mirror of
https://github.com/luxfi/dex.git
synced 2026-09-24 00:26:31 +00:00
zeekayandHanzo Dev
247b110b9d
The C matcher takes the book pointer and the indices but no book LENGTH, so it cannot bounds-check, and the Go wrapper did not either. MatchOrderCPU guards the same field because indices genuinely can be out of range — one field, two readers, one guard. On a real Metal device that wrote past the end of a Go slice and answered 420 where the oracle answered 490. An empty book is the same hole from the other side: &book[0] panicked where the CPU path returned cleanly, so one build was total and the other fatal on identical input. Both cases hand off to the oracle rather than restate its bounds rule here; a second copy of a bounds check is a second chance to get it wrong. The shadow gate gave every market order the MAXIMAL price, "so it crosses every resting level". That is true for a market BUY, which sits on the bid and crosses any ask at or below it. A market SELL sits on the ask and crosses any bid at or above it, and no bid is ever above +inf — so every market sell matched nothing, compared empty against empty, and was counted VERIFIED. The mechanism the GPU path is assured by was measuring nothing for an entire order type, while an operator watched Verified climb and Divergences stay at zero. Co-authored-by: Hanzo Dev <[email protected]>