By designing hooks like sandboxed plugins rather than open permissions.
The core token balance and pool liquidity are immutable.
A hook can only touch what is explicitly piped into itโspecifically, its small sliced fraction of the 2% trade fee.
If a new hook fails, produces unexpected math, or gets a bad oracle report, the failure boundary is localized. It canโt pull tokens from holders, alter supply arbitrarily, or touch other hooks.