Launchly

We express our gratitude to the Launchly team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Launchly implements a Uniswap v4 hook that intercepts swap execution to collect a fixed 2% fee on swaps involving the chain’s native currency, withdrawing the fee via the PoolManager and forwarding it to an immutable fee recipient through before-swap and after-swap accounting adjustments.

The system users should acknowledge all the risks summed up in the risks section of the report

{Finding_Table?columns=title,severity,status&setting.filter.type=Vulnerability}

Documentation quality

• Functional requirements and fee policy assumptions are not clearly specified.

• Technical design details are not documented.

• Function-level NatSpec comments are minimal and do not fully describe intended behavior and revert conditions.

Code quality

• The implementation leverages standard Uniswap v4 core/periphery interfaces and libraries rather than duplicating common functionality.

• The code is concise and generally follows Solidity best practices.

• Some protocol-specific assumptions are encoded implicitly in logic rather than expressed as explicit invariants.

Test coverage

Code coverage of the project is 44.45% (branch coverage).

• Deployment, pool initialization, liquidity minting, and basic swap flows are covered.

• Fee collection is exercised for native-input swaps and verified via balance/event checks, but edge cases around exact-output and hook delta semantics are not covered.

• Multi-user or adversarial interaction scenarios are not tested.

Launchly is a Uniswap v4 hook-based fee module that includes the LaunchlyBNBHook contract, designed to attach to a Uniswap v4 pool and impose an additional hook-level fee on swaps that involve the chain’s native currency. The hook is configured to run on the swap lifecycle only (before and after swap callbacks) and forwards collected fees to an immutable FEE_RECIPIENT address set at deployment time.

Operationally, the hook detects whether the native currency is on the input side or the output side of a swap, computes a 2% fee based on the relevant amount, and collects that fee using poolManager.take() function. To keep the swap’s accounting consistent with the fee extraction, it returns hook deltas (BeforeSwapDelta and the afterSwap delta) that are intended to adjust the swap’s settlement to reflect the deducted fee.

The contract intentionally rejects direct native currency deposits via receive() and fallback() to prevent accidental funds from being sent to the hook address, keeping the hook’s role limited to fee collection during PoolManager-mediated swap execution.

Privileged roles

• LaunchlyBNBHook has no owner or admin roles and no post-deployment privileged configuration functions.

• The FEE_RECIPIENT is set once during deployment and is the immutable address to which all hook fees are transferred during swap execution.

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope