Protocol invariants
Properties the implementation and every supported extension must preserve.
These invariants are requirements and test targets. Their presence in this page is not a proof that all have been verified.
Conservation and solvency
For each asset, reconcile spendable vault balance against principal, LP fee debts, protocol debts, beneficiary debts, segregated allocations, and identified excess. No unit backs two liabilities. Virtual curve reserves never finance a withdrawal.
User limits
The input debit stays within authorization; the output satisfies the applicable minimum. Hook fees, supported transfer fees, and custom deltas must be included in the applicable amount calculation. A zero intermediate-hop minimum may rely on a final route check; this must be explicit, not assumed.
Liquidity and ticks
Active liquidity matches positions covering the current interval. Crossing applies the correct signed net liquidity in each direction. Removing liquidity cannot underflow a position or withdraw another position's principal. Capacity and gap behavior are explicit.
Fee ownership
Only active positions earn fees for a traded segment. Checkpoints prevent repeat claims. Collect does not increase liquidity; compound is separate. Protocol retention and remainder splits conserve the charged fee. Per-mint fractional carry survives claims, and split residue remains accounted for.
Immutable relationships
The pair, spacing, hook binding, and supported policy version cannot change silently beneath LPs or quote adapters. If a future configuration is mutable, its authority, bounds, and treatment of existing claims must be defined.
Call and account authenticity
Validate owner programs, discriminators, seeds, signers, mint identities, token authority, and hook executability. A matching byte layout or supplied pubkey does not authenticate an account. Hooks receive only the privileges required by their contract.
Atomic failure
A rejected hook, insufficient output, bad account, or arithmetic error must leave no committed partial settlement. Runtime tests must inspect state and token balances after rejection, not only the error string.
Graduation
Graduation must happen once, uses real unencumbered assets, preserves the approved destination plan, and establishes a compatible CLMM price. Repetition and failure paths require tests as much as the happy path.