Scan a repository

The app takes a hook address or a GitHub repository. An address is read and measured on chain. A repository is read from its source: what the code says it will do.

What it reads

Paste github.com/owner/repo, a /tree/<branch>/<folder> link, or just owner/repo. The repository is downloaded as one archive from GitHub, public repositories only. Solidity under lib/, node_modules/, tests, mocks and scripts is left out.

A contract counts as a hook when it, or one of its bases in the repository, declares getHookPermissions, implements the hook callbacks, or extends BaseHook, IHooks or one of OpenZeppelin's uniswap-hooks bases. Each hook gets:

• The permissions it declares, read from the Hooks.Permissions({...}) literal. A deployment of that hook has to sit at an address whose last fourteen bits match.
• The eight checks, from source. 01 from the declared permissions, with beforeRemoveLiquidity only counted when its body can revert. 02 notes whether the swap callbacks return non-zero deltas or call take. 03 whether a withdrawal can be refused or charged. 04 whether the hook sets or overrides the fee. 05 the owner-gated functions. 06 upgradeability, delegatecall, selfdestruct. 07 whether the callbacks are guarded by onlyPoolManager. 08 is read on chain only.
• Lines worth reading, each linked to the line on GitHub at the commit that was read.

Source is not the deployment

Nothing obliges a team to deploy the code in its repository. What a hook takes from a swap and whether LPs get out are measured on the deployed hook, so in a repository scan checks 02 and 03 say what the code allows, not what it does.

If the repository keeps Foundry's deployment records (broadcast/<script>/<chain>/run-latest.json), every hook deployed on Robinhood Chain is listed with a button to measure it live. That is the strongest reading: the source tells you what to look for, the address tells you what happens.

From code

GET /api/repo?u=github.com/owner/repo

returns the same result as JSON: the repository, the commit, and for each hook its permissions, checks, score, verdict, findings and recorded deployments.