# HOOKWATCH

> Uniswap v4 hook intelligence for Base. We observe public on-chain data about v4 hooks
> and report what we found, with the evidence. This is not a security audit and we say so
> in every response. Unknown information is labelled UNKNOWN rather than guessed.

## What we do

We read a hook contract's bytecode, permission flags, proxy slots and admin storage from
a public Base RPC, hash the bytecode, and keep a record over time so a change can be
reported. Every claim in a report carries the source and block it came from.

## Paid endpoints

- quick_check (Quick check): 0.10 USDC - GET /v1/v4/hook-check
- full_report (Full risk report): 0.50 USDC - POST /v1/v4/risk-report
- implementation_change (Implementation change report): 2.00 USDC - GET /v1/v4/hook-delta
- watch_7d (Seven-day monitoring): 5.00 USDC - POST /v1/v4/watch

Payment is x402 over HTTP 402, settled in USDC on Base. The 402 response body and the
PAYMENT-REQUIRED header both describe the payment. No API key is needed.

## Free endpoints

- https://hookwatch.bradleyswartz317.workers.dev/v1/changes - the most recent hook changes we recorded, newest first
- https://hookwatch.bradleyswartz317.workers.dev/v1/sample/report - a sample report on a limited example dataset
- https://hookwatch.bradleyswartz317.workers.dev/v1/pricing - current prices
- https://hookwatch.bradleyswartz317.workers.dev/openapi.json - the full OpenAPI document
- https://hookwatch.bradleyswartz317.workers.dev/.well-known/x402.json - machine-readable payment metadata
- https://hookwatch.bradleyswartz317.workers.dev/mcp - MCP server (tools/list, tools/call)

## Limits

- Base mainnet and Base Sepolia only.
- We monitor a bounded set of pools, not every pool.
- Our history is what we observed while watching; it is not the entire life of a contract.
- Not a security audit.