Shield — sell defense
Sells absorbed at the pool's exact price: the seller is indifferent, the price doesn't move.
On a MAIN → SECONDARY sell, beforeSwap lets the pot absorb the sell at the pool's exact execution price — LP fee and tick impact included. The seller receives precisely what the pool would have paid; the pool's price simply does not move; the absorbed main goes to the recipient instead of the curve.
A sell, step by step
Technically: the shield does not invent a price. It quotes the fill with the identical arithmetic the PoolManager itself runs when it executes a swap (a thin wrapper over Uniswap's own computeSwapStep), against live slot0 and liquidity. It then returns a BeforeSwapDelta that shrinks the pool leg by exactly (absorbed, paid): the pot takes the main, settles the secondary, and the pool's reserves and price are untouched — the supply the pot absorbed never reaches the curve. A thin pot absorbs its affordable prefix and the remainder executes as a normal swap in the same call — partial defense, zero seller friction.
The test campaign proves this wei-exact: a hooked pool and a hookless twin (same currencies, fee, price, liquidity) pay a seller identical amounts across sell sizes, and a fully-absorbed sell leaves the pool's price bit-identical (invariant PP3).
Why it can't be played
The shield's fill price IS the pool's execution price, read live. Moving spot inside your own transaction moves your own fill with it — there is no oracle, no TWAP, no gap to arbitrage.
Consider the alternative to see why this matters: a pot that filled at spot (no fee, no impact) would be strictly better than the pool — so an attacker would pump spot up inside their own transaction and dump into the pot at the inflated price. Pricing at execution removes that edge with no oracle and no TWAP: the audit's manipulation test pushes the price up first and the shield still pays exactly what the (manipulated) pool itself would have paid — never a wei more.
Because the shield never pays above the pool's own price, selling into the pot is never better than selling into the pool. The pot cannot be drained at a discount — it can only ever buy at the market's own terms. Three more mechanical guards: the shield never pays more than the pot holds, never absorbs more than the seller offered, and never settles a one-sided fill (if either leg rounds to zero the swap simply goes to the pool).
Fee-on-transfer or rebasing MAIN tokens should be wrapped before pooling: the shield's pool-exact settlement assumes the main that leaves the PoolManager is the main the hook receives. (A fee-on-transfer secondary is fine — donations credit what actually arrived.)
The math of absorption
Model the pool locally as its tangent constant-product reserves (x, y) at the live price (x = L/√P of main, y = L·√P of secondary), fee f. A sell of s main pays out along the curve:
The shield pays exactly quote(s) — computed by the identical computeSwapStep arithmetic, tick-precise where the constant-product sketch above is the intuition. Seller indifference is therefore an identity, not an approximation: payout_shield(s) ≡ payout_pool(s), wei-exact, proven against a hookless twin across sell sizes.
Partial absorption — the price only sees the overflow
Because the pool leg of a partial fill starts from an un-moved price, the seller's blended payout is never worse than the hookless pool — marginally better, in fact, which is the one bounded economic surface a self-sandwicher can rent (written up honestly as GH-1, posture 3: bounded by the pot's affordability, fair-priced for the pot in every posture).
What the shield achieves economically
Absorbed supply never reaches the curve: the sell that would have pushed the price down is converted into pot inventory delivered to the recipient (or burned). For holders this reads as downside doing less damage while the pot lasts; for the seller nothing changes at all. The pot is a bid wall that costs nothing to cross and cannot be spoofed — it pays out exactly at market.
Quoting the shield
Returns zeros when the pot is unconfigured, empty, or the direction isn't the shielded one — safe to call blindly from UIs and routers.
FAQ
What does the seller actually get?+
Exactly what the pool would have paid — the pool's execution price with fee and tick impact included. The seller can't tell the shield exists; only the pool's reserves notice.
Why doesn't the price move on a shielded sell?+
The pot absorbs the sell in beforeSwap: it takes the MAIN being sold and pays the secondary the pool would have paid, so the curve itself never processes the sell.
What if the sell is bigger than the pot can absorb?+
The shield absorbs what it can afford and the remainder executes against the pool normally. Defense degrades gracefully — it never blocks or reverts the trade.
Where does the absorbed MAIN go?+
Same as a pump's output: through the buyback split — compound share into liquidity, burn share through the cascade, the rest to the recipient.
Can I preview the shield before selling?+
Yes: quoteShield(key, sellSize) returns what would be absorbed and what the pot would pay, as a view — UIs and contracts can read the defense before acting.