Repository navigation
[DeFi][FIN-08][M4] Enforce shared-payment allocation and bounded multihop routes #58
Description
Split acceptance: independent pool routing versus order allocation
Plain-English distinction. Routing a swap across two genuine pools is a useful AMM operation on its own. It must not wait for an order-book implementation. Combining multiple orders into shared payment outputs adds a separate obligation-accounting problem and may require the settlement work in #57.
| Track | Preconditions | Minimum executable acceptance |
|---|---|---|
| A — Pure pool-to-pool routes | #54 for constant-product pools, #65 for authenticated cross-tick pools; exact pool/asset identity and selected fixed bounds | One atomic transaction with two distinct pools, authentic intermediate asset conservation, both amount modes, actual all-group verification; no order script required |
| B — Shared-order allocations | #57 order/pool settlement + frozen D11 allocation rules | Multiple genuine orders using one shared output cannot duplicate payment credit, omit an obligation or substitute a recipient |
| C — Layout and unrelated-cell variants | Selected A or B plus frozen D12 layout/cardinality rules | Correct accepted permutations and rejection of omitted/duplicated/foreign Cells, fee/change interference and witness rewrites |
The router must distinguish exact-output completeness from a pool swap that terminates early at a price boundary. For sequential logical pool interactions, specify final netted asset flow without pretending that a freshly created transaction output can also be consumed as an input in the same CKB transaction. Repeated use of one pool requires a separately accepted ordered-transition transcript (#66/#75), not a free extension of C3.
flowchart TD
P["Authentic pool A + pool B"] --> R["Bounded pure AMM route"]
R --> V["Verify intermediate asset flow and limits"]
O["Authenticated orders + #57 settlement"] --> A["Shared payment allocation"]
A --> C["Check every obligation exactly once"]
V --> T["All required CKB Script groups accept"]
C --> T
Implementation ownership: financial route selection and obligation allocation remain protocol/builder work; a generic transaction selection deficiency belongs in a separate business-neutral runtime issue with a minimal failure case. This section clarifies the original C1–C4 programme; it does not claim these newly separated tests have passed.
Implementation ownership — protocol-first, no finance-specific compiler feature
Primary implementation layer: settlement protocol + off-chain routing/transaction builder. Shared-output credit accounting and multihop pricing are author-defined financial rules, not special route/allocate syntax, hidden codegen invariants or an implicit general router in CellScript.
Implementation shape: define a finite allocation representation and enforce, in application Scripts, complete obligation coverage and that credited amounts do not exceed the authentic shared payment output. For a bounded multihop route, assemble distinct, exact-known pool transitions in the same final transaction and check intermediate asset conservation; builders choose and encode the route, while on-chain Scripts verify relevant quantities and identities.
General-runtime boundary: first use existing fixed/bounded typed transaction views and closed-role composition. Open #49 (heterogeneous Cell selection), #48 (nested dynamic codec) and #47 (bounded Map/Set) are conditional general-purpose dependencies, not implicitly required by this issue. Escalate a minimal failing shape and a business-neutral contract separately, rather than creating a finance-specific compiler primitive.
Compiler-change gate (all FIN work): This issue does not authorise finance-specific grammar, IR, opcodes, codegen branches or hidden protocol semantics. First try existing general CellScript constructs. Any genuinely missing general capability needs a minimal failing application, a non-financial use case, its own narrow issue and independent checker/ABI/resource/gate acceptance as required by #43 §2.2. Application correctness and builder convenience are distinct from language support.
Umbrella: #43 FIN-08/M4. Owner roles: settlement protocol + generated builder; reviewer unassigned. Status: proposed.
Dependencies
- Track A, pure pool routing: [DeFi][FIN-04][M2] Complete constant-product AMM/LP lifecycle with generated builders #54 FIN-04 accepted exact-pool execution; [DeFi][FIN-15] Bounded cross-tick swaps with exact-input and exact-output settlement #65 FIN-15 when the route crosses concentrated-liquidity ticks. This track does not depend on [DeFi][FIN-06][M3] Implement escrowed partial-fill orders and cumulative rounding #56 FIN-06 orders or [DeFi][FIN-07][M3] Settle an order against an AMM with enforced asset flows #57 FIN-07.
- Track B, shared-output order settlement: [DeFi][FIN-07][M3] Settle an order against an AMM with enforced asset flows #57 FIN-07 accepted one-order/one-pool settlement is a hard prerequisite for multiple orders and shared payment allocations.
- All tracks reuse [Architecture][Builder] Add an artifact-only multi-Script ProtocolBundle #9/[Language design] Model typed cross-Script transaction roles without runtime linkage #10/[Language/ABI] Bind runtime Script values to verified package interfaces #11 exact-role composition; ordinary general [0.33][Runtime] Add bounded allocation-backed value collections and deterministic Map/Set #47/[0.33][ABI] Support bounded nested dynamic values with canonical codecs #48/[0.33][Runtime] Extend bounded Cell selection and correspondence for heterogeneous and dynamic data #49 are conditional only when a concrete supported shape demonstrates a missing mechanism.
- Freeze [DeFi][Application/Protocol] EVM-class finance on CKB with CellScript #43 D11 (aggregate allocation model) and D12 (numeric route/batch/pool/Cell bounds) after bounded pilot measurements.
- [0.33][Runtime] Extend bounded Cell selection and correspondence for heterogeneous and dynamic data #49 general heterogeneous Cell selection, [0.33][ABI] Support bounded nested dynamic values with canonical codecs #48 nested codecs and [0.33][Runtime] Add bounded allocation-backed value collections and deterministic Map/Set #47 local Map/Set are conditional supporting tracks, not automatic hard dependencies. For any admitted shape needing an unavailable general primitive, document a minimal failing case and open/link a business-neutral issue. Exact closed roles suffice for the initial portfolio.
- Unblocks FIN-09 final contention/rebuild suite and FIN-10 independent final reproduction.
Scope
- Implement [DeFi][Application/Protocol] EVM-class finance on CKB with CellScript #43 C2: multiple orders with explicit shared outputs. For each obligation i, output o and asset a, the real on-chain participants must bind
allocation(i,o,a)to recipient, identity, ordered output and amount. Every obligation is fully covered and the same paid amount cannot be credited twice. - Implement C3: bounded multihop route through distinct pools, each used at most once per transaction. Bind each intermediate asset amount exactly between successive pool transitions with no unaccounted mint/burn.
- Implement C4: bounded coexistence of routes/obligations with unrelated Cells and supported layout permutations; freeze canonical ordering or equivalence policy before acceptance.
- Couple application enforcement, generated builder allocation/routing, and ProtocolBundle all-group preflight to the same final canonical transaction. Reject hostile builders omitting their optional prechecks.
- Define exact limits on pools, orders, outputs, allocation entries, witnesses, byte sizes and cycles. Show how asset totals are deduplicated and computed safely without requiring an unbounded Map/Set.
Acceptance
- D11/D12 and precise C2–C4 admitted shapes, numeric and transaction budgets, canonical permutation rules, recipient/identity/fee/capacity bounds accepted before final validation.
- Successful C2 shared-output multi-order settlement and C3 distinct-pool multihop transactions run with all required Script groups and authentic token/pool/order state; C4 realistic unrelated-Cell/layout cases included.
- Duplicate payment credit, omitted obligation, aggregate underpayment, wrong recipient, wrong asset, missing/interposed intermediary, same pool reused, invalid output permutation, excessive batch and state/fee/change confusion each reject at intended boundary.
- Independent model verifies per-obligation and aggregate conservation and ordering, avoiding output-value double counting; builder/checker/CKB-VM/actual node evidence keeps each layer separate.
- Publish source/ELF/dependency/transaction identities, paired economic evidence, max valid and late-invalid resources, checker mutations, passing applicable gates and review disposition.
Non-goals: unrestricted router/path optimiser, MEV resistance, general CLOB, stablecoin integration, dynamic compatible-open roles or generic oracle access. Source: #43 §§9–12.
Dependency cross-links (confirmed GitHub issues)
Hard dependency for shared-order allocation (Track B): #57 FIN-07. Independent pure-pool routing (Track A): #54 FIN-04, and #65 FIN-15 for ranged pools; orders are not prerequisites. Additional freeze: #43 D11/D12 before C2–C4 acceptance. Required by: #59 FIN-09 final recovery/benchmark suite and #60 FIN-10 independent final acceptance. #47/#48/#49 are conditional general-language tracks, not implicit dependencies.
Umbrella dependency graph and authoritative financial acceptance: #43.
Activity