A Uniswap v4 hook on Hedera
The pool that
says no.
A Uniswap v4 hook that refuses two things a pool has never been able to refuse: a buyer who isn’t qualified, and a manager exceeding his mandate.
May 2026
Nothing in the stack could tell a decision from an injection.
In May 2026 an attacker drained roughly $150,000 from an AI-controlled wallet by asking Grok to translate a Morse code message. The decoded text was a transfer instruction. Content filters saw Morse. Spend limits had already been escalated away by an NFT the agent accepted. Nothing in the stack could tell a decision from an injection, because nothing was looking at decisions.
$1.1B
stolen across on-chain AI exploits, H1 2026
3.4×
all of 2025, in six months
$216k
the Bankr injection, single incident
SOURCE · BLOCKAID, H1 2026 · 212 EXPLOITS
Try it
Take the manager. It won’t help you.
context received
its reasoning
structured input — it never reads the prompt
verdict
covenant checks
✓ mandate_hash_matches
✓ validator_signature
✓ price_within_band
✗ max_position_pct
Fund balance
$482,150.00
Watch this figure, not the panes. It is the only thing on the page that would have changed.
One hook, two policies
Two things a pool has never been able to refuse.
IdentityNotVerified
- Refused: a buyer whose wallet is not in the ERC-3643 identity registry.
- Checked inside beforeSwap, before the pool prices anything at all.
- A permissionless pool cannot know its counterparty. This one asks.
CovenantBreach("max_position_pct")
- Refused: the fund's own manager, proposing a position over the ceiling.
- Evaluated against covenants the manager holds no key to amend.
- The validator signed nothing, so the hook had nothing to honour.
How
Five steps, and the manager is trusted at none of them.
- 1
Propose
The manager reads whatever it has been given and proposes a trade. It is assumed compromised, so nothing about this step is trusted — including its reasoning.
- 2
Validate
An independent validator re-derives the decision from structured inputs it fetches itself. It never reads the prompt, the reasoning, or any text the manager saw.
- 3
Sign
If the decision survives, the validator signs an EIP-712 receipt over the pool and the parameters. If it does not, there is no signature and nothing to present.
- 4
Enforce
The hook verifies that signature inside beforeSwap and evaluates the covenants itself. Anything outside the mandate reverts with a named reason.
- 5
Journal
The outcome is written to Hedera consensus — approvals, refusals and breaches alike — before it is anyone's word against anyone else's.
The stack
Three pieces, each doing one job.
Hedera— the register
The identity registry and the journal. Every decision the fund makes is written to a consensus topic before it is anyone's word against anyone's.
Uniswap v4— the trustee
The hook is where the refusal happens. Not a wrapper around the pool, not a guard in front of it — inside beforeSwap, where the swap either clears or does not.
Chainlink— the author
Prices the validator re-derives its decision from, fetched independently. The manager never supplies the numbers it is judged against.
3s
finality, Hedera consensus
$0.0008
per journal entry
296
chain id, Hedera testnet
~35k
gas overhead per swap