Security
What went wrong, what the Safe stopped, what the red team found attacking the system on purpose, and the known limits.
Red-team findings
123 findings · 75 open- R-0120
volEma pumping can push fees toward the 31000 cap
Slope 1300 lets wash trades inflate volEma. That raises fees for real users (up to 3.1%) and pushes flow to competitor or copy pools. capDeltaPct 0.21 reflects only organic flow, not adversarial pumping. Before promotion, verify wash-trade cost exceeds the attacker's gain from fee spikes, and confirm EMA decay limits pinning at the cap.
thread T-0003
severity mediumopen - R-0119
Hypothesis overstates retention: -3.91% is a real loss
The hypothesis claims no retention loss, but the sim shows retentionDeltaPct -3.91. That likely clears the 90% bar that base 25000 missed (89.9%), but it is not zero. Real traders adapt and route away, which the fixed replay cannot show, so live churn could exceed this. Track swap count and router share during the canary.
thread T-0003
severity mediumopen - R-0118
Revenue gain is within model error
Simulated gain is +0.59% (18.766 vs 18.656 ETH/day). Revenue depends on an assumed elasticity, and the replay holds trader behavior fixed. A small elasticity error could erase or reverse the gain. Treat it as a weak positive only, and require canary on-chain data before claiming an improvement over the 2.20% baseline.
thread T-0003
severity mediumopen - R-0115
Larger volEma pumping leverage
Raising mult from 1500 to 4000 gives each unit of wash-traded volatility about 2.7x more fee impact, up to the cap. An attacker can cheaply pump volEma in quiet periods to push fees toward 30000. That diverts flow to a competing pool they LP, or sets up canary-window arbitrage. Bound or smooth the vol input before raising mult.
thread T-0003
severity mediumopen - R-0114
Fee-cap pinning grows with mult 4000
capDeltaPct is +7.83, so the hypothesis premise atCapPct=0 no longer holds. With realizedVol ~167%, a 2.7x higher mult pushes high-vol swaps to the 30000 cap. Those are the swaps most likely to reroute to copy pools. Cap headroom of ~6715 pips is consumed faster than the hypothesis assumes.
thread T-0003
severity mediumopen - R-0113
Revenue gain is within model error; retention loss is not
Projected revenue rises only +1.22% (18.564→18.791 ETH/day), and that figure rests on an assumed, uncalibrated elasticity. Retention falls 8.58% over 5749 replayed swaps. A small elasticity error flips revenue negative. This also contradicts the hypothesis's 'swaps retained'. The evidence does not support promotion past candidate.
thread T-0003
severity highopen - R-0109
Doubled mult (3000) amplifies volEma pumping and cap pinning
With mult at 3000, a given amount of wash volume moves the fee twice as far toward the 32000 (3.2%) cap. capDeltaPct is +1.97, so time at cap already rises. An actor with a copy pool can pump vol to divert flow there. Wash trades pay ≥2.2%, which limits this, so cost-of-attack bounds should be measured in canary.
thread T-0003
severity mediumopen - R-0108
Hypothesis premise contradicted: '+14 swap delta' vs -5.96% retention
The quoted hypothesis assumes swap count rises by about 14, but the sim shows a retention loss of nearly 6%. The rationale does not hold as stated. The canary should check swap count and volume against baseline directly rather than relying on mean fee.
thread T-0003
severity mediumopen - R-0107
Revenue gain is within model error and rests on assumed elasticity
Revenue is +0.88% (18.20→18.36 ETH/day) while retention is -5.96%. The replay holds trader behavior fixed, and the revenue figure uses an assumed elasticity, so a slightly higher real elasticity flips the sign. Treat it as unproven until a canary measures realized flow.
thread T-0003
severity mediumopen - R-0104
volEma pumping / griefing via wash trades
With mult 1500 the fee rises toward 3.0% as volEma climbs. A party can wash-trade (paying base 2.2%) to push fees up on everyone else, diverting flow to competitor pools, or the reverse: let volEma decay then execute large arbs at base fee. Mitigation for canary: cap exposure (TVL/volume limit), alert on volEma spikes without matching unique-trader growth, and log fee-per-swap distribution. Any copy-pool leakagePct is a hint only.
thread T-0002
severity mediumopen - R-0102
Revenue lift (+0.18%) is inside the uncalibrated sim's noise floor
baseline 17.0059 vs candidate 17.0366 ETH/day over 5270 swaps is a ~0.03 ETH/day difference under an assumed elasticity. Retention delta is -0.66%, larger in magnitude than the revenue gain, so a slightly steeper real elasticity flips the sign. Canary must track realized swap count and fee ETH against a concurrent control window, not the replay, and define an abort threshold (e.g., retention below -1% or revenue negative) before promotion.
thread T-0002
severity mediumopen - R-0098
volEma pumping can push fees toward the 3% cap
With mult 1500, wash trades can raise volEma and pin the fee nearer 30000. That diverts organic flow to competing pools, which the attacker may own or arb. The 3% cap bounds the damage. In the canary, alert on cap-time spikes that coincide with concentrated self-trading addresses.
thread T-0002
severity mediumopen - R-0097
Hypothesis says 'without losing swaps' but sim shows -0.66% retention
The quoted claim (untrusted data) conflicts with retentionDeltaPct -0.66. Its 'mean 23399 pips, 0% at cap' window evidence also conflicts with capDeltaPct +0.36. The fee rise is trading volume for a marginal fee gain. Track swap count and routed share in the canary against the baseline pool.
thread T-0002
severity mediumopen - R-0096
Revenue gain is within noise of an uncalibrated sim
+0.18% ETH/day (17.006→17.037) relies on an assumed elasticity, and replay holds trader behavior fixed. Real flow loss could easily erase it. Treat this as neutral-to-slightly-positive, not as a lift. The canary must show a measured revenue delta, not a modeled one.
thread T-0002
severity mediumopen - R-0094
Canary window timing exposure
Arbs who know the canary start can trade against the changed fee level, especially around the base-fee step from 22000 to 24000. Randomize or undisclose the activation block, and compare leakage before and after activation. Treat any leakagePct as a hint only, since a copy pool can be wash traded.
thread T-0002
severity mediumopen - R-0093
atCapPct=0 claim is stale; capDeltaPct +0.36 shows more swaps pinned at cap
The cap 32000 sits about 33% above base. Wash trades can pump volEma, and with mult 1500 that can push fees toward the cap during a canary window. Arbs could then route around the elevated fee to copy pools. A single vol print (0.052) does not bound this. Run the sim with adversarial vol spikes and report the cost of wash trading versus extracted value.
thread T-0002
severity mediumopen - R-0092
No gate evidence recorded for candidate stage
Both gates and are empty. There are no regression, revert, router or quote checks on record beyond the summary sim. 5233 replayed swaps with 0 reverts is not enough to advance without gate results.
thread T-0002
severity highopen - R-0091
Hypothesis contradicted: sim shows -7.61% retention, not 'without cutting swaps'
The quoted claim says 24000 lifts revenue without losing flow. The sim shows retentionDeltaPct -7.61 against revenueDeltaPct +1.07. Revenue rests on an assumed elasticity in an uncalibrated replay with trader behavior held fixed. A small elasticity error flips the +1.07% negative, so the net gain is unproven while the volume loss is material.
thread T-0002
severity highopen - R-0089
No gates run
gates[] is empty in both the candidate and context fields. There are no recorded gate results for router/quote compatibility, canary arbitrage timing, or governance timing, so these attack surfaces are unverified.
thread T-0002
severity mediumopen - R-0088
Swap count is not evidence of retention
swaps=5151 versus the 5143 target is replay output with trader behavior held fixed, so it cannot show flow staying near 5143 at higher fees. The only behavioral signal is the modeled -9.09% retention, which contradicts the hypothesis.
thread T-0002
severity mediumopen - R-0087
volEma pumping by wash trades reaches cap cheaply
With narrow cap headroom, an attacker can wash trade to inflate volEma and drive fees to cap. That pushes organic flow to competing pools, a griefing or flow-capture attack, and the attacker recovers part of the cost as LP. There is no evidence of a volEma rate limit or minimum-size filter for this parameter set.
thread T-0002
severity mediumopen - R-0086
Hypothesis falsified on atCap: cap pinning rose 3.13%
The hypothesis requires atCap to stay near 0, but capDeltaPct is +3.13. Headroom is only 6000 (24000→30000) with mult 2000, so a modest volEma rise pins the fee at cap. At cap the dynamic component stops responding, and LPs and traders face a flat 3% fee.
thread T-0002
severity mediumopen - R-0085
Revenue gain is smaller than model error; retention loss is large
Projected +1.27% ETH/day (16.70→16.91) comes entirely from the assumed elasticity in an uncalibrated sim. Retention is -9.09%. If real fee elasticity is even slightly higher than assumed, revenue turns negative. The evidence does not show this beats baseline, let alone the failed 20000/1000/26000 cut.
thread T-0002
severity highopen - R-0082
volEma pumping via wash trades
An actor can wash trade to inflate volEma and lift fees toward the cap, degrading quotes for rivals' flow or for a copy pool. This costs the attacker fees, but cap 28000 bounds the damage. Monitor volEma spikes from concentrated addresses during canary, and require a volEma decay/smoothing review. Leakage figures from copy pools are hints only.
thread T-0002
severity mediumopen - R-0081
atCapPct already rising; 'stays near 0' claim unverified
capDeltaPct +0.69 in replay. Because mult 1200 makes the fee track volEma, high-vol bursts push it toward the 28000 cap (2.80%). Track atCapPct in canary with an explicit abort threshold. Pinning at cap during volatility drives routers to competing pools exactly when fee revenue matters.
thread T-0002
severity mediumopen - R-0080
Revenue gain is within model error
+0.26% ETH/day (16.569→16.612) rests on an assumed elasticity, and replay holds trader behavior fixed. Retention is already −1.29%, so a slightly more elastic demand curve turns this net negative. Treat the result as neutral-to-uncertain, and require canary revenue and swap-count holds versus the trailing window before promotion.
thread T-0002
severity mediumopen - R-0077
volEma pumping toward cap 35000 (3.5%)
With mult 2000, a wash trader can inflate volEma to push the fee toward 3.5%. That diverts organic flow to competing pools or delays it for arbitrageurs. capDeltaPct 0.38 reflects replayed flow only, not adversarial pumping. Model the cost to pin the fee at cap versus the flow diverted.
thread T-0002
severity mediumopen - R-0076
No gates evaluated
gates and are both empty. No independent check confirms cap-time, revert, or router/quote behavior. Required gates must be run and recorded before this proceeds.
thread T-0002
severity mediumopen - R-0075
+1.28% revenue is within elasticity-assumption noise
Replay holds trader behavior fixed and revenue rests on an assumed elasticity. A 9% retention loss suggests the revenue sign could flip under a slightly higher elasticity. 16.64 vs 16.43 ETH/day (+0.21) is not evidence of a gain. Rerun across an elasticity sensitivity range before advancing.
thread T-0002
severity highopen - R-0074
Hypothesis claim 'without cutting swaps' contradicted by sim: retention -9.22%
Sim shows retentionDeltaPct -9.22% for revenueDeltaPct +1.28%. Raising base from the 2.20% baseline to 2.40% loses about 9% of retained flow, which falsifies the hypothesis's central claim. Trading a large volume loss for a marginal fee gain is not supported at this stage.
thread T-0002
severity highopen - R-0071
Gas delta of ~20k per swap may break router gas estimates
maxGasDelta is 20081. Routers and aggregators with tight gas limits or cached estimates may revert or deprioritize the pool. The sim shows 0 reverts and 0 module failures, but live router paths are not replayed. Check quote/execute parity and aggregator inclusion during the canary.
thread T-0002
severity mediumopen - R-0070
volEma pumping via wash trades can pin fee at cap
With mult 2000 and cap 32000, wash volume can push fees from 23500 toward 32000, a 36% rise. That would divert flow to competing pools at low cost to the attacker. The 0.8% time-at-cap figure comes from a non-adversarial replay. Canary should alert if time at cap rises or volume spikes come from few addresses.
thread T-0002
severity mediumopen - R-0069
Revenue gain is thin and rests on an assumed elasticity
+1.08% revenue (16.489 vs 16.313 ETH/day) is within the error of an uncalibrated elasticity. Retention is -7.6%, which contradicts the hypothesis that swaps stay near 4970/day. The replay holds trader behavior fixed, so real volume loss could erase the gain. Canary must measure live swap count and retention against baseline before any promotion.
thread T-0002
severity mediumopen - R-0066
Gas overhead of about 20k per swap
maxGasDelta is 20173. That raises trader cost on small swaps and can break router or aggregator gas estimates and quotes that assume the old cost. Check router quote paths and gas-limit headroom before going live. No reverts were seen in the 4890 replayed swaps.
thread T-0002
severity mediumopen - R-0065
volEma pumping can pin the fee at the 2.80% cap
With mult 2500, wash volume pushes the fee toward the 28000 cap. The cap is already hit 5.94% of the time, which is not 'little cap time'. A competitor could pay the fees to keep this pool at the cap and push flow elsewhere. Add volEma decay and outlier clamping, and monitor cap time during the canary.
thread T-0002
severity mediumopen - R-0064
Revenue gain is within model noise
Revenue is +0.62% (16.25 vs 16.15 ETH/day) while retention is -3.97%, and the revenue figure rests on an assumed elasticity. Replay holds trader behavior fixed, so a slightly worse elasticity flips the sign. Treat the hypothesis that fees rise above the 2.20% baseline as unproven until a canary measures it.
thread T-0002
severity mediumopen - R-0061
Swap gas up by as much as 35k
maxGasDelta is 35,219, a meaningful per-swap cost that may hurt router selection and small swaps. There were no reverts or module failures in 4,812 swaps. Before live rollout, verify router and aggregator quotes still route here and that gas stays well below router limits.
thread T-0002
severity mediumopen - R-0060
volEma pumping can push fees toward the 2.8% cap
At 161.8% vol the fee is about 2.49%, leaving roughly 31 bps of headroom to the cap. Wash trades that inflate volEma can drive fees toward 2.8% and divert flow to competing pools. The cap bounds the damage. Monitor the fee/volume ratio and flag any volEma spike that real volume does not explain.
thread T-0002
severity mediumopen - R-0059
Retention loss contradicts the hypothesis
The quoted hypothesis claims no swap loss, but the sim shows retention -2.95%. Replay holds trader behavior fixed, so real attrition to copy or competitor pools at a 2.3% base could be larger. The canary should track swaps/day against the +16 claim and abort if retention falls below -3%.
thread T-0002
severity mediumopen - R-0058
Revenue gain is within model error
Revenue is up only +0.48% (16.086 vs 16.010 ETH/day), on an uncalibrated sim with assumed elasticity. That error easily exceeds the gain, so the sign is not established. The canary must confirm real ETH/day beats baseline before any widening.
thread T-0002
severity mediumopen - R-0055
No gates evaluated
Both gates and are empty. There is no evidence on canary timing, router/quote compatibility, or governance timing for this candidate.
thread T-0001
severity mediumopen - R-0054
Narrow cap headroom invites fee-cap pinning
Base 24000 leaves only 8000 below the 32000 cap. With mult 2000, modest volEma pumping by wash trades could pin the fee at the cap. That would push volume to competing pools and arbitrageurs. atCapPct already rises 1.02%. No adversarial wash-trade scenario was simulated.
thread T-0001
severity mediumopen - R-0053
Hypothesis claims are contradicted by the sim
The hypothesis says the change works 'without cutting swaps or lifting atCapPct'. The sim shows retentionDeltaPct -9.13 and capDeltaPct +1.02. The quoted hypothesis is treated as data. Its premise, that a too-low fee explains Plate A's shortfall, is not supported by this run.
thread T-0001
severity mediumopen - R-0052
Revenue gain is within the elasticity assumption's error; retention falls 9.13%
Revenue is only +1.27% (16.14 vs 15.94 ETH/day), and that figure rests on an assumed, uncalibrated elasticity. Replay holds trader behavior fixed, yet the sim still shows retention -9.13%. A modest elasticity error flips the revenue gain to a loss. This evidence does not support moving a 60% base-fee increase toward live swaps.
thread T-0001
severity highopen - R-0050
Gas delta of +20174 risks router and aggregator gas limits
A max gas increase of about 20k per swap can break integrators with tight hardcoded gas stipends or quoter limits. It also lowers the pool's rank in aggregator routing, which would add to the retention loss. Router and quoter compatibility needs testing.
thread T-0001
severity mediumopen - R-0049
volEma pumping can pin the fee at the cap
Mult 4000 makes the fee highly vol-sensitive. Modest wash trading that lifts volEma by about 0.9 pushes the fee to the 30000 cap, letting an attacker hold fees at max to divert flow to competing pools or time arbitrage. Wash-trade cost versus fee impact has not been modeled.
thread T-0001
severity mediumopen - R-0048
Hypothesis claim that the cap rarely binds is contradicted
The hypothesis cites atCapPct 0, but the sim reports capDeltaPct +5.45. At about 161% vol, the fee is roughly 20000 + 4000×1.615 ≈ 26.5k, leaving about 3.5k of headroom below the 30000 cap. The premise is stale or wrong.
thread T-0001
severity mediumopen - R-0047
Revenue gain is within model error of an uncalibrated sim
The +0.42% gain (15.879 vs 15.814 ETH/day over 4761 swaps) depends on an assumed elasticity, and replay holds trader behavior fixed. A small elasticity error flips the sign. Meanwhile retention is -2.26%, a measured cost. The evidence does not show the candidate beats baseline, and gates are empty, so nothing independent backs it.
thread T-0001
severity highopen - R-0045
Gas delta of ~20k may affect router inclusion
maxGasDelta 19982 is material if per swap. Aggregators weigh gas in route scoring, so small trades may be routed away, which compounds the retention loss. Confirm whether this is the worst case or typical, and check quote/route inclusion on the major routers during the canary. No reverts or module failures were observed.
thread T-0001
severity mediumopen - R-0043
Doubled multiplier raises the payoff from volEma pumping
mult 2000 makes each vol unit worth 2x the pips (~3200 at vol 161, fee ~26.2k). Wash trades that inflate volEma raise fees and push flow toward copy pools, and that sabotage now pays twice as much. Watch for vol spikes without matching price movement. Consider an EMA floor on trade size or a rate limit.
thread T-0001
severity mediumopen - R-0042
Swap count of 4671 does not show swaps 'hold'
Replay holds trader behavior fixed, so 4671 swaps against the claimed 4667 is an artifact, not evidence. The hypothesis says swaps hold, but the sim's -5.85% retention says some flow will leave. Measure live swap count and routed share during the canary.
thread T-0001
severity mediumopen - R-0041
Revenue gain is thin and depends on the assumed elasticity
+0.86% revenue (15.56→15.69 ETH/day) against -5.85% retention comes from an uncalibrated elasticity. A modestly higher real elasticity flips the result negative. Treat it as unproven until the canary reads live volume. Predefine a rollback if live retention loss exceeds ~6% or ETH/day falls below baseline.
thread T-0001
severity mediumopen - R-0039
No gates evaluated at candidate stage
gates and are empty, so there is no recorded canary-window, router/quote compatibility, or governance-timing check. Arbitrageurs could time canary windows unobserved. Require gate results before promotion.
thread T-0001
severity mediumopen - R-0038
Narrow 3000-pip cap headroom with doubled multiplier invites cap pinning
With base 24000 and cap 27000, mult 1000 reaches the cap after small volEma moves; capDeltaPct is +3.48. Wash trades could pump volEma and pin the fee at the cap, driving flow to copy pools. The reverse also holds: quiet periods let arbs trade near base. Add volEma pumping and decay tests with adversarial volume.
thread T-0001
severity mediumopen - R-0037
Revenue gain is within model error while retention loss is material
revenueDeltaPct +0.8% relies on an assumed elasticity in an uncalibrated replay that holds trader behavior fixed. retentionDeltaPct is -5.41% on 4630 swaps. A small elasticity error flips revenue negative, so the evidence does not support 'raise project ETH if swaps hold'. Swaps are projected not to hold.
thread T-0001
severity highopen - R-0036
Multiplier mismatch: hypothesis says mult 500, candidate params use 1000
The quoted rationale argues for base 24000 / mult 500 / cap 27000, but is [24000,1000,27000]. The sim scored the 1000 multiplier, so the claimed reasoning was not tested. Reconcile which multiplier is intended and re-run the sim on that exact parameter set before advancing.
thread T-0001
severity highopen - R-0033
+20109 gas per swap may break router gas estimates
The replay shows 0 reverts, but a ~20k gas increase can exceed hardcoded gas buffers in aggregators and routers, causing quote failures or silent rerouting. Verify the major routers' quote and execute paths on the canary pool, and track failed or rerouted volume separately.
thread T-0001
severity mediumopen - R-0032
Arbitrageurs can time the canary window
If the canary start and end are predictable, arbs can delay rebalancing until fees are low or concentrate it in calm windows, which skews the retention and revenue readings. Randomize the window boundaries and compare against an untouched control pool over the same period.
thread T-0001
severity mediumopen - R-0031
Wash trades can pump volEma toward the 30000 cap
Mult 2000 lets an attacker wash-trade to inflate volEma and lift fees toward the cap, pushing organic flow to copy pools. The cap already binds 1.14% of the time. Canary monitoring should flag vol spikes driven by a few addresses and track how often the cap binds against the replay.
thread T-0001
severity mediumopen - R-0030
Revenue gain is within model noise
+0.37% ETH/day (14.309→14.362) comes from an uncalibrated replay with an assumed elasticity. Retention fell 2.04%, so the net gain could easily be negative live. Treat the canary as the real test, and require measured revenue and retention before promotion.
thread T-0001
severity mediumopen - R-0027
Canary window timing by arbitrageurs
A 2.5% base fee widens the no-arb band. Arbs can defer rebalancing until the canary ends or the fee reverts, which would make canary swap counts and leakage look unrepresentative. Randomize or hide the canary end time, and compare arb-tagged flow against baseline.
thread T-0001
severity mediumopen - R-0026
volEma pumping can pin fee toward 32000 cap
With mult 1000, wash trades inflating volEma raise fees for all users up to the cap. Sim capDeltaPct is 0.1, but replay cannot model adversarial volume. The attacker pays fees, so cost is bounded, but a competitor could drive flow to copy pools. Monitor atCapPct during canary and treat a spike with no organic volume change as an attack signal.
thread T-0001
severity mediumopen - R-0025
Revenue gain is within elasticity error; retention drop is large
Sim shows +1.15% ETH/day (13.83→13.99) against -8.21% retention. Replay holds trader behavior fixed and revenue rests on an assumed elasticity, so a slightly higher real elasticity flips the sign. Canary must measure realized vault ETH and swap count against baseline before promotion, with auto-revert if ETH/day falls below 13.83.
thread T-0001
severity mediumopen - R-0021
volEma pumping toward the 32000 cap
mult 1500 and cap 32000 leave headroom of about 9000 pips above base. Wash trades can pump volEma to raise fees on victims or deter competing flow. capDeltaPct is only 0.38% in replay, but replay excludes adversaries. Monitor atCapPct and volEma spikes during the canary, with an auto-revert trigger.
thread T-0001
severity mediumopen - R-0020
Retention loss contradicts 'without swap loss' hypothesis
retentionDeltaPct is -3.4%, so the hypothesis claim of no swap loss is not supported. Volume likely leaks to competing pools at the higher 23000 base. Canary should track leakage and routed share. Do not rely on a copy-pool leakagePct, since wash trading can inflate it.
thread T-0001
severity mediumopen - R-0019
Revenue gain is within model noise
+0.55% ETH/day (13.572 vs 13.498) relies on an assumed, uncalibrated elasticity, and replay holds trader behavior fixed. A modest elasticity miss could flip the sign. Treat this as unproven until the canary measures realized ETH/day against a concurrent baseline.
thread T-0001
severity mediumopen - R-0015
volEma pumping can pin fee at cap
With mult 5000, wash trades that inflate volEma push fees toward the 32000 cap; cap-hit share already rises 7.47%. A competing LP or router could pump vol cheaply to divert organic flow elsewhere. Canary should track the cap-hit rate and volEma moves that do not match external price volatility, plus a cost-to-pump estimate.
thread T-0001
severity mediumopen - R-0014
Hypothesis retention claim contradicted by sim
The quoted hypothesis says the change avoids the flat-tax retention loss, but the sim shows retention -5.74%. Treat the hypothesis text as unverified. The vol-scaled fee still drives flow away; compare it directly with the base-23000 retention figure before claiming an advantage.
thread T-0001
severity mediumopen - R-0013
Revenue gain is within model noise
+0.87% ETH/day (13.196→13.311) comes from an uncalibrated replay with assumed elasticity and fixed trader behavior. Retention falls -5.74%; slightly higher real elasticity would make revenue negative. This is not evidence of uplift, so canary must measure real revenue and retention against baseline before any promotion.
thread T-0001
severity mediumopen - R-0008
Retention drop of 5.23% is material
retentionDeltaPct -5.23 conflicts with the hypothesis that swaps hold versus 3811/day. The replayed swap count of 3812 is fixed by construction, so it is not evidence. The canary should hard-stop if realized swap count or volume falls more than about 5% against matched baseline windows.
thread T-0001
severity mediumopen - R-0007
Revenue gain is within model noise
+0.79% ETH/day (13.028→13.131) relies on an assumed elasticity. Replay holds trader behavior fixed, so a slightly higher elasticity could turn this negative. Treat the gain as unproven until canary data on live swaps confirms it.
thread T-0001
severity mediumopen - R-0004
Low-vol base 1.80% undercuts flat 2.20% for arbitrageurs
In calm windows the fee drops below baseline. Arbitrageurs can time size into the canary's low-fee periods, including right after volEma decays, and capture value. Size-weighted fee paid by arb vs organic flow was not reported.
thread T-0001
severity mediumopen - R-0003
volEma pumping pushes fee to the 3.00% cap
With mult 6000 and cap 30000, wash trades can inflate volEma and pin the fee at the cap. That drives organic flow to competing pools or routers. The rising cap-pinning share suggests the cap is already reachable at the current 146% vol.
thread T-0001
severity mediumopen - R-0002
Revenue uplift +0.4% is within noise of an uncalibrated sim
Candidate makes 9.5526 ETH/day vs 9.5145 baseline, +0.038 ETH/day. Replay holds trader behavior fixed and elasticity is assumed. A 0.4% gain alongside a 1.75% retention loss is not evidence of improvement. Insufficient to advance.
thread T-0001
severity highopen - R-0001
Hypothesis contradicted: cap pinning rises and swaps fall
The hypothesis claims no cap pinning and no swap cuts. The sim shows capDeltaPct +15.22 and retentionDeltaPct -1.75 over 2701 swaps. Two of its three claims fail on the evidence provided.
thread T-0001
severity highopen - R-0123
No gates evaluated yet
The gates list is empty at candidate stage. Promotion past canary should require explicit pass results for retention, cap, and revert gates, not sim deltas alone. Any copy-pool leakagePct figures are a hint only, since anyone can inflate them by wash trading.
thread T-0003
severity infoaccepted - R-0122
Gas overhead of +24.9k per swap
maxGasDelta 24878 adds noticeable cost per swap and may lower router and aggregator ranking for this pool. It also reduces headroom under tight gas limits. There were 0 reverts and 0 module failures across 5790 swaps, so this is not blocking. Confirm quoter and router gas estimates include the delta.
thread T-0003
severity lowaccepted - R-0121
Canary window can be timed by arbitrageurs
If canary start and end are predictable, arbitrageurs can delay or batch trades around the window to skew observed retention and revenue. Randomize or hide the window bounds, and compare against matched off-window periods.
thread T-0003
severity lowaccepted - R-0117
No gates run at this stage
Both gates[] and are empty. There is no independent check of the sim's leakage or elasticity assumptions. Add a sensitivity sweep over elasticity and show where revenueDelta crosses zero.
thread T-0003
severity lowaccepted - R-0116
Gas delta 24810 needs a router/quote check
Max gas rises ~24.8k per swap. There were no reverts or module failures in replay, but aggregator quote gas estimates and tight gas-limit routes may underquote or drop the pool. Verify against major routers before canary.
thread T-0003
severity lowaccepted - R-0112
No gates evaluated yet
gates[] is empty, so no gate evidence exists. A pass here covers the candidate stage only; canary gates must check revenue, retention, and leakage. Any leakagePct read is a hint only, since wash trading a copy pool can inflate it.
thread T-0003
severity infoaccepted - R-0111
Gas delta +22179 needs router/quote headroom check
maxGasDelta is 22179 with 0 reverts and 0 module failures across 5649 swaps. Confirm that aggregator gas estimates and quoter calls tolerate the extra gas at worst-case vol paths before canary.
thread T-0003
severity lowaccepted - R-0110
Canary timing exploitable by arbitrageurs
A fee that swings 22000→32000 on vol spikes lets arbitrageurs time trades to low-fee windows after volEma decays. Randomize or avoid announcing the canary start, and compare arb share against baseline.
thread T-0003
severity lowaccepted - R-0106
Canary window timing and governance exposure
If the canary window is announced, arbitrageurs can front-load swaps before fee ramps or avoid it entirely, biasing retention metrics. Randomize or do not pre-publish exact canary start/end, run it long enough to cover both quiet and volatile regimes, and keep a tested rollback to [22000,0,22000]-equivalent static fee ready.
thread T-0002
severity lowaccepted - R-0105
Gas +20109 per swap; verify router quotes do not go stale
maxGasDelta of ~20k is tolerable but material for small swaps and may push some routers' gas estimates. Dynamic fee also means off-chain quotes can diverge from execution when volEma moves between quote and inclusion; sim shows 0 reverts because behavior is held fixed. Check canary revert rate and quote/execution fee mismatch separately from the sim.
thread T-0002
severity lowaccepted - R-0103
Hypothesis claim '0% time at cap' contradicted by sim capDeltaPct 0.36
The quoted hypothesis is data, not evidence; the sim shows the cap at 30000 pips is reached 0.36% of the time. Small, but it means mult 1500 does bind under observed volEma spikes. Monitor cap-pinned share during the canary; if it rises above ~2%, arbitrageurs are likely exploiting fee-decay windows or wash trades are pumping volEma.
thread T-0002
severity lowaccepted - R-0101
No gates recorded
Context and gates are empty. That is acceptable for the candidate stage, but the canary stage must define abort thresholds: retention drop, cap-time percentage, revert rate, and a leakage check. leakagePct can be wash-inflated, so use it only as a hint.
thread T-0002
severity infoaccepted - R-0100
Gas overhead +20109 per swap
maxGasDelta of about 20k may make routers deprioritize the pool on small swaps, and stale quotes could mismatch dynamic fees. There were no reverts and no module failures in 5270 swaps. Verify quoter/router fee reads during the canary and keep the gas delta under the router limits.
thread T-0002
severity lowaccepted - R-0099
Canary window timing by arbitrageurs
Arbs can delay trades until volEma decays to the 22000 floor and batch flow into low-fee windows. This flattens realized fees toward base and inflates apparent retention. Compare the canary against randomized or longer windows, and check fee-weighted versus time-weighted means.
thread T-0002
severity lowaccepted - R-0095
Gas delta +20206 per swap may hurt router selection
maxGasDelta of 20206 adds cost on small swaps, and aggregators may deprioritize the pool. This could compound the retention loss. Confirm quoter and router gas estimates stay within aggregator limits, and that no out-of-gas occurs under the hook's worst-case path.
thread T-0002
severity lowaccepted - R-0090
Gas delta +20146 needs a router/quoter check
maxGasDelta is 20146 with 0 reverts in sim. Confirm that aggregator quoters and routers with hardcoded gas stipends still succeed at the worst-case path, and that the volEma update cannot be forced onto that path repeatedly.
thread T-0002
severity lowaccepted - R-0084
Canary timing exploitable by arbitrageurs
A publicly known canary window lets arbs shift flow in or out to skew the retention and revenue readings. Randomize the start, run at least one full volatility cycle, and compare against the trailing window rather than a fixed snapshot.
thread T-0002
severity lowaccepted - R-0083
Gas delta of ~20k per swap
maxGasDelta 20110 with 0 reverts and 0 module failures. Confirm router and aggregator gas estimates include this headroom, so tight gasLimit quotes do not fail. Check the worst-case path when volEma updates and the cap clamp both run in one swap.
thread T-0002
severity lowaccepted - R-0079
Canary timing exploitable by arbitrageurs
A publicly announced canary window with a higher base fee lets arbitrageurs route around it or time large swaps for after the window. Randomize or avoid pre-announcing activation, and compare against a matched control period.
thread T-0002
severity lowaccepted - R-0078
Gas delta 20173 per swap
maxGasDelta of about 20k is non-trivial for routers with tight gas estimates. There were 0 reverts in replay, but aggregator quote/gas-limit compatibility should be checked before canary.
thread T-0002
severity lowaccepted - R-0073
leakagePct from copy pools is not trustworthy evidence
Any leakage metric derived from copy pools can be inflated by wash trading. Treat it as a hint only, and do not use it to justify promotion.
thread T-0002
severity infoaccepted - R-0072
Canary window can be gamed by timing arbitrage
Arbitrageurs can defer rebalancing to moments when the fee is low, or out of the canary window entirely. That would skew canary revenue and retention readings. Randomize the window boundaries, or run it long enough to cover multiple volatility regimes.
thread T-0002
severity lowaccepted - R-0068
Canary timing and leakage signals
Arbitrageurs can shift flow around a known canary window, and anyone can wash-trade a copy pool to inflate leakagePct. Randomize the canary start and treat leakage only as a hint, cross-checked against real on-chain volume.
thread T-0002
severity lowaccepted - R-0067
No gate results attached
The gates list is empty, so the 90% swap gate that 26000 failed is not confirmed. Retention of -3.97% suggests about 96% of swaps are kept, but the gate must be run explicitly before promotion.
thread T-0002
severity lowaccepted - R-0063
Treat leakage and copy-pool signals as hints only
No leakagePct is supplied, and anyone can inflate one by wash trading a copy pool. Gates are empty, so canary-stage gating must provide the real evidence.
thread T-0002
severity infoaccepted - R-0062
Canary window timing
Arbitrageurs can time trades around a predictable canary start or end, or around a vol regime, to skew results. Randomize or avoid announcing exact window boundaries, and judge results over full vol cycles.
thread T-0002
severity lowaccepted - R-0057
Reverts and module failures clean
candidateReverts 0 and moduleFailed 0 across 4796 swaps. This is acceptable but does not offset the economic uncertainty.
thread T-0001
severity infoaccepted - R-0056
Gas delta of up to 24924 per swap
maxGasDelta is about 25k. This raises the risk of gas starvation for tight router gas limits and aggregator quotes. Router and quote paths need checking under a worst-case calldata/state path.
thread T-0001
severity lowaccepted - R-0051
Retention loss is only partly addressed
The hypothesis claims it avoids the 5.85% retention loss. The -2.26% loss is smaller, but it is a net loss of users for an unproven revenue gain.
thread T-0001
severity lowaccepted - R-0046
Canary timing and governance window
Arbitrageurs can time flow around a publicly scheduled canary start and end, front-running the fee step or avoiding the window to skew metrics. Randomize or avoid announcing exact activation, and keep a timelocked rollback path ready.
thread T-0001
severity lowaccepted - R-0044
Cap headroom is fine; pinning is unlikely at current vol
Fee hits the 32000 cap only at vol ~450, about 2.8x the current 161. capDeltaPct +0.75 is small. Under a sustained wash pump or a real vol shock, fees pin at 3.2%, which may drive routers to alternatives. Monitor atCapPct during the canary.
thread T-0001
severity lowaccepted - R-0040
Gas delta of ~20k per swap needs a router/aggregator check
maxGasDelta is 20114 with 0 reverts and 0 module failures. Even so, aggregators with tight gas estimates may deprioritize or misquote the pool. Verify quoter/router parity and gas limits under worst-case volEma update paths.
thread T-0001
severity lowaccepted - R-0035
Copy-pool leakagePct is not evidence
Any canary leakage figure can be inflated by wash trading a copy pool. Use it as a hint only, and cross-check it against unique-trader and volume attribution.
thread T-0001
severity infoaccepted - R-0034
Low-vol claim is not supported by the replay
The hypothesis says base 22000 plus mult 2000 matches baseline fees when vol is low, yet retention still drops 2.04%. Split the replay results by vol regime to confirm calm-window fees actually match baseline.
thread T-0001
severity lowaccepted - R-0029
No gates recorded
The gates array is empty at candidate stage. That is acceptable for entering canary, but promotion should require recorded gate results: revert rate, atCapPct, ETH/day vs baseline, leakagePct. Treat any leakagePct rise as a hint, not proof, since copy-pool volume can be wash-inflated.
thread T-0001
severity lowaccepted - R-0028
Gas overhead +20142 max per swap
maxGasDelta 20142 with 0 reverts and 0 module failures in sim. Not starvation-level, but routers with tight gas estimates may under-provision. Verify quoter/router gas estimates include the delta, and check revert rates on aggregator paths in the canary.
thread T-0001
severity lowaccepted - R-0024
No gates evaluated
gates[] is empty. Acceptable at candidate stage, but canary promotion should require explicit gates on revenue, retention, atCapPct and gas.
thread T-0001
severity infoaccepted - R-0023
Canary timing exploitable by arbitrageurs
If activation and canary windows are predictable, arbs can shift flow around them and skew the measured ETH/day. Randomize window start, use a sufficiently long window, and compare against a concurrent control.
thread T-0001
severity lowaccepted - R-0022
Gas overhead of ~20k per swap
maxGasDelta is 20142. That can push routers' gas-adjusted quotes toward other pools and worsen retention. Confirm router and quoter gas estimates still fit, and that no path nears gas limits. 0 reverts and 0 module failures across 3982 swaps is reassuring.
thread T-0001
severity lowaccepted - R-0018
No gates defined for this stage
Gates are empty, so pass rests only on sim sanity (no reverts or failures). Canary gates should include revenue and retention floors, a cap-hit ceiling and leakagePct. Treat leakagePct as a hint only, since anyone can inflate it by wash trading a copy pool.
thread T-0001
severity infoaccepted - R-0017
Gas overhead acceptable but nonzero
Max gas delta is 24842 with 0 reverts and 0 module failures over 3884 swaps. Router quotes and gas-limited aggregator paths should be checked for staleness when the fee moves between quote and execution.
thread T-0001
severity lowaccepted - R-0016
Lower base favors arbs in calm windows
Base 20000 is below the mean 23895, so in low-vol periods arbitrageurs pay less, and they can time trades to the periods before volEma rises. Canary should split revenue by arb versus organic flow and by vol regime.
thread T-0001
severity lowaccepted - R-0012
No gates supplied
gates[] is empty for this candidate. Before promotion, the canary stage must define stop conditions on revenue, retention and cap-hit rate, with randomized window timing to blunt arbitrageur window timing.
thread T-0001
severity infoaccepted - R-0011
Gas overhead of ~20k per swap
maxGasDelta 20238 costs routers on marginal routes and may shift aggregator flow, which compounds the retention loss. No reverts or module failures occurred, so there is no starvation risk at the current gas limits. Verify that aggregator quote paths still select the pool.
thread T-0001
severity lowaccepted - R-0010
volEma pumping via wash trades
With mult 2000, an attacker can wash trade to inflate volEma and push fees toward the cap, diverting flow to rival pools. Even at the cap the fee uplift is bounded at about 1%, so the attack is costly relative to its gain. Track any volEma spike that has no matching price-move signal.
thread T-0001
severity lowaccepted - R-0009
Cap is binding, contrary to hypothesis
capDeltaPct 0.68 shows some swaps reach the 33000 cap, contradicting the claim of atCap 0. Pinning at cap during vol spikes concentrates the fee on toxic flow, which is acceptable, but it also invites timing games. Monitor the cap-hit rate during the canary.
thread T-0001
severity lowaccepted - R-0006
No gates evaluated
The gates list is empty. No independent checks on leakage, router quote parity or governance timing were provided for this stage.
thread T-0001
severity lowaccepted - R-0005
Gas delta +25k per swap
A maxGasDelta of 25029 raises the cost for routers and aggregators. It may cause quote/route deprioritization at the margin, compounding the retention loss. No reverts or module failures were observed, which is good.
thread T-0001
severity lowaccepted
Rollbacks
0 rollbacksNone recorded.
Safe overrides
0 overridesNone recorded.
Disclosures
5 disclosures- D-5
Other DNA pools pay DNA nothing
Anyone can open another DNA pool (Uniswap v2, v3, v4 without DNA's hook, or another exchange) and nobody can stop it. Trades there pay nothing to the buyback, liquidity, treasury or games; their fees go to whoever funds them. Wallets and aggregators may route through them, especially before they support DNA's hook. The official pool and every other pool the engine finds are on /trade.
severity infoaccepted - D-1
Not independently audited
Contracts are tested with unit, fuzz and invariant suites and adversarial reviews, but no external audit has been performed.
severity infoaccepted - D-2
Partial fills revert
Swaps that would only partially fill the ETH side revert instead of settling partially.
severity infoaccepted - D-3
LP fee is zero; fees go to the hook
Third-party LPs earn no swap fee in this pool; all fees route through the vaults.
severity infoaccepted - D-4
Platform dependencies
Launched via Programmable (permit signed by their key; Explore and swap route are their off-chain services). No on-chain power over DNA after launch.
severity infoaccepted