ECO-144: Create AI-augmented v4 hook guide - #1146
Draft
wkoutre wants to merge 3 commits into
Draft
Conversation
Adds a guide that walks through the full v4 hook lifecycle (scaffold, implement, test, audit, deploy) using an AI coding agent alongside the v4-template, backed by the existing v4-security-foundations and viem-integration skills. Prompts are agent-agnostic plain text, not Claude-specific. Closes ECO-144.
- Deploy prompt now mines a CREATE2 salt through the deployer proxy instead of a plain CREATE deploy, which would produce a hook address that doesn't encode the enabled permission flags. - Clarify that neither sender nor hookData is trustworthy for user identity without router allowlisting, and link the existing accessing-msg.sender guide. - Move the OpenZeppelin base-contract customization tip to Step 1 (scaffold), where base-contract choice actually happens.
|
Thanks for contributing to Uniswap Docs! 🦄 Quick heads up on how this repo works: the docs you see on developers.uniswap.org are built from a separate source repo. When we accept a change here, we port it over there, so your fix might show up on the live site before it lands in this repo. Updates to this repo come in batches on a regular cadence. When yours is included, you'll be credited as a co-author on the commit, so the contribution counts on your GitHub profile and in Uniswap/docs. We review every PR but can't merge everything. Either way, someone from the docs team will follow up here once we've taken a look. One legal bit: by submitting a PR you agree your contribution is licensed under the repo's MIT license. |
…guide Verified every factual claim against Uniswap/v4-template@main and Uniswap/uniswap-ai@main. Several were stale or wrong. Template facts: - The test harness is `BaseTest` (inheriting `Deployers`) plus `EasyPosm`. `Fixtures` no longer exists. Step 3's prompt now names the real files, matching what your-first-hook.mdx already says. - The example hook extends OpenZeppelin's `BaseHook` and overrides the internal underscore-prefixed callbacks. Scaffolding against a bare v4-periphery `BaseHook` would not compile in this template. The OZ hooks library is the template's primary dependency, not an optional swap-in. - v4-core and v4-periphery are not direct submodules; they resolve through `lib/uniswap-hooks`. Reworded "pre-installed" to describe the remappings. - Added the Foundry stable-channel requirement and `foundryup`, which the template README calls out explicitly. - Named `src/Counter.sol` and the four permissions it enables, since the first `forge test` runs against it. Deployment: - The template ships `script/00_DeployHook.s.sol`, which already mines the salt with v4-periphery's `HookMiner` and deploys through the CREATE2 proxy. Step 5 now adapts that script instead of asking the agent to re-implement salt mining in TypeScript. - `viem-integration` contains no contract-deployment material, so it now backs post-deploy verification and app integration, which is what it covers. Its description no longer claims "deployment patterns". - Added the anvil-first local flow and the `BaseScript.sol` fields that must be set, including `hookContract`. Security: - The Step 2 prompt offered a choice between `sender` and `hookData`, both untrustworthy, and corrected it only in later prose. It now requires the router-allowlist plus `msgSender()` pattern from accessing-msg.sender. - That prompt and a new Step 4 checklist item now require the allowlist setters be owner-restricted. The linked page writes them as bare `external` functions, so an agent copying it literally produces an allowlist anyone can write to. Reviewed by an independent fresh-context reviewer; its findings are included above. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a guide,
content/protocols/v4/guides/hooks/ai-augmented-hook-development.mdx, that walks a developer through the full v4 hook lifecycle — scaffold, implement, test, audit, deploy — using an AI coding agent alongside the v4-template.v4-security-foundationsfor the scaffold, test, and audit steps;viem-integrationfor post-deploy verification and app integration.Hooks Overviewguide and registered in the Hooks section'smeta.jsonnav.Accuracy pass
Every factual claim was verified against
Uniswap/v4-template@mainandUniswap/uniswap-ai@mainrather than written from memory. The corrections:Fixtures/EasyPosmFixturesno longer exists. It isBaseTest(inheritsDeployers) plusEasyPosm.BaseHook; the OpenZeppelin library is an optional swap-inBaseHookand overrides internal_beforeSwap-style callbacks. Code written the other way does not compile here. The OZ library is the template's primary dependency.lib/uniswap-hooks.script/00_DeployHook.s.sol, which does this with v4-periphery'sHookMinerand the CREATE2 proxy. The guide now adapts that script.viem-integrationcovers "deployment patterns"Claims that held up: the 14 permission flags, and the CREATE2 proxy address
0x4e59b44847b379578588920cA78FbF26c0B4956C.Also added: the Foundry stable-channel requirement (the template README calls out Nightly incompatibility), the anvil-first local flow, and the
BaseScript.solfields that must be set before scripts01–03work.Security of the advice
The guide tells developers how to get an agent to write a hook, so a bad prompt ships a bad hook. Two fixes:
senderparameter andhookDatafor user identity. Neither is trustworthy. It now requires the router-allowlist plusmsgSender()pattern from Access msg.sender Inside a Hook.accessing-msg.sender.mdxwritesaddRouter/removeRouteras bareexternalfunctions with no owner check, so an agent copying it literally builds an allowlist anyone can write to. That is a pre-existing issue in that page, not this PR, but this guide now warns about it.Linear: https://linear.app/uniswap/issue/ECO-144/create-ai-augmented-v4-hook-guide-v4-template-uniswap-ai
Test plan
/docs/...links resolve to existing files undercontent/.meta.jsonconventions match sibling pages.relatedTo, not a blocker, so this ships ECO-144's single-guide scope.