Lock in the rules. Lock out the rugs. Never your funds.
One audited, open-source transfer-hook engine — attach anti-rug rules to your token with zero code and earn a verifiable Safe Rails ✓ badge wallets and DEXs actually trust, because honeypots are impossible by construction.
No bespoke program to audit. One engine, read once, trust every token.
Every hooked token today ships its own unaudited program — so nobody trusts them. Hooklock flips it: thousands of tokens share one audited engine. Audit it once, trust them all.
No buy/sell-asymmetric block exists in the engine, and rule bounds are enforced. A Hooklock token cannot trap holders — and it's provable on-chain.
One open-source program secures every token. Integrators read a token's rules from a config account — no per-token audit, no hidden logic.
A DEX adds our single program id and instantly supports every Hooklock token. Integrating us is one line, and it ships them a trust badge their users want.
Toggle rules, set the mutability tier, and watch the badge + on-chain config update live.
Rules can only be loosened, never tightened. Provable on-chain.
{
"engine": "hooklock-v1",
"mint": "<your-token-mint>",
"mutability": "oneway",
"honeypot": "impossible",
"rules": [
{
"type": "launch_window",
"minutes": 5
},
{
"type": "max_wallet_holding",
"pct": 2
},
{
"type": "velocity_cap",
"pct_per_hour": 5
}
]
}Outcomes are knowable before signing — no surprise reverts.
We follow the spl-transfer-hook-interface exactly, so standard clients just work. Read a token's rules, simulate a transfer, and render the badge — all from one SDK.
import { getTokenRules, simulateTransfer } from "@hooklock/sdk";
// Show the badge in your token row
const rules = await getTokenRules(mint);
// -> { tier: "oneway", honeypot: "impossible", rules: [...] }
// Warn the user BEFORE they sign (no failed txns)
const ok = await simulateTransfer({ mint, from, to, amount });
if (!ok.pass) toast(ok.reason); // e.g. "blocked — 15s cooldown"Gate hooks by program? Add our id once → every Hooklock token works.
Simulate the hook client-side and warn users before they sign.
Drop-in badge component your users already want to see.