Hook Attestation Kit

Signed, machine-verifiable audit attestations for already-deployed Uniswap v4 hooks.

Status: spec draft v0.0 (November 2026). Proposed for a Uniswap Foundation Open Grant.

Problem

An audit today is a PDF link. A router, interface, LP or AI agent looking at a hook address cannot check that this exact bytecode at this address is what was audited. hooklist stores an audit URL. IHookMetadata (v4-periphery #382) requires the hook to implement an interface, which immutable hooks that are already deployed cannot do.

What the kit does

An auditor (or the hook team) signs an attestation off-chain. Anyone verifies it offline or from a contract.

Each attestation binds:

Field	Meaning
chainId, hook	where the hook lives
runtimeCodeHash	EXTCODEHASH of the hook at audit time
implementation, implCodeHash	for proxies: the implementation and its code hash
sourcifyMatch	Sourcify match for the audited source
commit	audited git commit
reportHash, reportURI	hash and location of the audit report
scope, findingsSummary	ERC-7512-style summary
issuer, issuedAt, expiresAt	who signed, when
revocationNonce	lets the issuer revoke

If the runtime bytecode or the proxy implementation changes, the attestation stops verifying.

Design choices

• Reuses ERC-7512 AuditSummary + EIP-712 typed data. Field-compatible with IHookMetadata: if a hook implements #382, the verifier reads it directly; if not, the attestation covers it from outside.
• Signatures: EIP-712 secp256k1 for EOAs, ERC-1271 for auditor multisigs.
• Revocation: issuer-signed revocation records plus an optional on-chain revocation registry.
• Precedents: Rhinestone ERC-7484 module registry, Gearbox BytecodeRepository.
• Not a scanner, not a dashboard, not an alert service.

Deliverables (planned)

1. Spec v0.1 for v4 hooks (bytecode + proxy binding, revocation) and test vectors.
2. Verifiers: TypeScript, Python, Solidity view function.
3. Auditor signing CLI.
4. hooklist schema extension proposed upstream.
5. Static verification page per hook.

MIT licensed. Contact: hello@predge.io · Telegram t.me/latcom