No bot buys its way around the gate. Wallets are capped at 2%. Liquidity is locked in bytecode. Every rule is enforced by the contract — the deployer can't change them either.
The hook never reverts. That is deliberate. A V4 pool can't be priced with local math — a hook may change the result — so any aggregator has to simulate the swap to quote it. A gate that reverts kills those simulations and the pool becomes unquotable everywhere, including on the one venue it was meant to favour. We shipped that version, measured it, and rebuilt.
So the hook only records, in transient storage, which router asked.
Enforcement happens one step later, when PoolManager hands the tokens over: the token contract reads
that mark and refuses delivery if it's missing. A quoter calls swap, reads the delta and
reverts — it never takes delivery, so it never meets the check. Anyone can
quote; only a whitelisted venue can buy.
Why sender and not tx.origin?
GMGN builds the transaction but the user's own wallet signs it — so tx.origin is the
user's address, useless for identifying a route. V4 instead hands the hook a sender
that is always the contract calling PoolManager: the router itself. PoolManager writes that value;
a caller cannot forge it.
Deploy token → create pool → seed supply → arm the gate