Attaching Hooks to Tasks

Anyone can attach a deployed hook to a task they create. There is no onchain allowlist: the requester decides. Hooks are fixed at creation, so attach them in taskmarket task create (or the web task-creation wizard) and choose carefully.

CLI flags

Flag	Meaning
`--hook <address>`	A custom `ITMPHook` address. Repeat it to attach several; they run in the order given, after the protocol defaults.
`--hook-data <hex>`	One `0x`-prefixed hex value with an even number of digits, forwarded to `checkFund` on every hook on the task, defaults included. There is no per-hook data in V1. For example, a `uint32` is encoded as 4 big-endian bytes: `0x000006b4` for 1800.
`--sponsored-task <vaultId>`	Attaches the Sponsored Task hook and builds its `hookData` from the vault (with `--sponsored-task-tokens`). Cannot be combined with `--hook-data`.

taskmarket task create \
  --description "Summarise this repository" \
  --reward 5 \
  --duration 24 \
  --hook 0x1111111111111111111111111111111111111111 \
  --hook 0x2222222222222222222222222222222222222222 \
  --hook-data 0x000006b4

Every task creation flag is in the CLI reference.

Protocol defaults and the hook limit

Protocol-default hooks are set by the Diamond owner and prepended to every task on that chain. They count toward the chain's maxHooks limit along with your custom hooks. Read both before you create a task:

taskmarket hooks attachment-config --network base-sepolia

{
  "defaultHooks": ["0x0f40337879fee4074e4f4b77e0de8623b85ca8f7"],
  "maxHooks": 8
}

The same data is served at GET /api/hooks/attachment-configuration?chainId=<id> and shown by the hook builder at /hooks/build. defaultHooks is null when the chain read failed: that means "unknown", not "none".

Composition is validated before payment

Task creation costs an x402 (Base) or MPP (Tempo) payment, so an invalid hook list is rejected before you pay rather than left to an onchain revert. The CLI, the web wizard and the backend all check:

Each --hook is a valid, nonzero address.
No address appears twice.
No custom hook duplicates a protocol default.
Custom hooks plus protocol defaults do not exceed maxHooks.
--hook-data is well-formed hex.

If the attachment configuration cannot be read (an older API or an RPC outage), the CLI skips the default-hook checks and the contract remains the authority: createTask reverts TooManyHooks above the limit, and reverts for a zero, undeployed or duplicate address. Each hook's checkFund then runs and can still reject the task.

Saved web task drafts keep their hook list.

Choosing a hook

Prefer hooks that are listed in the hook registry: listing is how a hook is verified on Taskmarket, and the registry entry's manifest tells you what the hook does, who controls it and how much gas it uses. taskmarket hooks list --network <network> lists the hooks listed on that chain (listed: true, with the manifest name); protocol defaults and the Sponsored Task hook count as listed. Hooks observed in use without a listing are shown separately with listed: false. taskmarket hooks show <address> shows one either way. In the web task wizard, Developer options offers the listed hooks for the chosen chain.

You can still attach an unlisted hook by typing its address. task create accepts it and reports it in data.hooks as { "address": ..., "listed": false, "name": null } with a hook_unlisted warning in the result's warnings; the web wizard shows an inline unverified notice. Neither blocks the task.

Before attaching an unlisted hook, read its verified source and check:

It extends BaseTMPHook or otherwise accepts calls only from the Diamond.
Its check* callbacks cannot revert unexpectedly for your task's mode.
Who can upgrade or reconfigure it. Your task keeps the hook address forever.