Uniswap v4 & Aggregators

wstGBP trades on-chain through a tGBP/wstGBP Uniswap v4 pool whose hook (WsgemBackstopHook) routes every swap through the wrapper’s atomic mint/redeem: buys execute at wstGBP.mintcost(), sells at wstGBP.burncost(). Depth inside the wrapper’s own ~25bps bid/ask band (the spread is the wrapper’s redeem fee) is bounded by mint capacity and the wrapper’s tGBP balance rather than by pool liquidity, and both prices ratchet up as NAV accrues.

The design has two consequences:

• There is no LP. beforeAddLiquidity reverts, so every swap is a wrapper mint or redeem, never AMM liquidity.
• There is no capital and no owner. The hook is ownerless, holds no funds, and adds no fee, admin, or pause of its own.

Deployed contracts on Ethereum mainnet (chainId 1)

All five contracts are ownerless and hold no capital.

Solidity source for the backstop hook and its periphery (the router, quoter, adapter, and hook helper), along with their tests and deployment scripts, is public at Arb-Capital/wstgbp-univ4-hook .

Pool id & canonical PoolKey

Uniswap v4 pools have no address. The pool lives inside the PoolManager singleton, keyed by poolId = keccak256(abi.encode(PoolKey)):

Swap direction

tGBP < wstGBP numerically, so currency0 = tGBP, currency1 = wstGBP:

• zeroForOne == true buys wstGBP: pay tGBP, executed as a wrapper mint at mintcost().
• zeroForOne == false sells wstGBP: receive tGBP, executed as a wrapper redeem at burncost().

Both tokens are 18 decimals; all prices are WAD (1e18) tGBP-per-wstGBP.

Swapping on v4 with WsgemSwapRouter

v4 swaps against this hook must be settle-first (pay the input before the swap executes). Route through WsgemSwapRouter or any settle-first solver; a plain swap-then-settle v4 router will revert.

function swapExactInput(
    PoolKey calldata key,
    bool zeroForOne,
    uint256 amountIn,
    uint256 minAmountOut,
    address recipient,      // address(0) => msg.sender
    uint256 deadline
) external returns (uint256 amountOut);
 
function swapExactOutput(
    PoolKey calldata key,
    bool zeroForOne,
    uint256 amountOut,
    uint256 maxAmountIn,    // surplus is refunded
    address recipient,
    uint256 deadline
) external returns (uint256 amountIn);

Both have Permit2 variants (swapExactInputPermit2 / swapExactOutputPermit2) that fund the swap from a Permit2 SignatureTransfer instead of a router approval; the permit’s token must be the input currency and its deadline is the swap deadline.

The router enforces minAmountOut (exact-input), maxAmountIn (exact-output), and full delivery of the exact output: a swap reverts rather than silently delivering less than agreed. Quotes are point-in-time and the oracle ratchets between quote and execution, so never send minAmountOut = 0.

Quoting with WsgemQuoter

Pre-flight swaps with the quoter rather than simulating reverts:

function quoteExactInput(bool zeroForOne, uint256 amountIn) external view returns (uint256 amountOut);
function quoteExactOutput(bool zeroForOne, uint256 amountOut) external view returns (uint256 amountIn);
 
// amountSpecified: negative = exact-input, positive = exact-output (PoolManager convention)
function previewSwap(bool zeroForOne, int256 amountSpecified)
    external view
    returns (uint256 amountIn, uint256 amountOut, bool executable, string memory reason);

previewSwap reports the live blockers instead of reverting: market closed, dust threshold, capacity exceeded, wrapper underfunded, redeem cooldown active, or oracle paused. Quoter output matches execution exactly.

Off-chain, quote directly from wstGBP.mintcost() / burncost() with the same WAD math as direct mint/redeem (see Mint & Redeem).

WsgemDirectAdapter for aggregators and solvers

WsgemDirectAdapter is a standalone, ownerless approve-then-swap contract that calls wstGBP.mint/redeem directly: no pool, no v4 callback, ordinary swap-then-settle semantics. DEX aggregators (Odos, LI.FI, Paraswap) and CoW Protocol solvers can call it like any swap contract; no settle-first router is needed. Prices and guards are identical to the hook’s.

// tokenIn == tGBP buys wstGBP (mint); tokenIn == wstGBP sells (redeem)
function swapExactInput(
    address tokenIn,
    uint256 amountIn,
    uint256 minAmountOut,
    address recipient,      // address(0) => msg.sender
    uint256 deadline
) external returns (uint256 amountOut);
 
function swapExactOutput(
    address tokenIn,
    uint256 amountOut,
    uint256 maxAmountIn,    // only the computed exact input is pulled
    address recipient,
    uint256 deadline
) external returns (uint256 amountIn);
 
function quoteExactInput(address tokenIn, uint256 amountIn) external view returns (uint256 amountOut);
function quoteExactOutput(address tokenIn, uint256 amountOut) external view returns (uint256 amountIn);

Permit2 variants (swapExactInputPermit2 / swapExactOutputPermit2) are available here too. The adapter is a pure price-taker with no price bounds of its own, so pass real slippage bounds.

CoW Swap order hooks with WsgemHookHelper

CoW Swap hooks  are {target, callData, gasLimit} entries in an order’s appData, executed by the public HooksTrampoline, which holds no funds and is callable by anyone. The adapter can’t be a hook target (it pulls from msg.sender), so WsgemHookHelper fills that gap: an ownerless wrap/unwrap target whose proceeds are hard-wired back to the user, at the same mintcost()/burncost() oracle prices as every other venue.

// POST-hook, after an order that buys tGBP: wrap the proceeds into wstGBP.
// Sweeps min(balance, allowance) of the owner's tGBP; all wstGBP goes to owner.
function wrapAll(address owner, uint256 minAmountOut) external returns (uint256 amountOut);
 
// PRE-hook, before an order that sells tGBP: redeem the owner's wstGBP back to tGBP.
function unwrap(address owner, uint256 amountIn, uint256 minAmountOut) external returns (uint256 amountOut);
function unwrapAll(address owner, uint256 minAmountOut) external returns (uint256 amountOut);

The security model is owner-bound: anyone may call every function, but funds only ever move from the owner back to the owner, capped by the owner’s ERC-20 allowance to the helper. The worst an arbitrary caller can do is trigger a conversion of the approved amount at the same mintcost()/burncost() oracle price as every other venue, delivered to the owner. That is bounded griefing (the wrapper’s ~25bps bid/ask spread on a forced round-trip), never extraction.

Integration notes:

• Grant exact-amount approvals to the helper, per order. wrapAll sweeps min(balance, allowance) because post-hook proceeds vary with order surplus.
• minAmountOut protects the signed hook against oracle movement between order signing and execution; set it from a quote, as with any swap.
• Hook execution is a weak guarantee (solver social consensus): an order can settle even if its hook was skipped. A skipped wrapAll leaves the owner holding tGBP plus a revocable approval; a skipped unwrap leaves the order unable to settle for lack of the sell token. Either way, nothing is lost.
• Unwraps face the same sell-side gates as every venue: they revert if wstGBP.cooldown() != 0 (RedeemCooldownActive) or the wrapper lacks tGBP (WrapperUnderfunded). There are no partial fills and no deferred payouts.
• Each conversion emits Wrap(owner, caller, amountIn, amountOut) or Unwrap(owner, caller, amountIn, amountOut), where caller is the executor, never the payer.

Hook payload snippets live in Swap Recipes.

What integrators should monitor

All of these are public on-chain reads on wstGBP (0x57C3...B7aE); they gate the pool, the router, the adapter, and the hook helper alike:

Ban-list screening applies to swaps as it does to direct mint/redeem: the swap recipient must not be banned on tGBP (see Contract Reference). Buys settle wstGBP through the PoolManager to the recipient, and every leg is screened.

Choosing a venue

Copy-paste viem snippets for all of the above (quoting, router swaps, adapter swaps, and venue monitoring) live in Swap Recipes.