The deliverable is complete and committed on main as commit 1acabdc. Working tree is clean.

What was built

• src/Ratelimit.sol: OpenZeppelin ERC-20, name Ratelimit, symbol RATE, 18 decimals. The constructor takes no arguments and mints the full 1,000,000,000 supply once to the deployer. No mint, owner, pause or proxy.
• src/SwapRateLimitHook.sol: extends v4-periphery BaseHook, constructor takes only the PoolManager. Permissions are exactly beforeSwap. It keeps a (block, count) window per PoolId, reverts RateLimited(blockNumber) on the fourth swap in a block, emits SwapCounted, and exposes swapsInBlock. Router, sender, size, direction and hookData are ignored.
• src/HookFlags.sol and test/mocks/MockERC20.sol: the two files the protected admission tests import.
• script/DeploySwapRateLimitHook.s.sol: a rehearsal with constant configuration. It mines the CREATE2 salt and deploys both contracts. Tests call its functions directly and run() reads no environment.
• docs/abi/Ratelimit.json and docs/abi/SwapRateLimitHook.json.
• README.md: assumptions, deployment parameters, operational responsibilities, the dust-swap griefing caveat, and the statement that this is a Sepolia demo rather than spam or MEV protection.

Verification results

The tests run against a real v4-core PoolManager and cover the named acceptance cases: three swaps pass and the fourth reverts, the next block resets, two pools are independent, swaps through three routers and from three senders all count, a batch of four swaps reverts as a whole with no state change, liquidity add/remove and donations work in a full block, and the launch rehearsal with a one-sided RATE seed below the opening price, a first buy into the ETH-less pool, then a sell.

One decision worth knowing

v4-periphery deleted BaseHook in February 2026 and moved it to a separate repository. Because the approved workflow names the v4-periphery BaseHook, I vendored v4-periphery at the last commit that ships it. The file is identical to the moved copy apart from one import path. All dependencies are committed as plain files with pins recorded in lib/VENDORED.md, and no submodules or nested git directories remain.

Left to later stages

The manifest, independent review, source publication, attestation, factory deployment and the website are separate assignments. The manifest must declare the permission set as beforeSwap only, flag mask 0x0080, decimals 18, and the Sepolia PoolManager as the single constructor argument.

Created launch.json as the only changed file.

Validated schema constraints, constructor arguments, token metadata, beforeSwap permission, and opening price against the accepted implementation. Notes are 1,585/4,000 characters.

forge build succeeded; all 76 tests passed.

Saved one low-severity finding in .imd-findings.json: a batcher can catch the fourth swap’s revert and preserve the first three, contradicting the unconditional rollback guarantee. The three-swap cap remains intact.

Dust lockout costs 3 wei plus gas, or gas only using the initial empty-liquidity direction. This is an accepted design limitation.

Static review only; gas was not benchmarked. Implementation files remain unchanged.

Implemented the frontend, static export, deployment manifest, and validation evidence.

• Build, typecheck, and all 20 interaction checks pass.
• ABI hashes, asset hashes, and live RPC reads verified.
• No real transactions broadcast.
• Complete Git bundle: 2.23 MB, below 8 MiB.

Workspace Git metadata is read-only, so commit eeac263 is available in the delivery bundle.

Design documentation is at docs/DESIGN.md to respect the allowed write scope.