Risk & known gaps

This code is unaudited and has never held value. What follows is the list of things that could go wrong and have not been ruled out — stated here rather than left for a reader to discover.

Known gaps

• No independent audit. Reentrancy through donate and cross-swap fee manipulation via the tick recorded in afterSwap have been reasoned about and partially mutation-tested, but not reviewed by a third party.
• The deviation cap is reasoned, not calibrated. Its bound comes from tick-space reasoning about the gap between real volatility and order-of-magnitude feed errors, not from fitted feed-failure data. It catches gross errors, not a subtly wrong value inside the tolerance.
• No L2 sequencer uptime check. Analysed and accepted: the aggregator cannot update while the sequencer is down, so the existing staleness check fires and the pool over-charges rather than under-charges. The residual cost is a window of ceiling-priced swaps after a restart.
• Aggregator circuit breakers unchecked. Non-binding on the deployed feed, where the bounds are sentinel defaults orders of magnitude outside any reachable price. Would need revisiting against a different feed.
• The capture share's elasticity is bounded, not measured. See the mechanism page.

Anticipated attacks