Approved workflow

Release Points (token symbol PNTS) on Sepolia as a univ4_hook launch. Token: Points (PNTS), total supply 1,000,000,000 PNTS with 18 decimals, minted once to the deployer (a separate zero-argument ERC-20, no mint, owner or admin). Hook: SwapPointsHook, a Uniswap v4 hook on the token's native-ETH pool that awards non-transferable points. afterInitialize stores startTime[poolId] = block.timestamp. afterSwap credits the hookData address (identity rule below). Points use 18 decimals so nothing rounds away: a buy earns ethPaid x 10,000 point-units per wei of ETH (10 points per 0.001 ETH), a sell earns ethReceived x 5,000 (5 points per 0.001 ETH), with ETH amounts as settled; both double while block.timestamp < startTime + 7 days. Points are a mapping with no transfer, approve or burn function. Each pool keeps an on-chain top 10 updated in O(10), ties keeping the earlier address ahead. Events: Points(poolId, user, earned, total). Views: pointsOf(poolId, user), top10(poolId), multiplierEndsAt(poolId). No fee, no funds, no admin. README: points have no value and can be farmed by round trips at the cost of LP fees. Identity: the credited address is abi.decode(hookData, (address)) when hookData is exactly 32 bytes and non-zero; otherwise the swap credits nobody. hookData is not authenticated: anyone can credit any address; say so in NatSpec and the README. Deploy shape, matching the live Sepolia hook launches 170 and 186 (168 passed the mainnet PoolManager and is not a model): SwapPointsHook's only constructor argument is the Sepolia PoolManager 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543; every rate, window and threshold here is a source constant; there is no owner, admin, setter, pause, upgrade or sweep, and no $owner or $token argument. Permissions are exactly afterInitialize, afterSwap (low address bits 0x1040), all others false; the constructor calls Hooks.validateHookPermissions and the CREATE2 salt is mined for those bits. The factory initializes the pool (currency0 native ETH, currency1 PNTS, fee 3000, tickSpacing 60) and seeds one-sided PNTS liquidity, so nothing in the hook may revert that initialize or that liquidity add (launch 138 was parked when a beforeInitialize gate reverted the factory), and the first buy lands in a pool that holds no ETH. All state is keyed by PoolId; a pool on this hook whose currency0 is not native ETH gets zero deltas and no other effect. Every callback requires msg.sender == PoolManager. Tests (Foundry, a real v4-core PoolManager deployed in the test, hook at a mined address): a launch rehearsal that initializes at the manifest price, seeds one-sided PNTS liquidity like the factory and makes the first buy into the ETH-less pool; exact-in and exact-out in both directions; dust amounts; a pool whose currency0 is not ETH; direct callback calls from a non-PoolManager address revert; fuzzed sizes; and specifically: buy and sell rates on exact-in and exact-out; the 2x boundary at startTime + 7 days minus 1 second and exactly; top-10 insertion, update, ties and eviction; no hookData earns nothing. An independent adversarial review (read-only) must attack: points arithmetic and units, the multiplier boundary, top-10 correctness and gas, and hookData spoofing or wash farming (document it; points are worthless). It reports each finding with the exact call sequence that triggers it. Website: one static page (dist/index.html) that reads the hook's views and events and the pool price through Uniswap's Sepolia StateView, with a buy/sell form that swaps through Uniswap's published Sepolia PoolSwapTest router (check it has code) and puts the connected wallet in hookData. It shows the points leaderboard, the connected wallet's points, and the time left on the 2x multiplier. Points is a Sepolia test toy: its token and any pot have no value, and nothing here promises a return.

Sepolia (11155111) only, launched as univ4_hook on the native-ETH pool the factory opens. GitHub publication and IPFS hosting are approved. Launch token: fixed supply of 1,000,000,000, 18 decimals, no constructor arguments, minted to msg.sender, no mint or admin. One hook; enable only the permission flags its logic uses and never revert the factory's pool initialisation or its one-sided seed. Like every hook launch that has gone live, the hook constructor takes exactly one argument, the Sepolia PoolManager 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543; rates, recipients and the token are source constants or learned from the pool key, and there is no owner. Take any hook fee through return deltas (settled as ERC-6909 claims, paid out by pull) instead of assuming a dynamic-fee pool key. Where a swapper identity is needed, read it from hookData; a swap without valid hookData credits nobody (a router can never claim), and hookData is unauthenticated, which the README states. No external oracles or VRF, no proxies, delegatecall or selfdestruct. foundry.toml sets bytecode_hash = "none". Any website is a static export with index.html in dist/. Site label lab-points-hook.

Build PNTS and SwapPointsHook (permissions afterInitialize, afterSwap; PoolManager-only constructor) with a launch-rehearsal Foundry suite and an independent adversarial review, deploy them through the factory on Sepolia, then build the one-page site against the live pool.

Website: one static page (dist/index.html) that reads the hook's views and events and the pool price through Uniswap's Sepolia StateView, with a buy/sell form that swaps through Uniswap's published Sepolia PoolSwapTest router (check it has code) and puts the connected wallet in hookData. It shows the points leaderboard, the connected wallet's points, and the time left on the 2x multiplier.