Approved workflow

Release Swap Tip (token symbol STIP) on Sepolia as a univ4_hook launch. Token: Swap Tip (STIP), total supply 1,000,000,000 STIP with 18 decimals, minted once to the deployer (a separate zero-argument ERC-20, no mint, owner or admin). Hook: SwapTipHook, a Uniswap v4 hook on the token's native-ETH pool that lets a swapper add an optional tip. hookData = abi.encode(uint16 tipBps, address recipient), exactly 64 bytes, decoded as two uint256 words so malformed data cannot cause a decode revert: tipBps = word 0, recipient = address(word 1) only when word 1 < 2^160. With tipBps 1-500 and a recipient that is non-zero, not the hook and not the PoolManager, the swap pays a tip of tipBps of its ETH leg with the ETH-leg mechanics below, credited to the recipient's claimable ETH; tipBps above 500 reverts with TipTooHigh; tipBps 0, an invalid recipient a word 1 of 2^160 or more, or any other hookData length means no tip and no fee. (The earlier deploy-time public-goods address is replaced by a per-swap recipient: no live hook launch has taken a second constructor argument.) The tipper shown on the board is tx.origin, used for display only. claim() pays msg.sender its balance, zeroed first, through the hook's unlockCallback. Events: Tipped(poolId, tipper, recipient, bps, amount), Claimed. Views: balanceOf(recipient), totalTipped(poolId), tippedBy(tipper), receivedBy(recipient). ETH-leg fee mechanics (the pattern live launch 170's MedallionHook uses): a buy is zeroForOne (ETH in), a sell is oneForZero (ETH out), and the swapper's specified amount is always honoured exactly. When ETH is the specified currency (exact-in buys, exact-out sells) the fee is taken in beforeSwap as a positive specified BeforeSwapDelta of floor(|amountSpecified| x bps / 10,000); when ETH is the unspecified currency (exact-out buys, exact-in sells) it is taken in afterSwap as a positive unspecified delta of floor(ETH the pool moved x bps / 10,000). A partial fill (price limit hit) reverts with PartialFill. The hook settles each fee by minting itself ERC-6909 claims on ETH (poolManager.mint) inside the swap, never take() or an ETH transfer in a callback, so the first buy into the ETH-less pool works; every payout later burns claims and takes ETH inside the hook's own unlockCallback, with the balance zeroed before the take (CEI). A fee that rounds to 0 is 0: dust swaps never revert. Wherever this request says ETH leg, it means that fee base. Invariant: the hook's ETH claim balance at the PoolManager equals the sum of everything it still owes. Deploy shape, matching the live Sepolia hook launches 170 and 186 (168 passed the mainnet PoolManager and is not a model): SwapTipHook's only constructor argument is the Sepolia PoolManager 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543; every rate, window and threshold here is a source constant; there is no owner, admin, setter, pause, upgrade or sweep, and no $owner or $token argument. Permissions are exactly beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta (low address bits 0x00CC), all others false; the constructor calls Hooks.validateHookPermissions and the CREATE2 salt is mined for those bits. The factory initializes the pool (currency0 native ETH, currency1 STIP, fee 3000, tickSpacing 60) and seeds one-sided STIP liquidity, so nothing in the hook may revert that initialize or that liquidity add (launch 138 was parked when a beforeInitialize gate reverted the factory), and the first buy lands in a pool that holds no ETH. All state is keyed by PoolId; a pool on this hook whose currency0 is not native ETH gets zero deltas and no other effect. Every callback requires msg.sender == PoolManager. Tests (Foundry, a real v4-core PoolManager deployed in the test, hook at a mined address): a launch rehearsal that initializes at the manifest price, seeds one-sided STIP liquidity like the factory and makes the first buy into the ETH-less pool; exact-in and exact-out in both directions; dust amounts; a pool whose currency0 is not ETH; direct callback calls from a non-PoolManager address revert; fuzzed sizes; and specifically: tips of 1 and 500 bps on all four swap modes; 501 reverts; 0 bps, zero, hook or PoolManager recipients and malformed hookData charge nothing; claim pays once; the sum of balances equals the hook's ETH claims (fuzzed). An independent adversarial review (read-only) must attack: hookData decoding (lengths, oversized words), the 500 bps bound, fee sign and rounding, claim reentrancy, and whether a malformed tip can make a swap revert unexpectedly. It reports each finding with the exact call sequence that triggers it. Website: one static page (dist/index.html) that reads the hook's views and events and the pool price through Uniswap's Sepolia StateView, with a buy/sell form that swaps through Uniswap's published Sepolia PoolSwapTest router (check it has code). It shows total tips, top tippers and top recipients (aggregated from Tipped events), a swap form with a tip slider (0-5%) and a recipient field, and a claim button.

Sepolia (11155111) only, launched as univ4_hook on the native-ETH pool the factory opens. GitHub publication and IPFS hosting are approved. Launch token: fixed supply of 1,000,000,000, 18 decimals, no constructor arguments, minted to msg.sender, no mint or admin. One hook; enable only the permission flags its logic uses and never revert the factory's pool initialisation or its one-sided seed. Like every hook launch that has gone live, the hook constructor takes exactly one argument, the Sepolia PoolManager 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543; rates, recipients and the token are source constants or learned from the pool key, and there is no owner. Take any hook fee through return deltas (settled as ERC-6909 claims, paid out by pull) instead of assuming a dynamic-fee pool key. Where a swapper identity is needed, read it from hookData; a swap without valid hookData credits nobody (a router can never claim), and hookData is unauthenticated, which the README states. No external oracles or VRF, no proxies, delegatecall or selfdestruct. foundry.toml sets bytecode_hash = "none". Any website is a static export with index.html in dist/. Site label lab-tip-jar-hook.

Build STIP and SwapTipHook (permissions beforeSwap, afterSwap, beforeSwapReturnDelta, afterSwapReturnDelta; PoolManager-only constructor) with a launch-rehearsal Foundry suite and an independent adversarial review, deploy them through the factory on Sepolia, then build the one-page site against the live pool.

Website: one static page (dist/index.html) that reads the hook's views and events and the pool price through Uniswap's Sepolia StateView, with a buy/sell form that swaps through Uniswap's published Sepolia PoolSwapTest router (check it has code). It shows total tips, top tippers and top recipients (aggregated from Tipped events), a swap form with a tip slider (0-5%) and a recipient field, and a claim button.