Approved workflow

Release Nosandwich (token symbol NOSAND) on Sepolia as a univ4_hook launch. Token: Nosandwich (NOSAND), total supply 1,000,000,000 NOSAND with 18 decimals, minted once to the deployer (a separate zero-argument ERC-20, no mint, owner or admin). Hook: AntiSandwichHook, a Uniswap v4 hook on the token's native-ETH pool built on OpenZeppelin uniswap-hooks' AntiSandwichHook (v1.2, on BaseDynamicAfterFee), vendored as source (Solidity 0.8.26, foundry.toml evm_version = "cancun" for its transient storage). In this pool currency0 is ETH, so, as that design documents, sells (oneForZero, token to ETH) never fill at a better price than the pool's start-of-block state: the first swap of each block checkpoints slot0, liquidity and the ticks between the last and current tick; later sells in that block are simulated against the checkpoint, and any output beyond the simulated amount (exact-in) or input short of it (exact-out) is taken as a positive afterSwap unspecified delta and minted to the hook as ERC-6909 claims. Two required deviations from OpenZeppelin's _beforeSwap, recorded in the README: on a pool's first swap the checkpoint is empty, so OpenZeppelin would take lastTick = 0 and walk every tickSpacing step from tick 0 to the opening tick (about 2,300-3,000 getTickInfo reads and stores at the factory's launch price, tens of millions of gas, beyond Sepolia's per-transaction gas cap), and no swap could ever succeed; the hook therefore treats an empty checkpoint (blockNumber 0) as lastTick = the current tick, and caps the loop at the 100 tickSpacing steps nearest the current tick. Buys (zeroForOne) follow the normal curve. _afterSwapHandler donates the collected amount to in-range LPs in the same afterSwap, like OpenZeppelin's mock; when in-range liquidity after the swap is zero it keeps the claims instead and permissionless donateCollected(poolKey) donates them later, so a swap never reverts because of a donate. No other fee, no admin. README: why a buy-sandwich's back-run sell earns nothing, what the one-direction limit leaves open, OpenZeppelin's MemoryOOG warning for the tick loop at tickSpacing 60, and that prices can lag the market because arbitrage is dampened. Events: Clipped(poolId, blockNumber, currency, amount), Donated(poolId, currency, amount). The symbol is NOSAND, not SAND, which is a widely traded token's ticker. Deploy shape, matching the live Sepolia hook launches 170 and 186 (168 passed the mainnet PoolManager and is not a model): AntiSandwichHook's only constructor argument is the Sepolia PoolManager 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543; every rate, window and threshold here is a source constant; there is no owner, admin, setter, pause, upgrade or sweep, and no $owner or $token argument. Permissions are exactly beforeSwap, afterSwap, afterSwapReturnDelta (low address bits 0x00C4), all others false; the constructor calls Hooks.validateHookPermissions and the CREATE2 salt is mined for those bits. The factory initializes the pool (currency0 native ETH, currency1 NOSAND, fee 3000, tickSpacing 60) and seeds one-sided NOSAND liquidity, so nothing in the hook may revert that initialize or that liquidity add (launch 138 was parked when a beforeInitialize gate reverted the factory), and the first buy lands in a pool that holds no ETH. All state is keyed by PoolId; a pool on this hook whose currency0 is not native ETH gets zero deltas and no other effect. Every callback requires msg.sender == PoolManager. Tests (Foundry, a real v4-core PoolManager deployed in the test, hook at a mined address): a launch rehearsal that initializes at the manifest price, seeds one-sided NOSAND liquidity like the factory and makes the first buy into the ETH-less pool; exact-in and exact-out in both directions; dust amounts; a pool whose currency0 is not ETH; direct callback calls from a non-PoolManager address revert; fuzzed sizes; and specifically: a buy front-run, victim buy and attacker sell in one block leave the attacker no profit; a lone sell in a fresh block is not clipped; clipped amounts reach LP fee growth; a zero-liquidity end keeps claims and donateCollected pays them later; exact-in and exact-out sells; gas of the first swap on a fresh pool at the launch price and of the checkpoint loop after a large tick move. An independent adversarial review (read-only) must attack: fidelity to OpenZeppelin's code, the direction mapping with currency0 = ETH, checkpoint correctness when liquidity changes within a block, the tick-loop gas bound (first swap from an empty checkpoint, the 100-step cap), JIT capture of donations, and the settle order in the handler. It reports each finding with the exact call sequence that triggers it. Website: one static page (dist/index.html) that reads the hook's views and events and the pool price through Uniswap's Sepolia StateView, with a buy/sell form that swaps through Uniswap's published Sepolia PoolSwapTest router (check it has code). It shows the start-of-block price, the current price, recent sells and how much each was clipped (Clipped events).

Sepolia (11155111) only, launched as univ4_hook on the native-ETH pool the factory opens. GitHub publication and IPFS hosting are approved. Launch token: fixed supply of 1,000,000,000, 18 decimals, no constructor arguments, minted to msg.sender, no mint or admin. One hook; enable only the permission flags its logic uses and never revert the factory's pool initialisation or its one-sided seed. Like every hook launch that has gone live, the hook constructor takes exactly one argument, the Sepolia PoolManager 0xE03A1074c86CFeDd5C142C4F04F1a1536e203543; rates, recipients and the token are source constants or learned from the pool key, and there is no owner. Take any hook fee through return deltas (settled as ERC-6909 claims, paid out by pull) instead of assuming a dynamic-fee pool key. Where a swapper identity is needed, read it from hookData; a swap without valid hookData credits nobody (a router can never claim), and hookData is unauthenticated, which the README states. No external oracles or VRF, no proxies, delegatecall or selfdestruct. foundry.toml sets bytecode_hash = "none". Any website is a static export with index.html in dist/. Site label lab-anti-sandwich-hook.

Build NOSAND and AntiSandwichHook (permissions beforeSwap, afterSwap, afterSwapReturnDelta; PoolManager-only constructor) with a launch-rehearsal Foundry suite and an independent adversarial review, deploy them through the factory on Sepolia, then build the one-page site against the live pool.

Website: one static page (dist/index.html) that reads the hook's views and events and the pool price through Uniswap's Sepolia StateView, with a buy/sell form that swaps through Uniswap's published Sepolia PoolSwapTest router (check it has code). It shows the start-of-block price, the current price, recent sells and how much each was clipped (Clipped events).