AUDIT TRANSCRIPT
Verbatim canonical report generated from the bounded read-only evidence snapshot. The downloadable archive contains every raw artifact and both reproducer scripts.
# Robinhood Chain Uniswap v4 high-fee pool investigation Generated 2026-08-14 from read-only Robinhood Chain RPC and Blockscout data. ## Verdict The [reported pattern](https://x.com/i/status/2088063686099206637) is real. During the bounded 8,000,000-block window from block 27,845,418 (`2026-08-04 18:37:53 UTC`) through 35,845,417 (`2026-08-14 01:08:06 UTC`), the official Robinhood Chain Uniswap v4 PoolManager emitted: - 111,291 pool `Initialize` events. - 16,949 pools configured with a static LP fee from 850,000 through 999,999 pips: 85% through 99.9999%. - 16,943 of those 16,949 pools used the zero-hook address. This is overwhelmingly vanilla v4 pool spam, not a hook exploit. - 4,755 high-fee pools later traded during the window, producing 24,152 `Swap` events in 21,981 transactions. - 7,674 distinct currency pairs were represented among the high-fee pool initializations. The pattern looks like automated shadow-pool or route-poisoning infrastructure, not primarily first-block sniping. It creates many alternative pools for token pairs, seeds liquidity at chosen prices, and captures a very large fraction of the input whenever a route includes one of those pools. This is happening on **Robinhood Chain**, a permissionless EVM network. It is not evidence that the Robinhood brokerage application itself selected or exposed these routes. Robinhood's own documentation describes the chain as open and permissionless and lists Uniswap as a third-party public DEX. ## Router evidence The claim that aggregators are simply avoiding the pools is not supported by the execution data. The `Swap.sender` field identifies the contract that immediately called PoolManager; it does not, by itself, identify the user-facing app or offchain quote engine that selected the route. | Immediate PoolManager caller | Verified identity | High-fee swap legs | Known-value LP fees* | | --- | --- | ---: | ---: | | `0x8876789976dEcBfCbBbe364623C63652db8C0904` | Uniswap `UniversalRouter` | 5,275 | $2,325.62 | | `0x39b38686a19836ac10162c490e4558e120CbBE5f` | `RobinHoodSettler`, matching the 0x Settler stack | 3,951 | $2,235.02 | | `0xA687b664662B96b180346D699a6d5b42e9B05d31` | `UniversalUniswapV4Adapter` | 1,473 | $588.91 | The Uniswap Universal Router and 0x Settler together account for 9,226 of 24,152 observed high-fee swap legs, or 38.20%. They account for 32.43% of the fee value that can be conservatively priced as ETH, WETH, or USDG. Concrete executions: - [Transaction `0xe76e…015`](https://robinhoodchain.blockscout.com/tx/0xe76eb18a946d4dc9a3e457fb923bc983a7ae40aa0c28588cb207041c6b92e015) entered through an unverified outer contract and then used Universal Router. Its ETH/LMBR v4 leg had an 89.369% nominal LP fee and accrued about `0.1948623587 ETH`, approximately $367.79 at the stated reference price. - [Transaction `0x1102…ac0`](https://robinhoodchain.blockscout.com/tx/0x1102513199287573c26cca0ac084f26966fdb4bc23da69c010e78b1684a61ac0) called Universal Router's `execute` method directly. Its 98.101% pool accrued `76.280920 USDG` in LP fees. - [Transaction `0x9d06…8be`](https://robinhoodchain.blockscout.com/tx/0x9d067711ad03b571deae1a78e83a59202828280288f63b2cfa6ae74fafebb8be) entered through the ERC-4337 EntryPoint and used the verified `RobinHoodSettler` as the immediate v4 caller. The high-fee leg accrued about `0.0617765861 ETH`, approximately $116.60. Those examples show both direct Universal Router execution and nested routes consistent with trading consoles, smart wallets, or upstream integrations. They prove that the high-fee legs executed. They do not prove which offchain quoting component chose each route, so the exact selector defect remains integration-specific. ## Fee accrual and the post's $15,000 estimate All 24,152 swaps reconcile exactly against the pool's static LP fee and its direction-specific Robinhood Chain protocol fee. The observed LP-fee accrual in readily priced assets was: - `2.699665680206267523 ETH` - `0.013044957360234056 WETH` - `8,941.869509 USDG` Using an ETH/WETH reference price of `$1,887.43`, that is **$14,061.92**. Another 1,567 input tokens accrued fees but were deliberately left unpriced. The post's rough `$15K` figure is therefore directionally credible. This is a lower-bound valuation of gross LP-fee accrual in the bounded 9.27-day scan, not verified realized profit. It does not prove that every fee has been collected, value the long tail of tokens, subtract gas or inventory losses, or reconstruct every position's share of each pool. ## Operator concentration Initial PositionManager NFT ownership was resolved for 3,935 of the 4,755 active pools, representing 297 distinct initial owners. Another 820 pools had a missing or non-unique mint path in the initialization transaction and remain unattributed. The largest resolved initial owners created 259, 239, 228, 211, and 173 active pools respectively. Fee value is more concentrated in several owner-associated pool clusters, but initial NFT ownership alone is not enough to claim the final beneficiary or exact per-owner profit because later liquidity changes and position transfers were not reconstructed. The evidence supports a few large operators plus a broader rotating or long-tail address set—not literally only a handful of addresses. ## Likely mechanism Uniswap v4 permits multiple permissionless pools for the same token pair and supports static LP fees up to the protocol cap. A deployer can therefore: 1. Initialize an alternative pool for a real or newly launched token pair with an 85–99.9999% fee. 2. Seed liquidity at a price that makes the pool or a multi-hop path appear usable to a route search. 3. Wait for a user, smart wallet, console, or quote engine to submit a route containing that pool. 4. Receive most of the input on that leg as LP fees when the swap remains inside the caller's aggregate `minOut` or maximum-input constraint. The onchain execution is working as v4 specifies: PoolManager applies the configured fee. The likely failure boundary is route discovery, quoting, pool filtering, token-market validation, or an explicitly encoded upstream route—not a demonstrated Uniswap v4 core exploit. ## Practical defenses For traders: - Do not trust an unfamiliar token's displayed spot price or aggregate route alone. - Decode the v4 pool key and reject unexpectedly high LP fees before signing. - Use tight output protection and verify the final asset amount, especially through trading consoles and cross-chain or account-abstraction flows. For routers and integrators: - Apply a hard or policy-based fee ceiling for discovered v4 pools unless the user explicitly opts in. - Score routes by final executable output after all per-leg fees, not raw spot price or apparent liquidity. - Detect duplicate-pair pool spam and adversarial initialization bursts. - Simulate the exact calldata at the target block and expose every selected pool fee to the user. ## Method and limitations - Primary source: `eth_getLogs` from the official chain RPC against the official Uniswap v4 PoolManager, with adaptive block-range splitting and cached checkpoints. - Independent check: 25 evenly spaced initialization transactions were reproduced through Robinhood Chain Blockscout; all 25 matched and there were no missing or extra events. - Dynamic-fee pools and 11 static pools configured at exactly 100% were excluded from the 85–99.9999% cohort. - The scan begins at a bounded block, so its initialization and fee totals are not an all-time census. - Router labels come from verified Blockscout contracts and official Uniswap/0x implementation references. Immediate-caller attribution is not the same as frontend attribution. ## Sources - [Original X post](https://x.com/i/status/2088063686099206637) - [Robinhood Chain documentation](https://docs.robinhood.com/chain/?lang=en) - [Robinhood Chain Uniswap v4 PoolManager](https://robinhoodchain.blockscout.com/address/0x8366a39CC670B4001A1121B8F6A443A643e40951) - [Robinhood Chain Universal Router](https://robinhoodchain.blockscout.com/address/0x8876789976dEcBfCbBbe364623C63652db8C0904) - [RobinHoodSettler on Blockscout](https://robinhoodchain.blockscout.com/address/0x39b38686a19836ac10162c490e4558e120cbbe5f) - [Uniswap v4 swap guide](https://developers.uniswap.org/docs/protocols/v4/guides/swapping/swapping) - [Uniswap Universal Router overview](https://developers.uniswap.org/docs/protocols/universal-router/overview) - [0x Settler repository](https://github.com/0xProject/0x-settler) - [0x contract documentation](https://docs.0x.org/docs/core-concepts/contracts) - [ETH/USD reference](https://api.coingecko.com/api/v3/simple/price?ids=ethereum&vs_currencies=usd)