Pump — the buyback

On a SECONDARY → MAIN buy, afterSwap makes the pot buy more main inside the buyer's own transaction and hands it to the recipient. The sizing rule is one line — and that one line is the entire anti-sandwich model.

Nothing in that line is hardcoded to a pool shape: fee·depth is computed live as the pool's current swap fee times its tangent reserve at the live price — so a deeper pool or a fatter fee tier earns a proportionally larger pump, automatically. And userIn is the measured secondary leg of the buyer's own swap delta, not a re-quote — a dust buy can only ever unlock a dust pump, and the pot follows real demand instead of emptying all at once.

A buy, step by step

Why it can't be sandwiched — the actual math

The sandwich shape: an attacker opens with a buy of size X to summon the pump, the pump of size V lands behind it, and the attacker closes by dumping the bag into the price bump they financed. Model the pool as depth R (the tangent reserve at the live price) with fee f. To leading order:

The attacker's size cancels out of the inequality — so one single bound on the pump's spend closes the attack for every attacker size, pot depth and price at once. The hook caps the pump at f·R and then takes only 80% of it, putting the realised spend at 0.8·f·R — strictly inside the break-even. No cooldown, no per-swap state, no reference price. This is proven at sizes from dust to pool-scale in the test campaign (test_A2), and it is exactly why a zero-fee pool never pumps: with f = 0 the ceiling is zero, and the design refuses to host a sandwichable buyback.

Intuition for the same thing: forcing a bigger pump requires a bigger real buy, which pays the pool's fee and impact twice — and the haircut means the pump moves the price by less than the attacker paid to trigger it. The "attack" is self-financing a donation to the pool's LPs, while the pot gets its tokens at market price either way.

The 80-cent theorem

Push the derivation one step further and the haircut turns into a statement you can quote: substitute the hook's actual spend V = 0.8 · min(f·R, X) into the profit formula and divide by the fee bill —

Every sandwich round-trip against the pump recovers at most 80 cents of every fee dollar it pays — a guaranteed loss of at least 20% of the fee bill, at every attacker size, every pot depth, every price, before gas. There is no size to optimize toward: the ratio is flat at 0.8 for everyone big enough to hit the cap, and strictly worse below it.

Worked numbers & the impact ceiling

R is the tangent reserve: the reserve an equivalent constant-product pool would show at the pool's live price and liquidity (L·√P on the secondary side). With it, everything above becomes concrete:

That last line is the second theorem hiding in the sizing rule: on any pool, the pump's price move is bounded by 1.6× the fee tier — 0.48% on a 0.30% pool, 1.6% on a 1% pool — per buy, no matter how large the pot is. The pot expresses itself as a steady stream of small, fee-bounded buybacks riding real demand, not as one visible candle a bot can hunt.

Quoting a pump

quotePump mirrors the live decision against current pool state — a UI, a bot or a test can preview the machine without executing a swap. The live pump enforces minOut on itself: if execution would deliver less, it abandons the round (QuoteMismatch semantics) rather than overpay.