Repository navigation
the quote ladder priced fees three times and depth not once - #2778
Merged
Merged
Conversation
Aurora asked whether a bridge shields a user from blank liquidity. No quote
API in this harness exposes a price-impact or a warning field, so there is
nothing to read off a single quote. What all eight do expose is an output
amount, and therefore a cost as a share of the ticket, which the harness
already records with an amount_usd label.
The trouble is the ladder. At $5, $50 and $300 the curve only shows a fixed
fee being amortised: debridge costs 62.9% of a $5 ticket and 1.3% of a $300
one, and every bridge falls the same way. Liquidity does not bind anywhere in
that range, so three rungs measured the same thing three times and the
question had no rung at all.
$25,000 is added, to the quote ladder only. The shape of the answer is the
measurement:
cost% keeps falling or stays flat the quote ignores depth and promises a
price the corridor may not fill
cost% turns upward the impact is being priced
no quote returned the provider declines the size, which is
the strongest form of shielding
Three readings off the provider's own number, uniform across all eight,
without parsing eight different error formats.
The meme corridor gets the rung in token units, because TRUMP to BRETT is the
thinnest route here and therefore where the question is sharpest.
Nothing is executed. main.go is untouched; its ladder tops out at $30 of real
money and never sees this constant. A test keeps the two orders of magnitude
apart on purpose.
Two more tests, one of them written because this change introduced the fault
it now catches: the meme route briefly carried four USD labels against three
token amounts, and since the quote loop ranges over the amounts, that corridor
would have dropped out of the depth comparison silently.
Aurora says swaps through Intents are confidential. The bench could neither support nor contest that, because it had no instrument for it, and a property nobody measures is where a benchmark quietly stops being one. This measures the narrowest honest version, and the narrowness is the point. A lock-and-mint bridge takes the recipient as a parameter of its deposit call, so anyone reading the source chain learns the other end immediately. An intent system sends a plain transfer to a one-time deposit address and settles separately, so the same reader learns nothing from that transaction alone. That difference is real, it is what "confidential" means operationally at the source, and it can be read without trusting anyone's description of their own product. Nothing is fetched. The harness builds the transaction it is about to broadcast, so the exact bytes the source chain will record are already in hand. The probe is a byte search for our own destination address in our own outgoing payload: one rule for all providers, no per-bridge calldata parsing, which is the trap that makes this sort of comparison lie. A negative is NOT "the swap is confidential". A solver may publish the link elsewhere, amounts may correlate, timing may correlate, a one-time address can still be clustered. The metric is named for the one thing it reads and the file says so twice. Two silences, both deliberate, both tested. An address or payload we cannot decode publishes nothing, because a zero reads as "this bridge does not disclose" and that is a claim we would not have earned. And a Solana source whose destination is the signing wallet publishes nothing either: that key sits in the serialized message as fee payer whatever the bridge does, so the reading would be about us. No current route hits it, which is exactly why it needs the guard rather than a comment. Wired on the Mobula path only for now, its three broadcast sites. The other bridges take the same one-line call at their own sites; doing them blind, without reading each quote shape, is how the Near Intents polling asymmetry got in.
… a flag Extending the disclosure reading past Mobula turned up the difference I was worried about, in the first bridge I looked at. Relay's Solana path hands over a JSON instruction list whose pubkeys are base58 STRINGS; Mobula's and LI.FI's hand over a base64 serialized message whose keys are raw BYTES. Searching one the way you search the other finds nothing, and finding nothing here publishes "this bridge does not disclose the destination", which is the most flattering thing the metric can say. So the parameter is an explicit payloadKind rather than an isSolana bool. The axis that matters is the encoding, not the chain, and every call site now declares which it is handing over. A bool would have let the next person wire a text payload as serialized and ship a provider an unearned compliment. Six broadcast sites covered: Mobula's three, Relay's two, LI.FI's Solana path. The self-route guard is no longer Solana-only. Reading it again, a destination equal to the signing wallet is unmeasurable on any chain for the same reason, not just where the payer sits in a serialized message. Two more tests. One pins Relay's shape both ways, that a pubkey in the instruction list is seen as text AND that reading it as a serialized message does not quietly return "undisclosed". The other keeps nil instructions rendering to nothing rather than to an empty JSON array, which would have been a measurable-looking payload with nothing in it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Aurora asked whether a bridge shields a user from blank liquidity. No quote API in this harness exposes a price-impact or warning field, so there is nothing to read off a single quote.
What all eight do expose is an output amount, and therefore a cost as a share of the ticket — which the harness already records with an
amount_usdlabel.The ladder could not answer it
Measured on the live endpoint across the three existing rungs:
Every bridge falls the same way. That is a fixed fee being amortised, not liquidity binding. Three rungs measured the same thing three times and the question had no rung at all.
The fix
$25,000, on the quote ladder only. The shape of the answer is the measurement:
Three readings off the provider's own number, uniform across all eight, without parsing eight different error formats.
The meme corridor (TRUMP → BRETT) gets the rung in token units: it is the thinnest route here and therefore where the question is sharpest.
Nothing is executed
main.gois untouched. Its execution ladder tops out at $30 of real money and never sees this constant — confirmed by an empty diff on that file. A test keeps the two three orders of magnitude apart on purpose, so the day someone wires them together it fails rather than signs.Two more tests
One written because this change introduced the fault it now catches: the meme route briefly carried four USD labels against three token amounts, and since the quote loop ranges over the amounts, that corridor would have dropped out of the depth comparison silently.
go build,go vet,go testall clean.