Skip to content

ECO-144: Create AI-augmented v4 hook guide - #1146

Draft
wkoutre wants to merge 3 commits into
Uniswap:mainfrom
wkoutre:nickkoutrelakos/eco-144-create-ai-augmented-v4-hook-guide-v4-template-uniswap-ai
Draft

ECO-144: Create AI-augmented v4 hook guide#1146
wkoutre wants to merge 3 commits into
Uniswap:mainfrom
wkoutre:nickkoutrelakos/eco-144-create-ai-augmented-v4-hook-guide-v4-template-uniswap-ai

Conversation

@wkoutre

@wkoutre wkoutre commented Aug 9, 2026

Copy link
Copy Markdown

Summary

Adds a guide, content/protocols/v4/guides/hooks/ai-augmented-hook-development.mdx, that walks a developer through the full v4 hook lifecycle — scaffold, implement, test, audit, deploy — using an AI coding agent alongside the v4-template.

  • Backed entirely by two existing Uniswap AI skills (no new skills introduced): v4-security-foundations for the scaffold, test, and audit steps; viem-integration for post-deploy verification and app integration.
  • Prompts are agent-agnostic plain text, not Claude-specific, per the ticket's acceptance criteria.
  • Cross-linked from the existing Hooks Overview guide and registered in the Hooks section's meta.json nav.

Accuracy pass

Every factual claim was verified against Uniswap/v4-template@main and Uniswap/uniswap-ai@main rather than written from memory. The corrections:

Claim Reality
Test utilities are Fixtures/EasyPosm Fixtures no longer exists. It is BaseTest (inherits Deployers) plus EasyPosm.
Hook extends a bare BaseHook; the OpenZeppelin library is an optional swap-in The template's example extends OpenZeppelin's BaseHook and overrides internal _beforeSwap-style callbacks. Code written the other way does not compile here. The OZ library is the template's primary dependency.
Template "ships with v4-core and v4-periphery pre-installed" They are not direct submodules; they resolve through lib/uniswap-hooks.
Write a viem script that mines a CREATE2 salt The template already ships script/00_DeployHook.s.sol, which does this with v4-periphery's HookMiner and the CREATE2 proxy. The guide now adapts that script.
viem-integration covers "deployment patterns" It covers client setup, reads, and writes. No contract-deployment content. It now backs post-deploy verification instead.

Claims that held up: the 14 permission flags, and the CREATE2 proxy address 0x4e59b44847b379578588920cA78FbF26c0B4956C.

Also added: the Foundry stable-channel requirement (the template README calls out Nightly incompatibility), the anvil-first local flow, and the BaseScript.sol fields that must be set before scripts 0103 work.

Security of the advice

The guide tells developers how to get an agent to write a hook, so a bad prompt ships a bad hook. Two fixes:

  • The Step 2 prompt previously offered a choice between the sender parameter and hookData for user identity. Neither is trustworthy. It now requires the router-allowlist plus msgSender() pattern from Access msg.sender Inside a Hook.
  • That prompt and a new Step 4 checklist item require the allowlist setters be owner-restricted. Worth flagging separately: accessing-msg.sender.mdx writes addRouter/removeRouter as bare external functions with no owner check, so an agent copying it literally builds an allowlist anyone can write to. That is a pre-existing issue in that page, not this PR, but this guide now warns about it.

Linear: https://linear.app/uniswap/issue/ECO-144/create-ai-augmented-v4-hook-guide-v4-template-uniswap-ai

Test plan

  • Content-only change — no build in this repo (README/CONTRIBUTING note this repo mirrors content into a separate publishing pipeline).
  • All six internal /docs/... links resolve to existing files under content/.
  • All external links return HTTP 200.
  • Frontmatter, title-case headings, code-fence tags, and meta.json conventions match sibling pages.
  • Reviewed by an independent fresh-context reviewer; findings addressed.
  • Reviewer: confirm placement/scope is right given ECO-152 (Use Case Guides) targets this same Hooks/Guides section with a more granular 4-page breakdown. ECO-144 lists ECO-152 only as relatedTo, not a blocker, so this ships ECO-144's single-guide scope.

wkoutre added 2 commits August 8, 2026 18:09
Adds a guide that walks through the full v4 hook lifecycle (scaffold,
implement, test, audit, deploy) using an AI coding agent alongside the
v4-template, backed by the existing v4-security-foundations and
viem-integration skills. Prompts are agent-agnostic plain text, not
Claude-specific.

Closes ECO-144.
- Deploy prompt now mines a CREATE2 salt through the deployer proxy
  instead of a plain CREATE deploy, which would produce a hook address
  that doesn't encode the enabled permission flags.
- Clarify that neither sender nor hookData is trustworthy for user
  identity without router allowlisting, and link the existing
  accessing-msg.sender guide.
- Move the OpenZeppelin base-contract customization tip to Step 1
  (scaffold), where base-contract choice actually happens.
@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown

Thanks for contributing to Uniswap Docs! 🦄

Quick heads up on how this repo works: the docs you see on developers.uniswap.org are built from a separate source repo. When we accept a change here, we port it over there, so your fix might show up on the live site before it lands in this repo.

Updates to this repo come in batches on a regular cadence. When yours is included, you'll be credited as a co-author on the commit, so the contribution counts on your GitHub profile and in Uniswap/docs.

We review every PR but can't merge everything. Either way, someone from the docs team will follow up here once we've taken a look.

One legal bit: by submitting a PR you agree your contribution is licensed under the repo's MIT license.

…guide

Verified every factual claim against Uniswap/v4-template@main and
Uniswap/uniswap-ai@main. Several were stale or wrong.

Template facts:
- The test harness is `BaseTest` (inheriting `Deployers`) plus `EasyPosm`.
  `Fixtures` no longer exists. Step 3's prompt now names the real files,
  matching what your-first-hook.mdx already says.
- The example hook extends OpenZeppelin's `BaseHook` and overrides the
  internal underscore-prefixed callbacks. Scaffolding against a bare
  v4-periphery `BaseHook` would not compile in this template. The OZ hooks
  library is the template's primary dependency, not an optional swap-in.
- v4-core and v4-periphery are not direct submodules; they resolve through
  `lib/uniswap-hooks`. Reworded "pre-installed" to describe the remappings.
- Added the Foundry stable-channel requirement and `foundryup`, which the
  template README calls out explicitly.
- Named `src/Counter.sol` and the four permissions it enables, since the
  first `forge test` runs against it.

Deployment:
- The template ships `script/00_DeployHook.s.sol`, which already mines the
  salt with v4-periphery's `HookMiner` and deploys through the CREATE2
  proxy. Step 5 now adapts that script instead of asking the agent to
  re-implement salt mining in TypeScript.
- `viem-integration` contains no contract-deployment material, so it now
  backs post-deploy verification and app integration, which is what it
  covers. Its description no longer claims "deployment patterns".
- Added the anvil-first local flow and the `BaseScript.sol` fields that
  must be set, including `hookContract`.

Security:
- The Step 2 prompt offered a choice between `sender` and `hookData`, both
  untrustworthy, and corrected it only in later prose. It now requires the
  router-allowlist plus `msgSender()` pattern from accessing-msg.sender.
- That prompt and a new Step 4 checklist item now require the allowlist
  setters be owner-restricted. The linked page writes them as bare
  `external` functions, so an agent copying it literally produces an
  allowlist anyone can write to.

Reviewed by an independent fresh-context reviewer; its findings are
included above.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant