains were affected by the same design flaw.
A recovery effort returned 17,560 REPPO and 17,681 vREPPO tokens from the Base chain deployment to the Zoo Finance team. It remains unclear whether the attacker maintained control of other recovered amounts or whether additional exploitations occurred on other chains hosting the same hook design.