Risk & known gaps
This code is unaudited and has never held value. What follows is the list of things that could go wrong and have not been ruled out — stated here rather than left for a reader to discover.
Known gaps
- No independent audit. Reentrancy through
donateand cross-swap fee manipulation via the tick recorded inafterSwaphave been reasoned about and partially mutation-tested, but not reviewed by a third party. - The deviation cap is reasoned, not calibrated. Its bound comes from tick-space reasoning about the gap between real volatility and order-of-magnitude feed errors, not from fitted feed-failure data. It catches gross errors, not a subtly wrong value inside the tolerance.
- No L2 sequencer uptime feed. An earlier version of this page argued the omission was safe because a down sequencer stops the aggregator updating, so staleness fires and the pool over-charges. That reasoning was wrong, and is retracted: it only holds once an outage exceeds the staleness bound. A shorter outage freezes the pool tick and the feed's timestamp together, so on resumption they still agree with each other while both disagree with the world — the drift reads as zero at exactly the moment it is largest, which is under-charging. The hook now detects this directly by comparing wall clock against block production and distrusting the reference for a fixed window afterward. That is narrower than reading the uptime feed and does not replace it.
- One High audit finding is open. A JIT liquidity provider who can order their own swap ahead of a pending one can manufacture apparent drift for that swap and collect the inflated surcharge as the dominant in-range LP. The deviation cap gates which Chainlink readings are adopted; it does not bound the live pool tick the fee formula consumes. No regression test covers this yet.
- Aggregator circuit breakers unchecked. Non-binding on the deployed feed, where the bounds are sentinel defaults orders of magnitude outside any reachable price. Would need revisiting against a different feed.
- The capture share's elasticity is bounded, not measured. See the mechanism page.
Anticipated attacks
| Attack | Mitigation |
|---|---|
| Attaching the hook to a foreign pool | Currency-pair binding in beforeInitialize, both halves covered by tests |
| Unsettled delta bricking every swap | donate plus the returned positive delta net to exactly zero |
| Surcharge donation with zero in-range liquidity | Pool.donate reverts there; guarded and skipped rather than reverting the swap |
| Self-dealing: attacker is the sole in-range LP | Net cost (1−s)·S; at s=1 there is no counterparty left to extract from |
| Oracle manipulation of the mispricing signal | Staleness bound, degrade to the ceiling, and a deviation cap against a block-sampled pool average |
| Intra-block price manipulation of that average | The average samples the block-open tick, so a same-block swap cannot move it |