# VTSwapHook: fee-adjusted pricing vs full reserve update drains funds

VTSwapHook mispriced Uniswap V4 swaps by using fee-adjusted amounts for pricing but full pre-fee amounts for reserves, letting an attacker drain 4.5M vATH and 2M ATH.

- Payout: Real-world hack
- Severity: critical
- Program: VTSwapHook
- Credited: DeFiHackLabs
- Disclosed: 2026-03-28
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-03/VTSwapHook_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260328-vtswaphook
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:oracle-manipulation

**Target:** Uniswap V4 hook (VTSwapHook) on Arbitrum
**Root cause:** The hook computed swap pricing using fee-adjusted amounts but updated internal reserves with the full pre-fee specified amount, creating a mismatch that allowed profitable round trips.
**Steps:**
1. Deploy attack contract and approve PoolManager for VATH and ATH.
2. Call `manager.unlock("")` to enter unlock callback.
3. Read `hook.reserve1()` and perform exact-in ATH->vATH swap with `amountSpecified = -reserve1 * 35 / 100` and `sqrtPriceLimitX96 = V4_MAX_USABLE_SQRT_PRICE`.
4. Perform exact-output vATH->ATH swap using the vATH credit from step 3 as `amountSpecified` and `sqrtPriceLimitX96 = V4_MIN_USABLE_SQRT_PRICE`.
5. Verify net deltas for both currencies are positive.
6. Call `manager.take(VATH, address(this), netDelta0)` and `manager.take(ATH, address(this), netDelta1)` to extract profits.
**How found:** Analysis of the hook's pricing logic revealed that fee-adjusted amounts were used for curve pricing while full pre-fee amounts updated reserves, enabling a profitable alternating swap sequence.
**Exploitation:** Attacker used a flash-accounting round trip: one exact-in swap followed by one exact-output swap, exploiting the reserve/pricing mismatch to accumulate positive deltas in both currencies without settling input, then took the tokens via PoolManager.
**Insight:** When auditing Uniswap V4 hooks, compare the amounts used for pricing calculations against those used for state updates; any discrepancy in fee handling can create arbitrage or drain opportunities via round-trip swaps.