Security and testing

What is tested, what is verified, what is out of scope.

Tests

• Unit tests for the pair, router, locker, treasury and launchpad, including the worked reward example reproduced exactly.
• Fuzz tests for fee math and for Euler accounting under random deposit, withdraw, transfer and claim sequences.
• Invariant tests: reward conservation, rewardBalance ≥ Σ pending, mMin ≤ m ≤ mMax with bounded slew, fee never above maxFee, reserves and rewards never mixed, treasury inflows reconcile with 15% of charged fees.
• An explicit test for the 6 / 18 decimals boundary: the pair is given a native balance and every accounting path must ignore it.
• An explicit test for several swaps in the same second.
• A fork test against Arc mainnet using the real USDC interface, run when ARC_RPC_URL is set.

Design choices

• Reentrancy lock on the pair and checks effects interactions throughout. USDC is a system token and is still treated as an external call.
• No upgradeable proxies. The factory owner can change defaults for new pools and the protocol recipient. It cannot touch existing pool balances.
• Contracts only touch USDC through the ERC-20 interface. No msg.value, no payable swap paths.

Before anything is called live

Published addresses must match verified source on the explorer, quoted fees must equal charged fees in fork tests, and treasury inflows must reconcile with 15% of charged fees.

Out of scope in this build

Concentrated liquidity, a Uniswap V4 hook version, governance, staking, cross chain transfers, fee discounts for holders, and any form of burn.