Impact protection for limit orders. It pays a resting maker for the price displacement caused by the swap that filled them — and, like a real airbag, it only deploys on impact.
You place an order: sell ETH at 1,866. It rests, waiting. A large trade arrives and does not merely touch your price — it blows through and keeps going to 1,875.
You got your price. Formally, nothing went wrong. But the extra move was captured by whoever ran through you, and it only existed because your order was sitting in the way.
How far past your price the fill pushed the market. One tick is one basis point, so it is exact integer arithmetic — no price reconstruction, nothing to round.
A capped share of the overshoot, taken from the swap that caused it, and only on the part the pool fee did not already cover.
To that specific maker's order, held as an ERC-721. Comparable designs pay the pool at large; this pays the person who was run over.
A maker filled by an ordinary swap already collected the fee on their own fill. Below that line they are not out of pocket, so the hook stays silent. Benign flow pays nothing without a special case existing for it — the threshold falls out of the measurement rather than being tuned.
Measured before any contract was written, over 30 days of Base WETH/USDC — 253,135 swap events, ~11,400 simulated fills. The same median came out of three independent pools and two time windows.
The median fill is not the product. The tail is.
48 hours of that same history, driven tick-for-tick through AirbagHook in a fork test, so the number comes from the contract rather than from a model of it.
| Replaying real Base history | Value |
|---|---|
| Swaps replayed | 1,055 |
| Orders filled | 611 |
| Of which compensated | 280 |
| Rebate, median | 3 bps |
| Rebate, p90 | 48 bps |
| Rebate, maximum | 199 bps |
More than half of all fills cost the swapper nothing. That is the design working, not failing. The maximum landing at 199 against a 200 bps cap is a useful sanity check: the ceiling binds and nothing slips past it.
Two adversarial audits ran before anything was deployed. They raised 65 findings; 48 survived independent refutation, and eight were blockers. All eight are closed. The rest are written down rather than quietly left.
Manipulable by adding liquidity in the same transaction. Doing better needs a time-weighted measure of depth, which cannot be read in-transaction without an oracle — and being oracle-free is the point, not an accident. The damage is bounded elsewhere: the charge can never exceed what the paying swap received.
Past that, a filler who saturates it can split their swap and escape the top-up. The real fix keys on ticks rather than orders. Until then the overflow emits an event, so the gap is observable from the first block rather than invisible.
A swap settles a bounded number of fills. Anything left is recoverable by anyone
through settleFills — but no swap is present at that point to charge, and
inventing a payer would be worse than admitting the gap.
They got their limit price. Airbag returns the part of the move their own order made possible. On a median fill the maker is already net positive and the hook correctly pays nothing.