Recently uncovered a quite covert V4 Hook logic vulnerability, and it's pretty disgusting to talk about.

Initially, I just felt something was off about the implementation mechanism of a certain Hook, so I threw its code into AI for analysis. The results were even more speechless—this Hook actually secretly siphons off the proper slippage. That's right, you heard it correctly—those extra tokens during a trade that don't flow through the official main pool are instead secretly accumulated into a dark pool.

What's even more frustrating is that these intercepted assets are not transparently displayed on-chain and can only be withdrawn periodically by whitelisted addresses. This effectively creates a hidden profit channel, completely bypassing the regulatory logic of the official main pool.

For DeFi users, this kind of design pattern represents a typical implicit risk. The seemingly normal slippage handling during transactions actually conceals a mechanism for funds to be redirected. I recommend everyone to thoroughly audit the fee logic and fund flow design when choosing Hook contracts, and don't be fooled by the superficial functionality description.