How the machine works

Every hooked pool declares two roles for its two currencies. MAIN is the asset being defended — it is what the pot buys and what the pot's recipient receives. SECONDARY is the buyback currency — the ONLY asset the pot holds and the only asset donate() accepts.

The pot is a per-pool, permissionless war chest. Anyone can fuel it — the token team, a protocol treasury, a community member, another contract. It spends itself automatically through two mechanics: the pump on buys and the shield on sells.

The pot's recipient decides where bought MAIN goes: address(0) means burn (the cascade below), anything else receives it directly.

On a SECONDARY → MAIN buy, afterSwap makes the pot buy more MAIN inside the buyer's own transaction. The spend is sized from the carrying buy:

A sandwich needs the attacker's round trip to profit from the pump's price push. But forcing a bigger pump requires a bigger real buy, which costs the attacker fee + impact twice — and the haircut means the pump moves the price by LESS than the attacker paid to trigger it. The attack is self-financing a donation to the pool.

On a MAIN → SECONDARY sell, beforeSwap lets the pot absorb the sell at the pool's EXACT execution price — fee and tick impact included. The seller receives precisely what the pool would have paid; the pool's price simply does not move. The absorbed MAIN goes to the recipient instead of the pool.

Because the shield never pays ABOVE the pool's own price, selling into the pot is never better than selling into the pool. Moving spot first buys an attacker nothing, and every round trip still pays the pool's fee and impact twice.

When the pot can't cover the whole sell, it absorbs the slice it can afford and the remainder swaps through the pool in the same call — partial defense, zero seller friction.

The pool's LP program (one per pool, owned) accrues swap fees on both sides. A harvest — automatic once fees pass the minimums, or manual — splits each side FROM THE GROSS:

• ▸ compound share (both sides) → re-minted as liquidity
• ▸ buyback share (secondary side) → fuels the pot
• ▸ burn share (main side) → the burn cascade
• ▸ the residual of each side → one recipient per side

Constraints, enforced on-chain when the config is set: compound + buyback ≤ 100% and compound + burn ≤ 100%; burn must be 0 when MAIN is native; a recipient is required wherever a residual exists. Config changes only affect FUTURE harvests.

Compounding anchors on the secondary token: it places as much of the budget as the current price allows and CARRIES the unmatched remainder to the next harvest — nothing leaks, nothing is double-compounded (harvested fuel sits in the pot, not in the next compound).

Traditional buyback machinery needs a price oracle and a keeper — two trust dependencies. Hook needs neither: your contract just donate()s, and the pot executes at REAL market prices, riding real user buys, only when there is real demand.

Two views quote the machine before you act: quotePump(key, buySize) returns what the pot would spend and buy alongside a buy of that size; quoteShield(key, sellSize) returns how much of a sell the pot would absorb and pay.

Everything is at the same address on all 18 chains, so a single integration ports everywhere unchanged.