CAMPAIGN FUNNEL
25 / 25 BLOCKSCOUT MATCHObserved Robinhood Chain · Uniswap v4 · bounded census
THE 99% TOLLBOOTH
Permissionless pools collected extreme fees through real execution paths. The chain proves the tollbooths existed and traded; it does not prove which frontend chose every route.
Abstract
8,000,000 blocks · 9.27 days · canonical PoolManagerWe censused Robinhood Chain blocks 27,845,418–35,845,417 and found 16,949 static Uniswap v4 pools configured for 85–99.9999% fees among 111,291 PoolManager initializations. Of that cohort, 4,755 pools executed 24,152 swap legs in 21,981 transactions; fee math reconciles for every observed leg, and 16,943 pools used no hook. ETH, WETH, and USDG inputs alone accrued a known LP-fee floor of $14,061.92 at the disclosed reference price, while 1,567 other input currencies remain unpriced. Immediate callers include Uniswap Universal Router and 0x-matching RobinHoodSettler. The evidence supports an automated duplicate-pair route-poisoning campaign and an integration-policy failure boundary—not a Uniswap v4 core exploit. It does not identify the offchain selector for every trade or establish brokerage-app involvement, victim loss, or realized operator profit.
- Method
- Canonical Initialize + Swap event census
- Result
- 4,755 traded extreme-fee pools
- Reconciliation
- 24,152 / 24,152 swap legs
- Conclusion
- Route policy, not v4 fee math
Robinhood Chain ≠ Robinhood brokerage app.
Boundary
This is a permissionless EVM network. No evidence here establishes that the retail brokerage UI selected these trades.
Long-form investigation narrative Expand the mechanism, execution evidence, economics, and engineering implications
Permissionless pool identity created a hostile route-search surface
Uniswap v4 permits multiple pools for the same currency pair because fee, tick spacing, and hook address are part of pool identity. The observed campaign used that design surface at scale: 16,949 extreme-fee pools covered 7,674 pairs, and 99.965% of the pools were hookless. The mechanism therefore does not require malicious hook code or a broken PoolManager.
The pools were not inert spam
4,755 pools received at least one swap. The canonical event stream records 24,152 high-fee legs across 21,981 transactions. Universal Router directly called PoolManager for 5,275 legs and RobinHoodSettler for 3,951. Those contracts prove real execution paths touched the pools; they do not, by themselves, reveal the originating UI, API, smart account, or quote engine.
The priced slice is a floor, not a loss estimate
For ETH, WETH, and USDG input legs, $15,277.74 of gross input was observed and $14,061.92—92.0419%—accrued as configured LP fees. Another 1,567 input currencies were intentionally left unpriced. Accrual is not the same as fee collection, net profit, or victim loss; output value, liquidity ownership changes, inventory exposure, and gas are outside this reconstruction.
Integrators need adversarial pool-selection policy
The chain shows normal v4 fee accounting applied to abnormal pools. The defensible engineering response is upstream: reject or heavily penalize untrusted fee tiers, canonicalize duplicate-pair candidates, simulate exact output, enforce user-protective minimum output, and retain pool IDs in quote telemetry. The exact selector defect remains unproven, so the report attributes immediate execution contracts—not every frontend decision.
The snapshot is reproducible but not an all-time census
The locked discovery artifact records requested bounds, source hosts, block-hash anchors, reproducer parameters, and a 25/25 Blockscout confirmation. It predates the collector's per-range coverage ledger, so range-by-range completion cannot be retroactively proven. That limitation is preserved rather than papered over.
01
CAMPAIGN POPULATION
Observed
From pool spam to live tollbooths
Every stage is counted from the official v4 PoolManager event stream.
HOOK FINGERPRINT
DerivedAlmost entirely vanilla v4
—of high-fee pools used the zero-hook address
This rejects the easy “malicious hook exploit” explanation. PoolManager applied ordinary configured fees.
BLOCK-INDEXED PULSE
Campaign persisted across the full scan
InitializedSwap legs
—16 equal block slices · exact block axis—
PAIR MULTIPLICITY
InferenceDuplicate pools make route poisoning tangible
02
FEE TERRAIN
Derived
Even the 99% cohort executed
Configured LP fee, activation, and fee accrual stay separate.
STATIC FEE BANDS
85–99.9999%Pool population and observed execution
PRICED-ASSET SLICE
DerivedWhere the known input went
GROSS ETH / WETH / USDG INPUT—
Not victim loss or realized profit. The swap output may retain value; 1,567 other input currencies are deliberately unpriced.
ACTIVATION LATENCY
DerivedNot primarily same-block sniping
Blocks are exact. Time equivalents use the scan window’s average seconds per block and are approximate.
03
EXECUTION PATHS
Attributed
Routers did touch the tollbooths
Immediate PoolManager callers are observable. Frontend and quote-engine selection usually are not.
01USER / SMART ACCOUNTOrigin varies
02ROUTER / SETTLERImmediate execution path
03V4 POOLMANAGERApplies configured fee
0485–99.9999% POOLMost input becomes LP fee
CALLER RANK
Who immediately called PoolManager
OWNER → CALLER FLOW
AssociationPool-origin clusters meeting execution paths
Left nodes are initial PositionManager NFT owners associated with the pool—not proven attackers or final fee recipients.
04
OPERATOR CLUSTERS
Association
Concentrated at the top, long-tailed underneath
Initial NFT ownership gives a clustering handle, not a beneficiary ledger.
INITIAL POSITION OWNERS
POSITIONMANAGER MINT LOGSLargest active-pool clusters
| Initial owner | Active pools | Share | Associated known fees | Attribution state |
|---|
05
ANNOTATED TRANSACTIONS
Observed
Three route shapes, one fee pattern
Direct router, wrapped router, and account-abstraction settlement examples.
06
EVIDENCE EXPLORER
Observed
Inspect the 16,949-pool cohort
The full compact index loads only when requested.
Previewing the highest known-value active pools. Load the index for all 16,949 records.
| Pool / pair | Fee | Block | Swaps | Known fee floor | Initial owner |
|---|
07
EVIDENCE BOUNDARIES
Method
What the chain proves—and what it doesn’t
The confidence labels are part of the product, not fine print.
COMPLETE RELEASE CAPSULE
Full audit. Raw chain evidence. Reproducer source.
The public bundle carries every artifact used by the investigation—not just the dashboard’s compact projection.
VERIFYING BUNDLE LOCK…
ARTIFACT LOCKER
SHA-256 LOCKEDEvery file inside the public bundle
SOURCE CHAIN
Linked