Unhook docs

Unhook lists the ERC-20 approvals a wallet has given on Robinhood Chain (chain id 4663) and lets the owner set any of them back to zero. It is a static site: every read and every transaction goes from your browser to Robinhood Chain. There is no Unhook contract and no server that sees your address.

What an approval is

Tokens don't move on their own. When an app needs to take tokens from your wallet (a swap router selling USDG for NVDA, a pons curve selling a meme back), you first call approve(spender, amount) on the token. From then on the spender can call transferFrom(you, anyone, amount) whenever it likes, up to that amount.

Most apps ask for 2^256 − 1, which is effectively unlimited, so you don't have to approve again next time. The approval does not expire. If the spender contract is exploited later, or was malicious from the start, it can empty that token from your wallet without a new signature.

How a scan works

1. Pons memes. The pons factory (0x7eD5…EC7e) has launched over 700,000 tokens, far too many to check from a browser. Unhook takes the newest 5,000 launches from the factory's Launched events and adds every pons market GeckoTerminal lists by volume and by trade count. For each meme it reads allowance(you, router) and allowance(you, curve) through Multicall3, 400 reads per request. Any older meme can be added by address.
2. Known spenders on core tokens. For the 27 Stock Tokens, USDG and WETH, the allowance to each well-known spender is read in one multicall.
3. Full history on core tokens you hold. An approval on a token you hold none of can't take anything, so the deep read runs on the core tokens with a balance. For each, Unhook asks for every Approval(owner = you, spender, value) event since block 0. The public RPC allows a single-address query to span at most 10,000,000 blocks, so the chain is read in slices (about ten per token), two at a time with short pauses so the RPC does not rate limit you.
4. Live check. Every token and spender pair found in the history is read again with allowance(). Pairs that are already zero are dropped. What remains is what a contract could take today.

You can add any other token address. Unhook runs step 3 and 4 for it.

Pons memes

Selling a pons meme back to its curve or through the pons router needs an approval. Those approvals are usually unlimited and pile up fast if you trade many memes. A meme's curve can only take that meme, so these are ranked medium, not high. Revoking them costs nothing but the next sell will ask for approval again.

Risk ranks

A named spender is not a guarantee of safety. The list only tells you what the contract is.

Revoking

Revoke sends token.approve(spender, 0) from the connected wallet. The button only works when the connected wallet is the one that was scanned. After the transaction lands Unhook reads the allowance again and removes the row once it is zero.

// what the Revoke button sends
await walletClient.writeContract({
  address: token,
  abi: ["function approve(address spender, uint256 amount) returns (bool)"],
  functionName: "approve",
  args: [spender, 0n],
});

"Revoke all high risk" sends one transaction per high-risk approval, one after another. Gas on Robinhood Chain is a fraction of a cent per revoke.

Limits

• ERC-20 only. NFT setApprovalForAll and Permit2's own sub-allowances are not listed yet.
• Tokens outside the core list and the pons factory are only checked if you add their address.
• If the public RPC rate limits the scan, it retries with growing pauses. If it still fails, try again a minute later.

Privacy

The site is static files on Cloudflare. Reads go from your browser to rpc.mainnet.chain.robinhood.com and robinhood.drpc.org. Unhook keeps the pons launch list in your browser's local storage and nothing else.

Token

$UNHK is the project's token on pons. It is not needed to use Unhook, which stays free apart from gas.

FAQ

Can Unhook move my tokens?

No. The only transaction it can ask you to sign is approve(spender, 0), which lowers a permission.

Why did a row come back after I revoked?

Your next trade on that app approved it again. That is expected.

Is the code audited?

There is no contract. The site is unaudited front-end code that calls standard token functions.