Building on-chain infrastructure
for Uniswap V4.

Pays a resting limit-order maker for the price displacement caused by the swap that filled them — measured inside the same transaction, from the pool’s own tick.

• Measured before a line of Solidity — thirty days of Base WETH/USDC, 253,135 swaps. Median displacement came out at 2.00 bps, the same figure from three independent pools and two time windows.
• The threshold is the pool’s own fee, not a tuned constant — a maker filled by an ordinary swap already earned that fee, so below it the hook stays silent and benign flow pays nothing. No special case needed to say so.
• The recipient is the difference — comparable designs return recaptured value to the LP pool at large. Airbag pays the specific maker who was run over, which is only possible because each order is an ERC-721 with an identity.
• No oracle, no keeper, no deferred settlement — one tick is one basis point, so the metric is exact integer arithmetic. Nothing is read at a later block: a future price is a value the filler themselves could write.
• Verified on mainnet to the basis point — a full place → cross → claim cycle on both chains. Each recorded 70 bps of displacement; the charge rule owed 33.50 bps of the maker’s notional and each paid 33.50 bps. Opposite currency ordering, opposite swap direction, same number.
• Two adversarial audit rounds before deploying — eight blockers in the first, two criticals in the second, both introduced by my own fix for the first. The invariant that should have caught them summed the wrong field: the detector was repaired before the defect.
• Limits written down, not discovered in production — three findings stay open by choice, each with the reasoning, in KNOWN-LIMITS.md. The demo pools hold dust and the crossing swaps were mine; the mechanism is proven, the economics need depth.

Turns a passive limit order into a yield-bearing position — and refunds the user for impermanent loss out of the yield it earns.

• Oracle-free IL rebate — impermanent loss derived from sqrtPriceX96 deltas via a 2nd-order Taylor approximation; rebate = min(yield, IL).
• Yield routing — executed output deposited into an ERC-4626 vault until claim: real Aave (waBasUSDC) on Base, a simulated vault on Unichain.
• Orders as NFTs — every order is an ERC-721: composable and tradable on secondary markets.
• O(1) tick scanning — doubly-linked list of active ticks only; cost scales with populated ticks crossed, not range width.
• Anti-DoS execution — failed orders emit and re-queue instead of reverting the swap, with gas metering against OOG.
• Audit-hardened — per-pool order isolation, a per-currency solvency invariant, and a hard trigger-price gate, backed by Foundry invariant tests; scope + threat model documented for external review.
• Security research — graded the vault path against OpenZeppelin's audit of Uniswap Labs' DualPoolHook, and found a medium-severity permanent fund lock: a permissionlessly-poisoned pool baseline overflowed the IL math inside the only exit path for a filled order. Fixed with a saturating cast, proven end-to-end and mutation-verified.

Production limit orders for Uniswap V4 with automated, gas-bounded execution triggered directly inside swaps.

• Self-executing — orders fill in the afterSwap hook as the pool crosses their tick. No keepers, no relayers.
• O(1) tick buckets — doubly-linked list of populated ticks for constant-time lookup during execution.
• Anti-DoS, graceful execution — a failing order never bricks the swap path.
• Bounded gas — 5 BPS execution fee, gas-metered batch execution, 150k gas cutoff per swap.
• Audit-ready — documented scope and invariants for external review.