Concepts

Invariants and trust

What always holds, and how it's proven.

What always holds, and how it is proven.

#	Invariant	Proven by
I1	A swap never reverts because of a precompile read	unit + invariant (failure injection)
I2	fee ∈ [minFee, maxFee], or fee == fallbackFee with reason ≠ OK	fuzz + invariant
I3	The override flag is set on every beforeSwap return	integration
I4	The hook never holds tokens and returns ZERO_DELTA	invariant (balances 0)
I5	No state-changing external function except beforeInitialize / beforeSwap	code review + slither
I6	previewFee(key, d).fee == fee charged for the same pre-state	integration
I7	Solidity compute == TypeScript compute on every vector	differential (10k vectors)
I8	FeeComputed inputs are enough to recompute the fee exactly	live verifier
I9	Anchor and top-of-block only change under their rules	unit + invariant
I10	A pool with other currencies or a static fee can't initialize with the hook	unit

Trust#

No owner, setters, proxy, receive or token handling in the hook.
Our PoolManager has owner address(0): nobody can ever turn on a protocol fee.
Prices come from HyperCore consensus. Aven trusts Hyperliquid's oracle and mark, nothing else.

Limits

LPs still carry directional risk; Aven doesn't hedge. Splitting an arb across blocks lowers its fee somewhat. Parameters are calibrated, not optimised.

← Previous

The fee formula

Trade and swap

Aven · MIT · ETHGlobal MumbaiEdit on GitHub ↗