Trading never stops
Every failure mode of the fee machine, and why none of them can ever touch a swap.
One rule outranks every feature in the fee machine: a swap must land no matter what. Every mechanic in this section — the split, the payouts, the burn, the compound — is built to fail sideways, never backwards into the trade that carried it. This chapter is the complete inventory of how.
Why this is a hard requirement, not politeness
A hook that can revert swaps is a denial-of-service surface: one broken recipient could freeze a pool's trading, and one adversarial token could hold every trader hostage. It is also a routing death sentence — aggregators simulate before they route, and a pool that ever reverts on them silently drops out of every route. So the design treats "the machine can never block a trade" as a safety invariant, enforced structurally, not as error handling sprinkled on top.
The inventory — every surface, every failure, every landing
| surface | what can go wrong | what happens instead of a revert |
|---|---|---|
| auto-harvest | a heavy token, a gas-expensive run | runs in its own frame under a hard gas budget; exceeding it reverts atomically inside that frame — fees stay pending, nothing is half-split, the swap completes; the manual path picks it up |
| the compound mint | a mint that would revert or over-consume | isolated frame with a strict budget check — any failure leaves the whole budget in the carry, retried next harvest; the harvest itself never blocks on it |
| recipient payouts | a reverting receive(), a blocklist, a gas guzzler | bounded-gas push; a refusal books the identical amount as owed — folds into the next push, claimable any time with full gas |
| the burn cascade | a fake burn(), a blocklisted dead address | verified probes fall through — burn → 0xdEaD → held-forever custody; every landing is out of circulation, none reverts the harvest |
| pot fuel (buybackShare) | — | an internal balance credit on the hook itself; there is no external call to fail |
| the pump (buy side) | pool state that would revert the buyback | try/catch self-call — the pump is skipped, the buyer's swap lands untouched |
| the shield (sell side) | empty pot, unconfigured pot, a leg rounding to zero | quotes zeros and steps aside — the sell executes through the pool as a normal swap |
| pot deliveries | a hostile pot recipient | native pushes carry a 30,000-gas stipend; a refusal parks the amount, retryable by anyone via flushDirect |
The pattern behind all eight rows
Every row is the same three-part shape. Isolate: anything that can fail runs in its own frame (a self-call, a bounded push, a gas budget), so a failure's blast radius is that frame alone. Book, don't lose: the failed value lands in a named ledger — pending fees, the carry, the owed ledger, the parked ledger, the held ledger — each one a term of obligationOf, each one covered by custody at all times. Retry permissionlessly: the next harvest, the next push, a claim, a flushDirect — someone with an incentive can always finish the job later, with their own gas and no special role.
Compose every failure at once — hostile recipients on both sides, an unburnable token, a carry that never fits, an empty pot — and the result is a pool that trades exactly like a hookless Uniswap pool, with value parked in ledgers waiting to be claimed. Misconfiguration wastes its own opportunity; it never taxes, delays or blocks a trader.
What this means for a trader, concretely
The machine adds no new revert path to a swap: no token behaviour, no configuration, no recipient and no pot state can make a trade fail that would have succeeded on a vanilla pool. The only overhead a trader ever carries is bounded gas — the pump's inline execution and an occasional auto-harvest under its budget — and the minimums exist precisely so the program tunes that cost consciously (see How harvesting works). Trade-side guarantees like "the shield pays pool-exact" are proven wei-exact in the test campaign.
FAQ
What is the worst a broken config can do?+
Nothing to traders. Every fee-machine failure is contained: the harvest reverts atomically (fees stay pending) or a delivery books to a ledger — the carrying swap lands either way.
What if the auto-harvest runs out of gas?+
The in-swap harvest runs under a budget; blowing it reverts the harvest alone, atomically. Pending fees stay safe and anyone entitled can run harvest(key) manually with full gas.
Can a hostile recipient block harvesting?+
No — a refusing recipient's amount books to the owed ledger and everything else settles normally. The hostility only hurts the hostile party's own payout timing.
Can a re-entrant token attack the machine mid-swap?+
State-bearing entries sit behind a transient-storage guard: a re-entering call bounces while the frame is live. The adversarial suite proves the swap still completes.
Why try/catch instead of letting errors bubble?+
Because the hook runs inside OTHER people's swaps. An error that bubbled would let any weird token or recipient grief every trader in the pool — so failures are absorbed, booked, and retried instead.