Risks & Security

Audited

DualPool was audited by OpenZeppelin from May 20 to June 17, 2026. The audit reported no critical and no high-severity issues, and every finding and note was resolved. The full report is published in the DualPool repository.

What the operator can — and can't — do

The protocol has one privileged role: the hook owner, who creates pools, seeds them, and can pause and resume swapping. Two-step ownership transfers are required, and ownership can never be renounced into thin air.

Just as important is what the owner cannot do:

• Fees can't be changed. A pool's fee is fixed forever at creation. Changing it means deploying a new pool.
• Your exit can't be blocked. Pausing stops swaps and new deposits — withdrawals keep working. There is no mechanism to freeze LP funds.
• Pricing can't be manipulated per-swap. No hidden parameters or per-trade overrides exist; execution is plain Uniswap v4 math at the posted fee.

The vaults

Idle capital lives in third-party ERC-4626 lending vaults — for the live pool, Steakhouse-curated vaults on Morpho. This is where the yield comes from, and it is the protocol's largest external dependency. What that means in practice:

• If a vault temporarily limits withdrawals, the pool quotes less to traders. Your share's claim is measured against total assets, so a throttled vault reduces activity, not your ownership.
• A compromised vault is the serious scenario: the hook holds standing allowances to its vaults, so vault selection is a real trust decision. The protocol verifies vaults are feeless at setup and includes an emergency control that pauses the pool, revokes both vault allowances, and pulls balances back in one action.
• Curated vaults add a softer assumption: trusting the curator not to gate the pool's access.

Yield drag, not loss

The “idle claims” effect described in Providing liquidity is a drag on yield, not a loss of principal: tokens waiting to be swept into the vault still belong to the pool — they're just not earning while they wait.

Quotes vs. execution

Every quote in this app is indicative. What executes is the bound you set — minimum received, or maximum sent for exact-output swaps. Never sign a transaction whose bound you wouldn't accept as the final price.

The fine print

Smart-contract risk never rounds to zero, audits included. The live deployment is a test deployment, sized accordingly. Nothing here is investment advice.