mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
53a476db38
Four papers had been written but never committed, and INDEX.md already listed
some of them — so the index pointed at files that did not exist in the repo.
Adds:
- sovereign-exchange/ (tex + pdf)
- lux-growth-round/ (tex + pdf)
- lp-310-universal-liquidity/sections/ — five section .tex files that the
paper \input{}s, so the top-level tex could not build without them
- built PDFs for fee-settlement, lp-208-dag-mempool, lp-310, lux-aivm
PDFs are tracked here by convention: 172 were already committed alongside 1,648
.tex sources, and the ignore rules only exclude the separate pdfs/ directory.
Each of the four has its matching .tex in the same directory — verified, not
assumed.
LaTeX build artifacts (.aux .log .out .toc .fdb_latexmk) stay ignored; nothing
outside .tex/.pdf/INDEX.md is staged. No .md anywhere in the new papers —
papers are LaTeX.
91 lines
4.6 KiB
TeX
91 lines
4.6 KiB
TeX
\section{Security}
|
|
\label{sec:security}
|
|
|
|
Universal Liquidity composes several trust boundaries --- an on-chain
|
|
settlement contract, an off-chain market maker, a router that decides
|
|
before it settles, and cross-chain aggregation. This section states the
|
|
threat model and shows how each attack the composition invites is closed by
|
|
a mechanism already introduced.
|
|
|
|
\subsection{Threat model}
|
|
|
|
We assume an adversary who can (C1) observe every pending transaction and
|
|
every public quote; (C2) submit transactions at arbitrary size and fee, and
|
|
influence ordering up to the consensus Byzantine bound; (C3) operate as, or
|
|
collude with, a market maker; and (C4) run flash-loan capital. We do
|
|
\emph{not} assume the adversary can forge signatures (ECDSA/BLS/ML-DSA-65),
|
|
break the AMM invariant, or violate the atomicity of a single transaction.
|
|
|
|
\subsection{Front-running and the free option}
|
|
|
|
A naive RFQ leaks a free option: if the \emph{user} signs and the maker
|
|
chooses whether to fill (``last look''), the maker fills only when the
|
|
market has moved in its favor and walks otherwise, and an observer can
|
|
front-run the pending fill. Universal Liquidity closes both:
|
|
|
|
\begin{itemize}[leftmargin=1.4em]
|
|
\item \textbf{The maker signs, not the user} (\S\ref{sec:rfq}). ``You
|
|
will receive $y$'' is the maker's cryptographic commitment, enforced by
|
|
the on-chain settlement predicate. The maker cannot renege on a fill the
|
|
user chooses to take within the quote's life.
|
|
\item \textbf{Short, on-chain-checked expiry.} The quote is valid only
|
|
until a block-timestamp bound the contract verifies. The free-option
|
|
window is bounded to the quote lifetime, and the spread (\S\ref{sec:rfq})
|
|
prices that residual exposure explicitly (Theorem~\ref{thm:nooption}).
|
|
\item \textbf{Off-chain decision.} Because best execution is resolved
|
|
before the transaction is built (Router Law, \S\ref{sec:router}), there
|
|
is no in-flight price comparison in the mempool for an adversary to
|
|
sandwich.
|
|
\end{itemize}
|
|
|
|
\subsection{Atomicity and partial-fill attacks}
|
|
|
|
The all-or-nothing property (\S\ref{sec:router-atomic}) is a security
|
|
property, not just a UX one. Without it, a split fill could be attacked by
|
|
causing one leg to fail after another settled, leaving the trader
|
|
mispriced. With single-transaction atomicity, every leg's predicate is
|
|
checked and every leg moves in the same block, or none does. A router that
|
|
composes native and signed-quote legs is therefore no more attackable than
|
|
a single-source fill.
|
|
|
|
\subsection{Inventory double-spend}
|
|
|
|
A PMM that signs two quotes against the same inventory and has both settle
|
|
would be over-committed. The inventory-reservation mechanism
|
|
(\S\ref{sec:rfq-inv}) makes a signed quote consume a reservation that the
|
|
settlement predicate checks, so a given unit of maker inventory backs at
|
|
most one settleable quote at a time. Over-commitment is prevented on-chain,
|
|
not by the maker's honesty.
|
|
|
|
\subsection{Reference-price and oracle manipulation}
|
|
|
|
The PMM prices against external reference venues; an adversary who can move
|
|
that reference (thin external market, flash-loan-funded push) can skew the
|
|
quote. Two bounds contain this: the maker owns its spread and widens it when
|
|
reference confidence drops, and the router never routes to the PMM when the
|
|
native (manipulation-resistant, on-chain-reserve) price is better --- so a
|
|
manipulated PMM quote loses to the native floor rather than executing. The
|
|
native AMM/book legs are priced by on-chain state and are not oracle-dependent.
|
|
|
|
\subsection{Non-custodial settlement and pre-trade privacy}
|
|
|
|
Two platform properties reinforce the protocol. First, settlement is
|
|
\emph{non-custodial}: legs move under the dealerless threshold-MPC custody
|
|
of the underlying L1, so no router, maker, or venue operator ever holds
|
|
material sufficient to move a trader's assets unilaterally --- the exchange
|
|
coordinates a threshold, it does not take custody. Second, where an operator
|
|
enables it, order intent can be submitted encrypted and decrypted only at
|
|
block construction (the encrypted-mempool path), removing the pre-trade
|
|
information leak that funds front-running at the source rather than merely
|
|
bounding it.
|
|
|
|
\begin{property}[Composition safety]
|
|
Under the threat model above, a universal fill is safe against
|
|
front-running (maker-signed, off-chain-decided), free-option extraction
|
|
(short on-chain expiry, spread-priced), partial-fill manipulation
|
|
(single-transaction atomicity), inventory double-spend (on-chain
|
|
reservation), and reference manipulation (native floor dominates a skewed
|
|
quote). Each guarantee reduces to a mechanism enforced on-chain, not to the
|
|
honesty of an off-chain party.
|
|
\end{property}
|