Security
Known limitations
What Rule Craft does not protect against.
- The Rule Craft contracts are unaudited. They are tested (unit, fuzz and a mainnet-fork test), which is not the same thing.
- No score on this site is an audit.
- The risk score reads permissions and parameters. It cannot find bugs in code.
- The scanner only sees what an address encodes. A hook with few permissions can still be badly written.
- Rule Craft pools accept exact-input swaps only. Routers that try exact-output will revert (ExactInputOnly).
- Quoters that ignore hooks over-promise output on pools with burns or streams. Uniswap's v4 Quoter runs the hook and quotes correctly.
- Snipe Guard counts what buyers receive per block, not who they are. A determined buyer can spread across blocks; the cap only slows the first blocks.
- If no liquidity is in range at the moment of a buy, the guard tax and stream are simply not charged on that buy.
- Milestone Pot and Arb Recapture are planned and not part of the on-chain v1.
The contracts are live on Robinhood Chain since 2026-10-02. Tested (unit, fuzz, mainnet fork) but not audited.