On September 9, a founder named Ozzy did something that, in a bear market, counts as a small act of courage: he publicly denied an allegation that no ordinary user could easily verify. The claim was that Pons — a token project whose liquidity lives inside a Uniswap V4 pool — had quietly raised its tax rate after issuance. His answer was blunt. The rate was never adjustable. The official pool charges 0% trade tax plus a 1% hook fee. Anyone seeing more than 1% had simply been routed somewhere else. Liquidity flows where belief resides, and belief had just left the room. Here is the part that should worry every builder on V4: nobody had to lie for users to pay more than the contract promised. The router took them there.
Pons is not complicated on paper. It is an application-layer token project that deployed its official liquidity pool on Uniswap V4, using the hook mechanism — the plugin architecture that lets a pool execute custom logic at key lifecycle points. Its configuration is 0% trade tax and a 1% hook fee, a structure the team says was disclosed from day one.
The controversy began when users on certain trading terminals saw fees above 1% and concluded that Pons had moved the goalposts after launch. Ozzy's response had four parts: the project does not support post-issuance tax changes; the anomaly comes from terminals misrouting orders into higher-fee pools; malicious actors had attempted to "vamp" liquidity pools, which pushed some terminals to display inflated rates; and he had already asked the affected terminals to correct their routing.
That last detail matters more than the first three combined. Pons does not control the path between a user and its pool. The terms of the trade — the thing a user actually consents to — are set by software the project does not own.
Let us be precise about the mechanism, because the imprecision is where the fear lives. Uniswap V4 allows multiple pools to exist for the same token pair with different hook configurations. In V3 this was already true of fee tiers, but a V3 fee tier is a single number legible at a glance. A V4 hook is arbitrary behavior. When a router asks which pool is best, it is comparing not just prices but custom logic it may not fully parse. Pool discovery, parameter display, and pool identity verification have not kept pace.
Now add the second failure. A 1% hook fee and a "1% tax" are not the same object, but they look identical in a user interface. The trade tax lives in the token contract; the hook fee is charged by the pool's custom logic. Round-trip cost on the official pool is roughly 2% — buy and sell, each paying the hook. That is higher than most V3 tiers, and it is being presented to users under a "0% tax" headline. The number is not a lie. It is a disclosure that was never designed to be read by a human at three in the morning.
I learned something about this in 2017, as a junior engineer at a small Frankfurt security firm. I spent weeks inside the Parity multi-sig contracts and found a self-destruct vulnerability that could have drained millions. I hesitated — disclosure would disrupt a launch. I sent it privately to the core team first. What I took from that year was not a template for bug reports but a rule about context: code has conscience only when the human reading its consequences can see them. A parameter that is technically public but practically invisible is, ethically, not disclosed.
The "vamp" detail deserves the same scrutiny. In DeFi, vampire attacks historically meant luring liquidity with incentives. Here the description fits something closer to a poisoned or impersonating pool: an attacker deploys a Pons pool with higher fees, and the router, blind to provenance, selects it. That is MEV's quieter cousin — not front-running your trade, but redirecting it into a cost you never agreed to. In 2020, while leading community governance design for Aave's v2 launch, I spent long nights arguing that financial sovereignty had to mean more than the ability to sign a transaction. Sovereignty means the signature means what you think it means.
After FTX, I retreated to Frankfurt and spent months inside ZK-rollup research — Aztec's proof systems, specifically — because mathematical certainty without a trusted third party felt like the only honest comfort left. Those months taught me that ZK does not solve this problem. Verification of the trade and verification of the terms of the trade are different problems. Pons's contracts may be perfectly sound. The consent layer above them was not.
Also note what the response did not include: no audit disclosure, no code repository, no statement about admin privileges, no timelock. Ozzy's phrasing — that users seeing higher rates are being misrouted, unless a deployer set a higher rate at issuance — contains a conditional that implies tax parameter space exists somewhere. Maybe it is locked. Maybe it is a principle rather than a constraint. We cannot tell, and that uncertainty is itself the risk.
The comfortable reading is that this is a terminal bug and Pons is a victim. I do not fully buy it. Terminals have always optimized for the best price path. They were never asked to be custodians of pool provenance, and nobody has funded the pool identity authentication layer that V4 adoption now requires. Blaming them for a gap the ecosystem never built is convenient and cheap.
The less comfortable reading is that Pons chose its fee structure for legibility in the wrong direction. A 0% trade tax is the signature of a serious token — no honeypot mechanics, no obvious meme-tax red flags. That is a positioning choice, and it worked. But it pushed the entire revenue model into a hook fee that most users cannot distinguish from a tax. Trust is the new token, and it was spent on branding, not on clarity. In a bear market, where the only question readers actually have is whether their assets are safe, a fee you cannot verify is indistinguishable from a fee that was changed.
The next six months will tell us whether V4's tooling grows a provenance layer — a signed registry, a standard for terminal-side pool badges — or whether every custom-hook project learns this lesson alone, one misrouted trade at a time. Watch what the terminals actually ship, not what the founder promises. The contract said 1%. The experience said otherwise. Whichever number users end up believing is the one that becomes the protocol.