[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GRESNYKH33FVGX16ZPWV9F":3,"skill-same:01M6GRESNYKH33FVGX16ZPWV9F":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":24,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":6,"ownerHtmlUrl":60,"ownerBlogUrl":61,"ownerDescription":62,"updatedAt":63,"install":64,"resources":77},"01M6GRESNYKH33FVGX16ZPWV9F","v4-security-foundations",null,"Security-first Uniswap v4 hook development. Use when user mentions \"v4 hooks\", \"hook security\", \"PoolManager\", \"beforeSwap\", \"afterSwap\", or asks about V4 hook best practices, vulnerabilities, or audit requirements.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",81,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdefi\u002Funiswap-official-v4-hooks\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdefi\u002Funiswap-official-v4-hooks\u002FSKILL.md",[19],{"categoryNo":20,"categoryName":21,"taxonomyType":22,"taxonomyTypeDesc":23},"01JBSEEDCAT000000000000040","财务","PROFESSION","适用职业",[25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"v4 security foundations","foundations","security","hooks","when","uniswap v4","opus","hook","type","uniswap","requirements","task","use","webfetch","read","subagent","explore","first","Hook Development","audit","best practices","development","2026-11-10 10:12:30",false,"---\nname: v4-security-foundations\ndescription: Security-first Uniswap v4 hook development. Use when user mentions \"v4 hooks\", \"hook security\", \"PoolManager\", \"beforeSwap\", \"afterSwap\", or asks about V4 hook best practices, vulnerabilities, or audit requirements.\nallowed-tools: Read, Glob, Grep, WebFetch, Task(subagent_type:Explore)\nmodel: opus\nlicense: MIT\nmetadata:\n  author: uniswap\n  version: '1.1.0'\n---\n\n# v4 Hook Security Foundations\n\nSecurity-first guide for building Uniswap v4 hooks. Hook vulnerabilities can drain user funds—understand these concepts before writing any hook code.\n\n## Threat Model\n\nBefore writing code, understand the v4 security context:\n\n| Threat Area             | Description                                                | Mitigation                                     |\n| ----------------------- | ---------------------------------------------------------- | ---------------------------------------------- |\n| **Caller Verification** | Only `PoolManager` should invoke hook functions            | Verify `msg.sender == address(poolManager)`    |\n| **Sender Identity**     | `msg.sender` always equals PoolManager, never the end user | Use `sender` parameter for user identity       |\n| **Router Context**      | The `sender` parameter identifies the router, not the user | Implement router allowlisting                  |\n| **State Exposure**      | Hook state is readable during mid-transaction execution    | Avoid storing sensitive data on-chain          |\n| **Reentrancy Surface**  | External calls from hooks can enable reentrancy            | Use reentrancy guards; minimize external calls |\n\n## Permission Flags Risk Matrix\n\nAll 14 hook permissions with associated risk levels:\n\n| Permission Flag                   | Risk Level | Description                 | Security Notes                |\n| --------------------------------- | ---------- | --------------------------- | ----------------------------- |\n| `beforeInitialize`                | LOW        | Called before pool creation | Validate pool parameters      |\n| `afterInitialize`                 | LOW        | Called after pool creation  | Safe for state initialization |\n| `beforeAddLiquidity`              | MEDIUM     | Before LP deposits          | Can block legitimate LPs      |\n| `afterAddLiquidity`               | LOW        | After LP deposits           | Safe for tracking\u002Frewards     |\n| `beforeRemoveLiquidity`           | HIGH       | Before LP withdrawals       | Can trap user funds           |\n| `afterRemoveLiquidity`            | LOW        | After LP withdrawals        | Safe for tracking             |\n| `beforeSwap`                      | HIGH       | Before swap execution       | Can manipulate prices         |\n| `afterSwap`                       | MEDIUM     | After swap execution        | Can observe final state       |\n| `beforeDonate`                    | LOW        | Before donations            | Access control only           |\n| `afterDonate`                     | LOW        | After donations             | Safe for tracking             |\n| `beforeSwapReturnDelta`           | CRITICAL   | Returns custom swap amounts | **NoOp attack vector**        |\n| `afterSwapReturnDelta`            | HIGH       | Modifies post-swap amounts  | Can extract value             |\n| `afterAddLiquidityReturnDelta`    | HIGH       | Modifies LP token amounts   | Can shortchange LPs           |\n| `afterRemoveLiquidityReturnDelta` | HIGH       | Modifies withdrawal amounts | Can steal funds               |\n\n### Risk Thresholds\n\n- **LOW**: Unlikely to cause fund loss\n- **MEDIUM**: Requires careful implementation\n- **HIGH**: Can cause fund loss if misimplemented\n- **CRITICAL**: Can enable complete fund theft\n\n## CRITICAL: NoOp Rug Pull Attack\n\nThe `BEFORE_SWAP_RETURNS_DELTA` permission (bit 3) is the most dangerous hook permission. A malicious hook can:\n\n1. Return a delta claiming it handled the entire swap\n2. PoolManager accepts this and settles the trade\n3. Hook keeps all input tokens without providing output\n4. User loses entire swap amount\n\n### Attack Pattern\n\n```solidity\n\u002F\u002F MALICIOUS - DO NOT USE\nfunction beforeSwap(\n    address,\n    PoolKey calldata,\n    IPoolManager.SwapParams calldata params,\n    bytes calldata\n) external override returns (bytes4, BeforeSwapDelta, uint24) {\n    \u002F\u002F Claim to handle the swap but steal tokens\n    int128 amountSpecified = int128(params.amountSpecified);\n    BeforeSwapDelta delta = toBeforeSwapDelta(amountSpecified, 0);\n    return (BaseHook.beforeSwap.selector, delta, 0);\n}\n```\n\n### Detection\n\nBefore interacting with ANY hook that has `beforeSwapReturnDelta: true`:\n\n1. **Audit the hook code** - Verify legitimate use case\n2. **Check ownership** - Is it upgradeable? By whom?\n3. **Verify track record** - Has it been audited by reputable firms?\n4. **Start small** - Test with minimal amounts first\n\n### Legitimate Uses\n\nNoOp patterns are valid for:\n\n- Just-in-time liquidity (JIT)\n- Custom AMM curves\n- Intent-based trading systems\n- RFQ\u002FPMM integrations\n\nBut each requires careful implementation and audit.\n\n## Delta Accounting Fundamentals\n\nv4 uses a credit\u002Fdebit system through the PoolManager:\n\n### Core Invariant\n\n```text\nFor every transaction: sum(deltas) == 0\n```\n\nThe PoolManager tracks what each address owes or is owed. At transaction end, all debts must be settled.\n\n### Key Functions\n\n| Function                     | Purpose                             | Direction              |\n| ---------------------------- | ----------------------------------- | ---------------------- |\n| `take(currency, to, amount)` | Withdraw tokens from PoolManager    | You receive tokens     |\n| `settle(currency)`           | Pay tokens to PoolManager           | You send tokens        |\n| `sync(currency)`             | Update PoolManager balance tracking | Preparation for settle |\n\n### Settlement Pattern\n\n```solidity\n\u002F\u002F Correct pattern: sync before settle\npoolManager.sync(currency);\ncurrency.transfer(address(poolManager), amount);\npoolManager.settle(currency);\n```\n\n### Common Mistakes\n\n1. **Forgetting sync**: Settlement fails without sync\n2. **Wrong order**: Must sync → transfer → settle\n3. **Partial settlement**: Leaves transaction in invalid state\n4. **Double settlement**: Causes accounting errors\n\n## Access Control Patterns\n\n### PoolManager Verification\n\nEvery hook callback MUST verify the caller:\n\n```solidity\nmodifier onlyPoolManager() {\n    require(msg.sender == address(poolManager), \"Not PoolManager\");\n    _;\n}\n\nfunction beforeSwap(\n    address sender,\n    PoolKey calldata key,\n    IPoolManager.SwapParams calldata params,\n    bytes calldata hookData\n) external override onlyPoolManager returns (bytes4, BeforeSwapDelta, uint24) {\n    \u002F\u002F Safe to proceed\n}\n```\n\n### Why This Matters\n\nWithout this check:\n\n- Anyone can call hook functions directly\n- Attackers can manipulate hook state\n- Funds can be drained through fake callbacks\n\n## Router Verification Patterns\n\nThe `sender` parameter is the router, not the end user. For hooks that need user identity:\n\n### Allowlisting Pattern\n\n```solidity\nmapping(address => bool) public allowedRouters;\n\nfunction beforeSwap(\n    address sender,  \u002F\u002F This is the router\n    PoolKey calldata key,\n    IPoolManager.SwapParams calldata params,\n    bytes calldata hookData\n) external override onlyPoolManager returns (bytes4, BeforeSwapDelta, uint24) {\n    require(allowedRouters[sender], \"Router not allowed\");\n    \u002F\u002F Proceed with swap\n}\n```\n\n### User Identity via hookData\n\n```solidity\nfunction beforeSwap(\n    address sender,\n    PoolKey calldata key,\n    IPoolManager.SwapParams calldata params,\n    bytes calldata hookData\n) external override onlyPoolManager returns (bytes4, BeforeSwapDelta, uint24) {\n    \u002F\u002F Decode user address from hookData (router must include it)\n    address user = abi.decode(hookData, (address));\n    \u002F\u002F CAUTION: Router must be trusted to provide accurate user\n}\n```\n\n### msg.sender Trap\n\n```solidity\n\u002F\u002F WRONG - msg.sender is always PoolManager in hooks\nfunction beforeSwap(...) external {\n    require(msg.sender == someUser); \u002F\u002F Always fails or wrong\n}\n\n\u002F\u002F CORRECT - Use sender parameter\nfunction beforeSwap(address sender, ...) external {\n    require(allowedRouters[sender], \"Invalid router\");\n}\n```\n\n## Token Handling Hazards\n\nNot all tokens behave like standard ERC-20s:\n\n| Token Type          | Hazard                               | Mitigation                          |\n| ------------------- | ------------------------------------ | ----------------------------------- |\n| **Fee-on-transfer** | Received amount \u003C sent amount        | Measure actual balance changes      |\n| **Rebasing**        | Balance changes without transfers    | Avoid storing raw balances          |\n| **ERC-777**         | Transfer callbacks enable reentrancy | Use reentrancy guards               |\n| **Pausable**        | Transfers can be blocked             | Handle transfer failures gracefully |\n| **Blocklist**       | Specific addresses blocked           | Test with production addresses      |\n| **Low decimals**    | Precision loss in calculations       | Use appropriate scaling             |\n\n### Safe Balance Check Pattern\n\n```solidity\nfunction safeTransferIn(\n    IERC20 token,\n    address from,\n    uint256 amount\n) internal returns (uint256 received) {\n    uint256 balanceBefore = token.balanceOf(address(this));\n    token.safeTransferFrom(from, address(this), amount);\n    received = token.balanceOf(address(this)) - balanceBefore;\n}\n```\n\n## Base Hook Template\n\nStart with all permissions disabled. Enable only what you need:\n\n```solidity\n\u002F\u002F SPDX-License-Identifier: MIT\npragma solidity ^0.8.24;\n\nimport {BaseHook} from \"v4-periphery\u002Fsrc\u002Fbase\u002Fhooks\u002FBaseHook.sol\";\nimport {Hooks} from \"v4-core\u002Fsrc\u002Flibraries\u002FHooks.sol\";\nimport {IPoolManager} from \"v4-core\u002Fsrc\u002Finterfaces\u002FIPoolManager.sol\";\nimport {PoolKey} from \"v4-core\u002Fsrc\u002Ftypes\u002FPoolKey.sol\";\nimport {BeforeSwapDelta, BeforeSwapDeltaLibrary} from \"v4-core\u002Fsrc\u002Ftypes\u002FBeforeSwapDelta.sol\";\n\ncontract SecureHook is BaseHook {\n    constructor(IPoolManager _poolManager) BaseHook(_poolManager) {}\n\n    function getHookPermissions() public pure override returns (Hooks.Permissions memory) {\n        return Hooks.Permissions({\n            beforeInitialize: false,\n            afterInitialize: false,\n            beforeAddLiquidity: false,\n            afterAddLiquidity: false,\n            beforeRemoveLiquidity: false,\n            afterRemoveLiquidity: false,\n            beforeSwap: false,           \u002F\u002F Enable only if needed\n            afterSwap: false,            \u002F\u002F Enable only if needed\n            beforeDonate: false,\n            afterDonate: false,\n            beforeSwapReturnDelta: false,      \u002F\u002F DANGER: NoOp attack vector\n            afterSwapReturnDelta: false,       \u002F\u002F DANGER: Can extract value\n            afterAddLiquidityReturnDelta: false,\n            afterRemoveLiquidityReturnDelta: false\n        });\n    }\n\n    \u002F\u002F Implement only the callbacks you enabled above\n}\n```\n\nSee [references\u002Fbase-hook-template.md](references\u002Fbase-hook-template.md) for a complete implementation template.\n\n## Security Checklist\n\nBefore deploying any hook:\n\n| #   | Check                                                 | Status |\n| --- | ----------------------------------------------------- | ------ |\n| 1   | All hook callbacks verify `msg.sender == poolManager` | [ ]    |\n| 2   | Router allowlisting implemented if needed             | [ ]    |\n| 3   | No unbounded loops that can cause OOG                 | [ ]    |\n| 4   | Reentrancy guards on external calls                   | [ ]    |\n| 5   | Delta accounting sums to zero                         | [ ]    |\n| 6   | Fee-on-transfer tokens handled                        | [ ]    |\n| 7   | No hardcoded addresses                                | [ ]    |\n| 8   | Slippage parameters respected                         | [ ]    |\n| 9   | No sensitive data stored on-chain                     | [ ]    |\n| 10  | Upgrade mechanisms secured (if applicable)            | [ ]    |\n| 11  | `beforeSwapReturnDelta` justified if enabled          | [ ]    |\n| 12  | Fuzz testing completed                                | [ ]    |\n| 13  | Invariant testing completed                           | [ ]    |\n\n## Gas Budget Guidelines\n\nHook callbacks execute inside the PoolManager's transaction context. Excessive gas consumption can make swaps revert or become economically unviable.\n\n### Gas Budgets by Callback\n\n| Callback                      | Target Budget | Hard Ceiling | Notes                         |\n| ----------------------------- | ------------- | ------------ | ----------------------------- |\n| `beforeSwap`                  | \u003C 50,000 gas  | 150,000 gas  | Runs on every swap; keep lean |\n| `afterSwap`                   | \u003C 30,000 gas  | 100,000 gas  | Analytics\u002Ftracking only       |\n| `beforeAddLiquidity`          | \u003C 50,000 gas  | 200,000 gas  | May include access control    |\n| `afterAddLiquidity`           | \u003C 30,000 gas  | 100,000 gas  | Reward tracking               |\n| `beforeRemoveLiquidity`       | \u003C 50,000 gas  | 200,000 gas  | Lock validation               |\n| `afterRemoveLiquidity`        | \u003C 30,000 gas  | 100,000 gas  | Tracking\u002Faccounting           |\n| Callbacks with external calls | \u003C 100,000 gas | 300,000 gas  | External DEX routing, oracles |\n\n### Common Gas Pitfalls\n\n1. **Unbounded loops**: Iterating over dynamic arrays (e.g., all active positions) can exceed block gas limits. Cap array sizes or use pagination.\n2. **SSTORE in hot paths**: Each new storage slot costs ~20,000 gas. Prefer transient storage (`tstore`\u002F`tload`) for data that doesn't persist beyond the transaction. Requires Solidity >= 0.8.24 with EVM target set to `cancun` or later.\n3. **External calls**: Each cross-contract call adds ~2,600 gas base cost plus the callee's execution. Batch calls where possible.\n4. **String operations**: Avoid `string` manipulation in callbacks; use `bytes32` for identifiers.\n5. **Redundant reads**: Cache `poolManager` calls — repeated `getSlot0()` or `getLiquidity()` reads cost gas each time.\n\n### Measuring Gas\n\n```bash\n# Profile a specific hook callback with Foundry\nforge test --match-test test_beforeSwapGas --gas-report\n\n# Snapshot gas usage across all tests\nforge snapshot --match-contract MyHookTest\n```\n\n---\n\n## Risk Scoring System\n\nCalculate your hook's risk score (0-33):\n\n| Category              | Points | Criteria                                 |\n| --------------------- | ------ | ---------------------------------------- |\n| **Permissions**       | 0-14   | Sum of enabled permission risk levels    |\n| **External Calls**    | 0-5    | Number and type of external interactions |\n| **State Complexity**  | 0-5    | Amount of mutable state                  |\n| **Upgrade Mechanism** | 0-5    | Proxy, admin functions, etc.             |\n| **Token Handling**    | 0-4    | Non-standard token support               |\n\n### Audit Tier Recommendations\n\n| Score | Risk Level | Recommendation                 |\n| ----- | ---------- | ------------------------------ |\n| 0-5   | Low        | Self-audit + peer review       |\n| 6-12  | Medium     | Professional audit recommended |\n| 13-20 | High       | Professional audit required    |\n| 21-33 | Critical   | Multiple audits required       |\n\n## Absolute Prohibitions\n\n**Never do these things in a hook:**\n\n1. **Never trust `msg.sender` for user identity** - It's always PoolManager\n2. **Never enable `beforeSwapReturnDelta` without understanding NoOp attacks**\n3. **Never store passwords, keys, or PII on-chain**\n4. **Never use `transfer()` for ETH** - Use `call{value:}(\"\")`\n5. **Never assume token decimals** - Always query the token\n6. **Never use `block.timestamp` for randomness**\n7. **Never hardcode gas limits in calls**\n8. **Never ignore return values from external calls**\n9. **Never use `tx.origin` for authorization** - It's a phishing vector; malicious contracts can relay calls with the original user's `tx.origin`\n\n## Pre-Deployment Audit Checklist\n\n| #   | Item                                      | Required For             |\n| --- | ----------------------------------------- | ------------------------ |\n| 1   | Code review by security-focused developer | All hooks                |\n| 2   | Unit tests for all callbacks              | All hooks                |\n| 3   | Fuzz testing with Foundry                 | All hooks                |\n| 4   | Invariant testing                         | Hooks with delta returns |\n| 5   | Fork testing on mainnet                   | All hooks                |\n| 6   | Gas profiling                             | All hooks                |\n| 7   | Formal verification                       | Critical hooks           |\n| 8   | Slither\u002FMythril analysis                  | All hooks                |\n| 9   | External audit                            | Medium+ risk hooks       |\n| 10  | Bug bounty program                        | High+ risk hooks         |\n| 11  | Monitoring\u002Falerting setup                 | All production hooks     |\n\nSee [references\u002Faudit-checklist.md](references\u002Faudit-checklist.md) for detailed audit requirements.\n\n## Production Hook References\n\nLearn from audited, production hooks:\n\n| Project        | Description           | Notable Security Features     |\n| -------------- | --------------------- | ----------------------------- |\n| **Flaunch**    | Token launch platform | Multi-sig admin, timelocks    |\n| **EulerSwap**  | Lending integration   | Isolated risk per market      |\n| **Zaha TWAMM** | Time-weighted AMM     | Gradual execution reduces MEV |\n| **Bunni**      | LP management         | Concentrated liquidity guards |\n\n## External Resources\n\n### Official Documentation\n\n- [v4-core Repository](https:\u002F\u002Fgithub.com\u002FUniswap\u002Fv4-core)\n- [v4-periphery Repository](https:\u002F\u002Fgithub.com\u002FUniswap\u002Fv4-periphery)\n- [Uniswap v4 Docs](https:\u002F\u002Fdocs.uniswap.org\u002Fcontracts\u002Fv4\u002Foverview)\n- [Hook Permissions Guide](https:\u002F\u002Fdocs.uniswap.org\u002Fcontracts\u002Fv4\u002Fconcepts\u002Fhooks)\n\n### Security Resources\n\n- [Trail of Bits Audits](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fpublications)\n- [Certora v4 Analysis](https:\u002F\u002Fwww.certora.com\u002F)\n- [ABDK Consulting](https:\u002F\u002Fabdk.consulting\u002F)\n\n### Community\n\n- [v4-hooks-skill by @igoryuzo](https:\u002F\u002Fgithub.com\u002Figoryuzo\u002FuniswapV4-hooks-skill) - Community skill that inspired this guide\n- [v4hooks.dev](https:\u002F\u002Fwww.v4hooks.dev) - Community hook resources\n\n---\n\n## Additional References\n\n- [Base Hook Template](references\u002Fbase-hook-template.md) - Complete implementation starter\n- [Vulnerabilities Catalog](references\u002Fvulnerabilities-catalog.md) - Common patterns and mitigations\n- [Audit Checklist](references\u002Faudit-checklist.md) - Detailed pre-deployment checklist\n","# v4 Hook Security Foundations\n\nSecurity-first guide for building Uniswap v4 hooks. Hook vulnerabilities can drain user funds—understand these concepts before writing any hook code.\n\n## Threat Model\n\nBefore writing code, understand the v4 security context:\n\n| Threat Area             | Description                                                | Mitigation                                     |\n| ----------------------- | ---------------------------------------------------------- | ---------------------------------------------- |\n| **Caller Verification** | Only `PoolManager` should invoke hook functions            | Verify `msg.sender == address(poolManager)`    |\n| **Sender Identity**     | `msg.sender` always equals PoolManager, never the end user | Use `sender` parameter for user identity       |\n| **Router Context**      | The `sender` parameter identifies the router, not the user | Implement router allowlisting                  |\n| **State Exposure**      | Hook state is readable during mid-transaction execution    | Avoid storing sensitive data on-chain          |\n| **Reentrancy Surface**  | External calls from hooks can enable reentrancy            | Use reentrancy guards; minimize external calls |\n\n## Permission Flags Risk Matrix\n\nAll 14 hook permissions with associated risk levels:\n\n| Permission Flag                   | Risk Level | Description                 | Security Notes                |\n| --------------------------------- | ---------- | --------------------------- | ----------------------------- |\n| `beforeInitialize`                | LOW        | Called before pool creation | Validate pool parameters      |\n| `afterInitialize`                 | LOW        | Called after pool creation  | Safe for state initialization |\n| `beforeAddLiquidity`              | MEDIUM     | Before LP deposits          | Can block legitimate LPs      |\n| `afterAddLiquidity`               | LOW        | After LP deposits           | Safe for tracking\u002Frewards     |\n| `beforeRemoveLiquidity`           | HIGH       | Before LP withdrawals       | Can trap user funds           |\n| `afterRemoveLiquidity`            | LOW        | After LP withdrawals        | Safe for tracking             |\n| `beforeSwap`                      | HIGH       | Before swap execution       | Can manipulate prices         |\n| `afterSwap`                       | MEDIUM     | After swap execution        | Can observe final state       |\n| `beforeDonate`                    | LOW        | Before donations            | Access control only           |\n| `afterDonate`                     | LOW        | After donations             | Safe for tracking             |\n| `beforeSwapReturnDelta`           | CRITICAL   | Returns custom swap amounts | **NoOp attack vector**        |\n| `afterSwapReturnDelta`            | HIGH       | Modifies post-swap amounts  | Can extract value             |\n| `afterAddLiquidityReturnDelta`    | HIGH       | Modifies LP token amounts   | Can shortchange LPs           |\n| `afterRemoveLiquidityReturnDelta` | HIGH       | Modifies withdrawal amounts | Can steal funds               |\n\n### Risk Thresholds\n\n- **LOW**: Unlikely to cause fund loss\n- **MEDIUM**: Requires careful implementation\n- **HIGH**: Can cause fund loss if misimplemented\n- **CRITICAL**: Can enable complete fund theft\n\n## CRITICAL: NoOp Rug Pull Attack\n\nThe `BEFORE_SWAP_RETURNS_DELTA` permission (bit 3) is the most dangerous hook permission. A malicious hook can:\n\n1. Return a delta claiming it handled the entire swap\n2. PoolManager accepts this and settles the trade\n3. Hook keeps all input tokens without providing output\n4. User loses entire swap amount\n\n### Attack Pattern\n\n```solidity\n\u002F\u002F MALICIOUS - DO NOT USE\nfunction beforeSwap(\n    address,\n    PoolKey calldata,\n    IPoolManager.SwapParams calldata params,\n    bytes calldata\n) external override returns (bytes4, BeforeSwapDelta, uint24) {\n    \u002F\u002F Claim to handle the swap but steal tokens\n    int128 amountSpecified = int128(params.amountSpecified);\n    BeforeSwapDelta delta = toBeforeSwapDelta(amountSpecified, 0);\n    return (BaseHook.beforeSwap.selector, delta, 0);\n}\n```\n\n### Detection\n\nBefore interacting with ANY hook that has `beforeSwapReturnDelta: true`:\n\n1. **Audit the hook code** - Verify legitimate use case\n2. **Check ownership** - Is it upgradeable? By whom?\n3. **Verify track record** - Has it been audited by reputable firms?\n4. **Start small** - Test with minimal amounts first\n\n### Legitimate Uses\n\nNoOp patterns are valid for:\n\n- Just-in-time liquidity (JIT)\n- Custom AMM curves\n- Intent-based trading systems\n- RFQ\u002FPMM integrations\n\nBut each requires careful implementation and audit.\n\n## Delta Accounting Fundamentals\n\nv4 uses a credit\u002Fdebit system through the PoolManager:\n\n### Core Invariant\n\n```text\nFor every transaction: sum(deltas) == 0\n```\n\nThe PoolManager tracks what each address owes or is owed. At transaction end, all debts must be settled.\n\n### Key Functions\n\n| Function                     | Purpose                             | Direction              |\n| ---------------------------- | ----------------------------------- | ---------------------- |\n| `take(currency, to, amount)` | Withdraw tokens from PoolManager    | You receive tokens     |\n| `settle(currency)`           | Pay tokens to PoolManager           | You send tokens        |\n| `sync(currency)`             | Update PoolManager balance tracking | Preparation for settle |\n\n### Settlement Pattern\n\n```solidity\n\u002F\u002F Correct pattern: sync before settle\npoolManager.sync(currency);\ncurrency.transfer(address(poolManager), amount);\npoolManager.settle(currency);\n```\n\n### Common Mistakes\n\n1. **Forgetting sync**: Settlement fails without sync\n2. **Wrong order**: Must sync → transfer → settle\n3. **Partial settlement**: Leaves transaction in invalid state\n4. **Double settlement**: Causes accounting errors\n\n## Access Control Patterns\n\n### PoolManager Verification\n\nEvery hook callback MUST verify the caller:\n\n```solidity\nmodifier onlyPoolManager() {\n    require(msg.sender == address(poolManager), \"Not PoolManager\");\n    _;\n}\n\nfunction beforeSwap(\n    address sender,\n    PoolKey calldata key,\n    IPoolManager.SwapParams calldata params,\n    bytes calldata hookData\n) external override onlyPoolManager returns (bytes4, BeforeSwapDelta, uint24) {\n    \u002F\u002F Safe to proceed\n}\n```\n\n### Why This Matters\n\nWithout this check:\n\n- Anyone can call hook functions directly\n- Attackers can manipulate hook state\n- Funds can be drained through fake callbacks\n\n## Router Verification Patterns\n\nThe `sender` parameter is the router, not the end user. For hooks that need user identity:\n\n### Allowlisting Pattern\n\n```solidity\nmapping(address => bool) public allowedRouters;\n\nfunction beforeSwap(\n    address sender,  \u002F\u002F This is the router\n    PoolKey calldata key,\n    IPoolManager.SwapParams calldata params,\n    bytes calldata hookData\n) external override onlyPoolManager returns (bytes4, BeforeSwapDelta, uint24) {\n    require(allowedRouters[sender], \"Router not allowed\");\n    \u002F\u002F Proceed with swap\n}\n```\n\n### User Identity via hookData\n\n```solidity\nfunction beforeSwap(\n    address sender,\n    PoolKey calldata key,\n    IPoolManager.SwapParams calldata params,\n    bytes calldata hookData\n) external override onlyPoolManager returns (bytes4, BeforeSwapDelta, uint24) {\n    \u002F\u002F Decode user address from hookData (router must include it)\n    address user = abi.decode(hookData, (address));\n    \u002F\u002F CAUTION: Router must be trusted to provide accurate user\n}\n```\n\n### msg.sender Trap\n\n```solidity\n\u002F\u002F WRONG - msg.sender is always PoolManager in hooks\nfunction beforeSwap(...) external {\n    require(msg.sender == someUser); \u002F\u002F Always fails or wrong\n}\n\n\u002F\u002F CORRECT - Use sender parameter\nfunction beforeSwap(address sender, ...) external {\n    require(allowedRouters[sender], \"Invalid router\");\n}\n```\n\n## Token Handling Hazards\n\nNot all tokens behave like standard ERC-20s:\n\n| Token Type          | Hazard                               | Mitigation                          |\n| ------------------- | ------------------------------------ | ----------------------------------- |\n| **Fee-on-transfer** | Received amount \u003C sent amount        | Measure actual balance changes      |\n| **Rebasing**        | Balance changes without transfers    | Avoid storing raw balances          |\n| **ERC-777**         | Transfer callbacks enable reentrancy | Use reentrancy guards               |\n| **Pausable**        | Transfers can be blocked             | Handle transfer failures gracefully |\n| **Blocklist**       | Specific addresses blocked           | Test with production addresses      |\n| **Low decimals**    | Precision loss in calculations       | Use appropriate scaling             |\n\n### Safe Balance Check Pattern\n\n```solidity\nfunction safeTransferIn(\n    IERC20 token,\n    address from,\n    uint256 amount\n) internal returns (uint256 received) {\n    uint256 balanceBefore = token.balanceOf(address(this));\n    token.safeTransferFrom(from, address(this), amount);\n    received = token.balanceOf(address(this)) - balanceBefore;\n}\n```\n\n## Base Hook Template\n\nStart with all permissions disabled. Enable only what you need:\n\n```solidity\n\u002F\u002F SPDX-License-Identifier: MIT\npragma solidity ^0.8.24;\n\nimport {BaseHook} from \"v4-periphery\u002Fsrc\u002Fbase\u002Fhooks\u002FBaseHook.sol\";\nimport {Hooks} from \"v4-core\u002Fsrc\u002Flibraries\u002FHooks.sol\";\nimport {IPoolManager} from \"v4-core\u002Fsrc\u002Finterfaces\u002FIPoolManager.sol\";\nimport {PoolKey} from \"v4-core\u002Fsrc\u002Ftypes\u002FPoolKey.sol\";\nimport {BeforeSwapDelta, BeforeSwapDeltaLibrary} from \"v4-core\u002Fsrc\u002Ftypes\u002FBeforeSwapDelta.sol\";\n\ncontract SecureHook is BaseHook {\n    constructor(IPoolManager _poolManager) BaseHook(_poolManager) {}\n\n    function getHookPermissions() public pure override returns (Hooks.Permissions memory) {\n        return Hooks.Permissions({\n            beforeInitialize: false,\n            afterInitialize: false,\n            beforeAddLiquidity: false,\n            afterAddLiquidity: false,\n            beforeRemoveLiquidity: false,\n            afterRemoveLiquidity: false,\n            beforeSwap: false,           \u002F\u002F Enable only if needed\n            afterSwap: false,            \u002F\u002F Enable only if needed\n            beforeDonate: false,\n            afterDonate: false,\n            beforeSwapReturnDelta: false,      \u002F\u002F DANGER: NoOp attack vector\n            afterSwapReturnDelta: false,       \u002F\u002F DANGER: Can extract value\n            afterAddLiquidityReturnDelta: false,\n            afterRemoveLiquidityReturnDelta: false\n        });\n    }\n\n    \u002F\u002F Implement only the callbacks you enabled above\n}\n```\n\nSee [references\u002Fbase-hook-template.md](references\u002Fbase-hook-template.md) for a complete implementation template.\n\n## Security Checklist\n\nBefore deploying any hook:\n\n| #   | Check                                                 | Status |\n| --- | ----------------------------------------------------- | ------ |\n| 1   | All hook callbacks verify `msg.sender == poolManager` | [ ]    |\n| 2   | Router allowlisting implemented if needed             | [ ]    |\n| 3   | No unbounded loops that can cause OOG                 | [ ]    |\n| 4   | Reentrancy guards on external calls                   | [ ]    |\n| 5   | Delta accounting sums to zero                         | [ ]    |\n| 6   | Fee-on-transfer tokens handled                        | [ ]    |\n| 7   | No hardcoded addresses                                | [ ]    |\n| 8   | Slippage parameters respected                         | [ ]    |\n| 9   | No sensitive data stored on-chain                     | [ ]    |\n| 10  | Upgrade mechanisms secured (if applicable)            | [ ]    |\n| 11  | `beforeSwapReturnDelta` justified if enabled          | [ ]    |\n| 12  | Fuzz testing completed                                | [ ]    |\n| 13  | Invariant testing completed                           | [ ]    |\n\n## Gas Budget Guidelines\n\nHook callbacks execute inside the PoolManager's transaction context. Excessive gas consumption can make swaps revert or become economically unviable.\n\n### Gas Budgets by Callback\n\n| Callback                      | Target Budget | Hard Ceiling | Notes                         |\n| ----------------------------- | ------------- | ------------ | ----------------------------- |\n| `beforeSwap`                  | \u003C 50,000 gas  | 150,000 gas  | Runs on every swap; keep lean |\n| `afterSwap`                   | \u003C 30,000 gas  | 100,000 gas  | Analytics\u002Ftracking only       |\n| `beforeAddLiquidity`          | \u003C 50,000 gas  | 200,000 gas  | May include access control    |\n| `afterAddLiquidity`           | \u003C 30,000 gas  | 100,000 gas  | Reward tracking               |\n| `beforeRemoveLiquidity`       | \u003C 50,000 gas  | 200,000 gas  | Lock validation               |\n| `afterRemoveLiquidity`        | \u003C 30,000 gas  | 100,000 gas  | Tracking\u002Faccounting           |\n| Callbacks with external calls | \u003C 100,000 gas | 300,000 gas  | External DEX routing, oracles |\n\n### Common Gas Pitfalls\n\n1. **Unbounded loops**: Iterating over dynamic arrays (e.g., all active positions) can exceed block gas limits. Cap array sizes or use pagination.\n2. **SSTORE in hot paths**: Each new storage slot costs ~20,000 gas. Prefer transient storage (`tstore`\u002F`tload`) for data that doesn't persist beyond the transaction. Requires Solidity >= 0.8.24 with EVM target set to `cancun` or later.\n3. **External calls**: Each cross-contract call adds ~2,600 gas base cost plus the callee's execution. Batch calls where possible.\n4. **String operations**: Avoid `string` manipulation in callbacks; use `bytes32` for identifiers.\n5. **Redundant reads**: Cache `poolManager` calls — repeated `getSlot0()` or `getLiquidity()` reads cost gas each time.\n\n### Measuring Gas\n\n```bash\n# Profile a specific hook callback with Foundry\nforge test --match-test test_beforeSwapGas --gas-report\n\n# Snapshot gas usage across all tests\nforge snapshot --match-contract MyHookTest\n```\n\n---\n\n## Risk Scoring System\n\nCalculate your hook's risk score (0-33):\n\n| Category              | Points | Criteria                                 |\n| --------------------- | ------ | ---------------------------------------- |\n| **Permissions**       | 0-14   | Sum of enabled permission risk levels    |\n| **External Calls**    | 0-5    | Number and type of external interactions |\n| **State Complexity**  | 0-5    | Amount of mutable state                  |\n| **Upgrade Mechanism** | 0-5    | Proxy, admin functions, etc.             |\n| **Token Handling**    | 0-4    | Non-standard token support               |\n\n### Audit Tier Recommendations\n\n| Score | Risk Level | Recommendation                 |\n| ----- | ---------- | ------------------------------ |\n| 0-5   | Low        | Self-audit + peer review       |\n| 6-12  | Medium     | Professional audit recommended |\n| 13-20 | High       | Professional audit required    |\n| 21-33 | Critical   | Multiple audits required       |\n\n## Absolute Prohibitions\n\n**Never do these things in a hook:**\n\n1. **Never trust `msg.sender` for user identity** - It's always PoolManager\n2. **Never enable `beforeSwapReturnDelta` without understanding NoOp attacks**\n3. **Never store passwords, keys, or PII on-chain**\n4. **Never use `transfer()` for ETH** - Use `call{value:}(\"\")`\n5. **Never assume token decimals** - Always query the token\n6. **Never use `block.timestamp` for randomness**\n7. **Never hardcode gas limits in calls**\n8. **Never ignore return values from external calls**\n9. **Never use `tx.origin` for authorization** - It's a phishing vector; malicious contracts can relay calls with the original user's `tx.origin`\n\n## Pre-Deployment Audit Checklist\n\n| #   | Item                                      | Required For             |\n| --- | ----------------------------------------- | ------------------------ |\n| 1   | Code review by security-focused developer | All hooks                |\n| 2   | Unit tests for all callbacks              | All hooks                |\n| 3   | Fuzz testing with Foundry                 | All hooks                |\n| 4   | Invariant testing                         | Hooks with delta returns |\n| 5   | Fork testing on mainnet                   | All hooks                |\n| 6   | Gas profiling                             | All hooks                |\n| 7   | Formal verification                       | Critical hooks           |\n| 8   | Slither\u002FMythril analysis                  | All hooks                |\n| 9   | External audit                            | Medium+ risk hooks       |\n| 10  | Bug bounty program                        | High+ risk hooks         |\n| 11  | Monitoring\u002Falerting setup                 | All production hooks     |\n\nSee [references\u002Faudit-checklist.md](references\u002Faudit-checklist.md) for detailed audit requirements.\n\n## Production Hook References\n\nLearn from audited, production hooks:\n\n| Project        | Description           | Notable Security Features     |\n| -------------- | --------------------- | ----------------------------- |\n| **Flaunch**    | Token launch platform | Multi-sig admin, timelocks    |\n| **EulerSwap**  | Lending integration   | Isolated risk per market      |\n| **Zaha TWAMM** | Time-weighted AMM     | Gradual execution reduces MEV |\n| **Bunni**      | LP management         | Concentrated liquidity guards |\n\n## External Resources\n\n### Official Documentation\n\n- [v4-core Repository](https:\u002F\u002Fgithub.com\u002FUniswap\u002Fv4-core)\n- [v4-periphery Repository](https:\u002F\u002Fgithub.com\u002FUniswap\u002Fv4-periphery)\n- [Uniswap v4 Docs](https:\u002F\u002Fdocs.uniswap.org\u002Fcontracts\u002Fv4\u002Foverview)\n- [Hook Permissions Guide](https:\u002F\u002Fdocs.uniswap.org\u002Fcontracts\u002Fv4\u002Fconcepts\u002Fhooks)\n\n### Security Resources\n\n- [Trail of Bits Audits](https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fpublications)\n- [Certora v4 Analysis](https:\u002F\u002Fwww.certora.com\u002F)\n- [ABDK Consulting](https:\u002F\u002Fabdk.consulting\u002F)\n\n### Community\n\n- [v4-hooks-skill by @igoryuzo](https:\u002F\u002Fgithub.com\u002Figoryuzo\u002FuniswapV4-hooks-skill) - Community skill that inspired this guide\n- [v4hooks.dev](https:\u002F\u002Fwww.v4hooks.dev) - Community hook resources\n\n---\n\n## Additional References\n\n- [Base Hook Template](references\u002Fbase-hook-template.md) - Complete implementation starter\n- [Vulnerabilities Catalog](references\u002Fvulnerabilities-catalog.md) - Common patterns and mitigations\n- [Audit Checklist](references\u002Faudit-checklist.md) - Detailed pre-deployment checklist\n",{"name":5,"model":31,"license":15,"metadata":52,"description":7,"allowed-tools":54},{"author":34,"version":53},"1.1.0","Read, Glob, Grep, WebFetch, Task(subagent_type:Explore)","main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fdefi\u002Funiswap-official-v4-hooks",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-13 02:31:19",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill v4-security-foundations",{"tool":70,"command":71},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill v4-security-foundations",{"tool":73,"command":74},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill v4-security-foundations","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdefi\u002Funiswap-official-v4-hooks\u002FSKILL.md",true,[78,82,88,92,96,100],{"path":79,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":16},"LICENSE","许可证",1069,{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Faudit-checklist.md","REFERENCE","参考文档",8597,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdefi\u002Funiswap-official-v4-hooks\u002Freferences\u002Faudit-checklist.md",{"path":89,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fbase-hook-template.md",12244,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdefi\u002Funiswap-official-v4-hooks\u002Freferences\u002Fbase-hook-template.md",{"path":93,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fvulnerabilities-catalog.md",10825,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdefi\u002Funiswap-official-v4-hooks\u002Freferences\u002Fvulnerabilities-catalog.md",{"path":97,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":98,"sourceHtmlUrl":99},"SOURCE.md",160,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdefi\u002Funiswap-official-v4-hooks\u002FSOURCE.md",{"path":101,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":102,"sourceHtmlUrl":103},"TRUST.auto.yaml",2191,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fdefi\u002Funiswap-official-v4-hooks\u002FTRUST.auto.yaml",[105,133,156,174,187,197],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":109,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":47},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":137,"licenseFileUrl":138,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":47},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[142,143,144,145,146,147,148,149,150,151,152,153,154,155],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":137,"licenseFileUrl":160,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":47},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[164,143,165,166,167,168,169,153,152,151,170,171,172,147,173,146,145],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":137,"licenseFileUrl":178,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":47},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[182,183,144,184,185,154,152,186,150,149,147,146],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":188,"name":189,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":190,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":47},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[194,195,196],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":198,"name":199,"nameZh":6,"description":200,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":201,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":47},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[205,206,207,208,209,210,211,37,212,213,214],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]