fix(pair): bound hybrid book leg in the no-belief slippage path (#273) #746

Merged

Brouie merged 1 commit from qa/273-hybrid-noblief-slippage-floor into main

2026-06-04 08:09:30 +00:00

Brouie commented

2026-06-04 06:10:11 +00:00

(Migrated from gitlab.com)

A hybrid swap with no belief_price whose book leg fills materially worse than the pool fair rate was accepted — the no-belief metric measured only the pool leg's spread, so book degradation only enlarged the denominator. Folds the book leg's shortfall vs the pool's realized net rate (pool_net_return/pool_input) into the spread numerator.

Direction 1 only (non-breaking; no Swap schema change). Net-vs-net avoids false-rejecting a book that's only short by its own fee. Meets AC1/AC2/AC3. Formula chosen via an adversarial design pass; PoC drain → reject (0.83), legit hybrid → pass (0.0036), pool-only → #197 byte-identical.

Directions 2 (min_return) + 3 (mandatory belief/min_receive, the pure-pool_input==0 case) are flagged on #273 as the frontend/router-coordinated follow-up — making the guard mandatory would break book swaps in the dapp until the frontend sends a floor.

Tests: PoC hybrid_no_belief_book_far_below_pool_rejected (fails pre-fix) + 2 max_spread unit tests. Suite 415/0.

GitLab #273

A hybrid swap with no `belief_price` whose book leg fills materially worse than the pool fair rate was accepted — the no-belief metric measured only the pool leg's spread, so book degradation only enlarged the denominator. Folds the book leg's shortfall vs the pool's realized **net** rate (`pool_net_return/pool_input`) into the spread numerator. Direction 1 only (non-breaking; no `Swap` schema change). Net-vs-net avoids false-rejecting a book that's only short by its own fee. Meets AC1/AC2/AC3. Formula chosen via an adversarial design pass; PoC drain → reject (0.83), legit hybrid → pass (0.0036), pool-only → #197 byte-identical. Directions 2 (`min_return`) + 3 (mandatory belief/min_receive, the pure-`pool_input==0` case) are flagged on #273 as the frontend/router-coordinated follow-up — making the guard mandatory would break book swaps in the dapp until the frontend sends a floor. Tests: PoC `hybrid_no_belief_book_far_below_pool_rejected` (fails pre-fix) + 2 max_spread unit tests. Suite 415/0. GitLab #273

Rows
Columns