HookGuard

Every hook on the list, one square each

Orange means it can move money and has no audit on record. Hover any square to see which hook it is.

315 moves money, no audit 25 moves money, audited 142 can't move money 4 audited, can't move money

Why this is worth caring about. A hook sits in the path of every trade in its pool, and anyone can open a new pool pointing at an existing hook — you don't need the author's permission. Bunni v2, at the time the biggest hook by money held, was drained of ~$8.3M in September 2025 and shut down.

One honest caveat. "No audit" here means the list doesn't record one — not that none exists. That gap is the actual point: right now there's no machine-readable way for anyone to tell a reviewed hook from an unreviewed one. If a hook here has been audited, open an issue and we'll fix the data.

This is not an audit. It reads permissions and list metadata; it does not read what the hook actually does. A high score means worth a look, never broken. A low score means nothing showed up at this level, never safe. How we tested the rules — and the five ways they were wrong →

The list only shows the ones that signed up

Uniswap's registry is opt-in — a hook is on it because someone asked. So we went and counted the real thing: every pool ever created on Unichain, and the hook attached to each one. Here's the gap.

on the list

actually out there

1.24%

of them are listed

pools ever created

of them use a hook — 71%

hooks used by 10+ pools

Being straight about this number. 1,094 of the 1,211 are attached to exactly one pool — that's launchpads spitting out a fresh hook per token, not 1,094 real projects. The ones that matter are the 117 used by two or more pools, and the 35 used by ten or more. Even so: the second and third busiest hooks on Unichain aren't on the list at all.

unlisted hooks in 10+ pools

of those publish source — 17%

listed hooks publish source — 100%

The ones off the list mostly can't be checked at all. Every hook on the registry publishes its source, because publishing is effectively how you get listed — that 100% describes the sign-up form, not the ecosystem. Off the list, 25 of the 30 hooks sitting in the swap path of 10 or more live pools publish nothing. No source to audit, to scan, or to read. That is the ceiling on every source-level tool in v4 — this one included. The 5 that do publish aren't obscure: PrediXHookProxyV2, UniMemeHook, BunniHook, PolymarketHook, UniswapCupHook.

And the busiest one is a proxy. PrediXHookProxyV2, attached to 1,034 pools, is upgradeable. The permission bits in a hook's address are fixed forever and a live pool cannot detach from its hook — but the code behind that address can still be swapped. Whoever holds the upgrade key is part of the trust boundary of every one of those pools.

Check it yourself: CHAIN=unichain python3 src/discover.py · it refuses to publish a partial scan, because undercounting is the one mistake that would quietly make this number a lie · raw data

Which chains are worst

Bar length is how many hooks that chain has. The coloured part is the share with no audit on record.

ethereum

171

95%

base

162

95%

robinhood

100%

arbitrum

90%

bnb

75%

unichain

94%

polygon

82%

optimism

91%

xlayer

100%

avalanche

100%

monad

80%

blast

100%

celo

100%

soneium

100%

worldchain

100%

zora

100%

315 hooks can move your money. Nobody checked them.

Every hook on the list, one square each

The list only shows the ones that signed up

Which chains are worst

Browse all 486