①
ExposureGate1D
a new SwapVM instruction
Turns an off-chain exposure reading into a one-way limit on liquidity. It can derate or halt a fill and can never improve one.
src/opcodes/ExposureGate.sol ↗LIVE
Exposure
Fill
1inch Aqua · SwapVM · Uniswap v4 · The Graph
_exposureGate1D reads a maker's live exposure across every strategy and can only derate or halt their fill, on 1inch SwapVM and Uniswap v4 alike.
01 · Simulated reading · 10%
At or below maxExposureBps the opcode does nothing. The maker's program fills exactly as written.
02 · Simulated reading · 70%
Between 50% and 90% the fill scales down linearly. At 70% every taker gets half the ungated output. Never more.
03 · Simulated reading · 95%
At 90% or above the swap reverts on SwapVM and Uniswap v4 alike. They share one gate, so they can't disagree.
Every failure mode fails closedMonotonic by constructionSame number on both venuesThe oracle can lie, the fill can't growRisk travels with the strategy
The problem
Aqua lets one wallet back several strategies at once. Each strategy checks its own commitment against the wallet and passes. Nothing looks at all of them together, so the maker can still be committed far beyond what they hold.
Checked one by one
- Strategy A✓ 60% of wallet · passes
- Strategy B✓ 60% of wallet · passes
- Strategy C✓ 60% of wallet · passes
Seen together
0%
of the wallet committed in total
wallet
Aqueduct's oracle aggregates every strategy the maker has shipped, so each one is gated on the total, including strategies that look safe on their own.
Illustrative numbers, not live data. On-chain proof: test/MultiStrategyExposure.t.sol.
Three pieces, nothing else
Everything in the repo supports exactly three components, not a pile of loosely related features.
②
Exposure Oracle
a cross-strategy risk layer
Works out how much liquidity a maker can safely expose right now, summed across every Aqua strategy they've shipped. A Graph subgraph and a keeper feed it.
src/oracle/ExposureOracle.sol ↗③
AquaV4Hook
execution that doesn't depend on the venue
Offers the same Aqua liquidity, under the same exposure limit, through a Uniswap v4 pool. The risk policy belongs to the strategy, not to any one pool.
src/hooks/AquaV4Hook.sol ↗_exposureGate1DExposureOracleAquaV4HookAqua.safeBalancesThe Graph · ExposurePosition
III · The one property
Every failure mode fails closed.
Not “degrades gracefully”. Every way this system can go wrong ends in a strictly smaller fill or no fill at all, never in a taker getting more than the maker's own unsigned program authorized.
Live on Base Sepolia · chain 84532
Every contract is live on testnet, and both venues were each verified with a real swap transaction. The numbers below come from
deployment.json and the README's on-chain verification.—
maker strategies shipped
A, B, C + Strategy P
—
Uniswap v4 pools sourced from Aqua
static fee + risk-adjusted fee
—
pips fee at 10% exposure
verified on-chain, dynamic-fee pool
—
pips fee at 70% exposure
same pool, same formula