Edge cases and attack surface

A mechanism is only as good as its behaviour on a bad day. This page goes through the cases the design already answers, then lists the attack surface, including the parts that are still open. Open questions are marked as open.

Halt mid-session#

What happens. When the market status reports a halt in the stock, three things change. Duties are suspended, because the oracle no longer carries a tradable reference price. The fee cap is raised, so the regent can widen the fee while the pool trades blind. When trading resumes, a new bell window opens: for the first 20 seconds after the resumption, only the regent can swap.

Why it is safe, and what remains open. A halt resumption is the same event as an opening bell: the stock reopens at a new price and the pool is stale. The regent bought the session, including whatever happens inside it. Suspending duties avoids slashing a regent against a price that does not exist.

Open: how a single-stock halt and its resumption are detected on-chain. The draft assumes the Chainlink market status reports both. If the signal is late, the bell window opens late.

Sequencer downtime#

What happens. If the Robinhood Chain sequencer stops, nothing moves: no swaps, no bids, no rent. Rent is accounted per second, so the seconds of downtime are seconds the regent paid for and could not use. The unstreamed rent for that period is refunded to the regent pro rata.

Why it is safe, and what remains open. LPs were not traded against during the outage, so they give up rent for a period in which the seat was worth nothing. Open: how downtime is measured on-chain, and what happens to an auction whose closing window falls inside an outage. The design also defines no bell window for a sequencer restart, although the pool price may be stale at that moment.

Auction collusion#

What happens. Bidders could agree not to compete, so that one of them takes the seat at the reserve.

Why it is safe, and what remains open. The auction is permissionless, open and ascending. Anyone who locks the bond can bid, and every bid is public. A cartel has to include every capable bidder, for every session, indefinitely. One honest bidder is enough to break it, because a seat sold below its value is a profit opportunity for that bidder. Meanwhile the reserve sets a floor: 50% of the median of the last 10 winning bids for that session type.

The worst case is low rent. LPs in a pool with no auction receive no rent at all for the same leak. Open: the reserve follows past winning bids, so a cartel that holds for many sessions would pull the floor down with it.

A dominant LP bidding on its own pool#

What happens. An LP that owns most of a pool's liquidity bids for the seat. If it wins, most of the rent it pays streams back to itself.

Why it is safe. This is neutral. The LP pays itself for the right to rebalance its own position. It does not get the seat for free: it still pays the 10% protocol cut on the full bid, and every other LP still receives a pro rata share of the rent. It has no special standing in the auction. If the seat is worth more to someone else, that bidder can outbid it, and the dominant LP collects rent instead.

New pools only#

What happens. In Uniswap v4 the hook is fixed at pool creation. An existing $NVDA/USDG pool cannot adopt Regent. Regent pools are new pools and start with no liquidity.

Why it matters, and what remains open. This is a cold start problem, not a safety problem. The pitch to LPs is rent paid in advance: before each session starts, the winning bid is already in escrow and the rate per second is known. Whether that is enough to move liquidity is open, and only real auctions can answer it. Rent depends on auctions and can be zero. A thin pool also makes a less valuable seat, so early sessions may go unsold and fall back to the fail-safe.

Attack surface#

Oracle manipulation or staleness#

Duties only apply when the Chainlink tokenized-equity feed is fresh and the market status is open. A stale feed switches duties off. It does not slash anyone. The residual risk is a feed that is fresh and wrong during DAY: it could slash an honest regent or excuse a negligent one. The oracle never moves LP funds and never sets the pool price. Its reach is limited to the regent's bond.

Calendar errors#

A wrong calendar would open a bell window at the wrong time or apply duties while the market is shut. The planned SessionClock is cross-checked against the Chainlink market status, and the holiday calendar is governed so it can be corrected. Daylight saving transitions, holidays and 13:00 early closes are covered by tests in the reference logic. Open: what the hook should do for the rest of a session when the calendar and the market status disagree. See Sessions and the calendar.

Griefing through anti-snipe extensions#

A bid in the last 60 s extends the auction by 60 s, so a griefer could try to keep an auction open. Two things bound this. Extensions stop at the hard close, 2 min before the session starts, so the session is never delayed. And each extension needs a valid bid, at least +5% over the standing bid and paid upfront. The cost compounds, and a griefer left holding the top bid pays it to the LPs.

JIT liquidity#

Someone could add liquidity just before rent is distributed and remove it just after. Liquidity removed less than 30 min after being added forfeits its accrued rent back to the pool, where it goes to the LPs who stayed. In the reference logic, topping up a position restarts its clock. Liquidity that stays longer receives rent like any other. See Rent streaming and anti-JIT.

Executor compromise#

The regent swaps through a registered executor contract. If it is compromised, the attacker holds the seat rights for the rest of the session: fee-free swaps, fee setting inside the bounds, the bell window. That is the regent's loss. The executor has no custody of LP funds, so LPs face nothing worse than a hostile regent, which the fee bounds already assume. Open: whether a regent can rotate its executor mid-session.

Spam calls to poke#

poke() is permissionless and pays the caller 10% of the slash. With no pending breach-seconds there is no slash, so there is no reward, and the caller has only paid gas.

Governance capture#

Stakers govern the fee bounds, the bell window length, the tiers and the holiday calendar. A captured vote could raise fee caps, lengthen the bell window, set bond tiers that exclude honest bidders, or corrupt the calendar. None of these parameters gives governance custody of LP liquidity. Open: the voting process, quorum, timelocks and whether contracts are upgradeable. None of this is designed yet.

Reserve ratchet#

A reserve computed from past winning bids could lock a pool out: one overheated auction raises the reserve, nobody meets it, the seat goes unsold. Two things limit this. The reserve uses a median over 10 sessions, so a single outlier barely moves it. And it is only 50% of that median, so it sits below recent clearing prices and can fall as well as rise as lower winning bids enter the window. Open: unsold sessions add no winning bid, so a reserve left too high after a lasting drop in seat value does not correct itself. A decay rule or a governance override may be needed.

The planned contract boundaries behind all of this are in Architecture and contracts.