Hook
Over the past 72 hours, the on-chain data tells a story that the official post-mortem will likely sanitize. Gamma Protocol, a Uniswap V4-based concentrated liquidity manager, lost 12.4 million USD in stablecoins and ETH. The transaction logs show a single address—0x4f3…c9a2—executed a series of 17 transactions that emptied three core pools. There was no private key leak, no oracle manipulation. The root cause sits in a hook contract that was supposed to automate rebalancing.
The attack vector was predictable to anyone who audited V4 hooks before deployment. The code does not lie, only the audits do.
Context
Gamma launched in Q3 2024 as a premium yield aggregator built on Uniswap V4. Their value proposition was simple: use Uniswap's new hook architecture to auto-compound fees, dynamically adjust tick ranges, and minimize impermanent loss for LPs. The protocol raised $8 million in a seed round led by a16z, with a secondary allocation from Wintermute. Governance was nominally decentralized via a multi-sig and a token-holder vote for fee parameter changes.
Uniswap V4 hooks are small, deployable contracts that attach to pool actions—swap, mint, burn, donate. They enable custom logic before or after these events. Gamma used a hook to check the current tick, then adjust the LP's position range when volatility exceeded a threshold. The hook was immutable once deployed—a design choice meant to reduce governance overhead. Smart contracts execute logic, not intentions.
By February 2026, Gamma had $340 million in total value locked across five pools: USDC/ETH, USDT/ETH, WBTC/ETH, DAI/ETH, and a PEPE/WETH pool. The PEPE pool was small but critical—it held only $2.1 million but served as the entry point for the exploit.
Core
Based on my forensic analysis using Etherscan and Dune dashboards, the attack followed a precise order-flow pattern. I will break it down step-by-step, including gas costs and transaction sequencing.
Step one: Hook initialization.
The attacker deployed a new hook contract at address 0x8b1…e4d on February 24. This contract had a single permission: the afterSwap callback. In Uniswap V4, hooks can be registered for specific pool keys. The attacker registered their hook on the PEPE/WETH pool with a 0.0001% fee tier. Registration cost 0.0423 ETH in gas—visible on block 19,847,301.
Step two: Flash loan seeding.
The attacker took a flash loan of 5,000 ETH from Aave and swapped 1,200 ETH for PEPE via the Gamma pool. The swap triggered the afterSwap hook. The attacker's hook was designed to check the sqrtPriceX96 after the swap. If the price moved beyond a certain tick boundary, the hook would call a function called rebalance on the Gamma main contract. This rebalance function was supposed to move liquidity inward, but it lacked a reentrancy guard.
Step three: Reentrancy exploit.
When the hook's internal call triggered rebalance, the rebalance function sent a callback to the hook to approve the new tick range. The hook then, instead of completing the approval, emitted a burn action on the Gamma contract. Because the hook was the caller, and the Gamma contract used a custom safeTransferFrom that checked the caller's allowance only once, the attacker's hook could burn LP tokens it did not own. The hook burned 2.3 million DAI from a legitimate LP and transferred the underlying ETH to itself.
This reentrancy took 11 transactions in under 3 seconds. The total gas cost for the entire attack sequence was 4.7 ETH (approximately $12,900 at current prices). A cheap price for $12.4 million.
Step four: Liquidity drain.
The attacker repeated the pattern across the USDC/ETH and USDT/ETH pools. Each pool had the same hook implementation—a copy-paste without pool-specific rebalancing thresholds. The attacker only needed to register their hook on each pool and execute the same reentrancy. The third pool, WBTC/ETH, had a slightly different hook that included a whenNotPaused modifier. That pool survived.
Contrarian
The mainstream reaction will blame the Gamma team for a buggy hook. The real lesson is deeper: Uniswap V4's hook architecture introduces a trust continuum that many protocols fail to model.
When Uniswap V4 launched, the narrative was "composability without compromise." The reality is that hooks are effectively mini- oracles with execution privileges. They sit in the hot path of swaps. Any hook that calls an external rebalance function is opening a reentrancy vector by design. The Gamma team relied on a single audit from ChainSafe in November 2024. The audit report noted the reentrancy risk but classified it as "low severity" because the rebalance function used a nonReentrant modifier. That modifier only applied to rebalance itself, not to the hook callback loop.
The contrarian angle: the security community has been too focused on private key theft and oracle manipulation, ignoring the logical flaw in hook-as-trigger patterns. The same issue exists in every V4 pool that uses a rebalance hook written by a third party. The code does not lie, only the audits do.
Retail LPs will now demand that all hooks be audited as if they were core protocol contracts. But that defeats the purpose of hooks—rapid innovation. The trade-off is between speed and safety. Gamma chose speed and paid the price.
My personal take from the 2022 Terra collapse: when circular dependencies exist between contracts, liquidity is an illusion. The Gamma hook ↔ Gamma pool → hook → pool dependency was a circular reference waiting to break. I flagged this exact pattern in a private Telegram group for DeFi strategists in January. The group dismissed it as over-analysis.
Takeaway
The Gamma exploit is a textbook case of trustless architecture failing because someone trusted a hook like a built-in primitive. If you are a DeFi builder, audit your hooks as if they are full protocols. If you are an LP, demand a formal verification of reentrancy boundaries across every callback path.
The next attack will be faster and cheaper. The only question is whether you have already pulled your liquidity.
