Limits

censoredHooks reads a hook from the outside, at one block, with one small trade. That is enough to catch a lot, and not enough to promise anything. This page lists what a clean report does not cover.

A scan is a measurement, not a promise

Every number on a report was true at the block written on it. Nothing in a scan binds the hook to behave the same way at the next block.

• A hook with an owner can change. Check 05 names the owner and the functions that look like an owner's. A tax can be raised, a fee recipient changed, a pause switched on, after the scan.
• A dynamic fee can change. On a dynamic-fee pool the fee read today is the fee the hook chose today. Check 04 judges where it stands and says it can move.
• A proxy can change everything. Check 06 fails a proxy for this reason.

If a hook has an owner or a dynamic fee, scan it again just before a large trade. Opening its page does that.

A hook can treat your trade differently from the probe's

The probe swaps a small amount, from a fresh address that has never touched the pool, with empty hookData, through its own unlock rather than a router. Hooks can and do branch on all of these.

• Sender. A hook can whitelist routers, exempt some addresses, or tax addresses that sold recently.
• Amount. A hook can tax large swaps more, or cap swap size. A small probe swap will not see a rule that starts above its size.
• Time. Many launch hooks have taxes that decay with time since launch. A scan taken early shows the early tax; a scan taken later shows the later one. Neither shows the curve.
• hookData. Routers can pass extra data to the hook. The probe passes none.
• State. A hook that counts swaps, tracks a price or keeps a cooldown may be in a different state when you trade.

The probe measures a real trade. It is not your trade.

Only some pools are measured

A hook can serve hundreds of pools. A scan measures up to two of its most recent pools that have a price. Another pool with the same hook can have a different fee, a different tick spacing, different liquidity, or a hook configuration specific to that pool. If the pool you are about to use is not among the measured ones, the measurement is from a sibling pool.

Pools whose current price has no liquidity, or too little to measure, are marked too thin. So is a direction in which a swap goes through but consumes nothing, because the liquidity ends at the current price on that side (common on launch pools nobody has traded yet). Thin swaps are not measured, and they say nothing about the hook either way.

Fees are read where they stand

Check 04 judges the pool fee at the scan's block: the fee in the pool key, or, for a dynamic-fee pool, the fee the hook has stored in the pool at that moment, taking the highest among the measured pools. A fee the hook returns for a single swap is not stored; it shows up as take in 02 instead. A dynamic fee that is low today and raised tomorrow was judged on today's level, which is why any dynamic fee is at least a caution.

Bytecode reading is heuristic

The scan reads the bytecode; it does not decompile it.

• Function selectors are found by looking for the comparisons a standard Solidity dispatcher makes. A non-standard dispatcher, hand-written assembly or another compiler can hide selectors from it, and some functions may be missing from the list.
• Names come from a public signature database (openchain.xyz). A selector can have no name, or a name that collides with an unrelated function that happens to share the same four bytes. A name is a hint, not a fact.
• Owner-style functions are matched by name. A setter with an innocent name will not be flagged. One with an alarming name may be harmless.
• DELEGATECALL and SELFDESTRUCT are reported when the opcode appears in the code, not when it is reachable.
• owner() is the only ownership function called. Access control through roles, a hard-coded admin address or a separate controller contract is not recognised as an owner, though its functions may still appear in the list.

What a scan does not do

• It is not an audit. No one reads the hook's logic line by line. A scan does not prove the absence of bugs, reentrancy issues or economic exploits.
• It does not read verified source. Whether a hook has published and verified its source on the explorer is not part of the scan or the score. If the source is published, read it too.
• It does not judge the token. The token traded in the pool can have its own tax, blacklist or mint, independent of the hook. A clean hook does not make a clean token.
• It does not judge the people. Who deployed the hook, what they have deployed before, and what they intend are outside the scan.
• It does not cover other chains. Only Robinhood Chain is scanned today.

How to use a report, given all this

Treat a danger verdict as a reason not to trade or deposit until you understand the failing check. Treat a safe verdict as "safe by construction, as far as the scan can see, at this block": nothing that may take, no hand on a switch, a fixed fee, fixed code. It is not a guarantee about logic the scan cannot read. Read the sentences under 04 and 05 to know how much of what you see can change. For anything large, scan again right before.