A theory of Automated Market Makers in DeFi
Massimo Bartoletti, James Hsin-yu Chiang, Alberto Lluch-Lafuente
aa r X i v : . [ c s . F L ] F e b A theory of Automated Market Makers in DeFi
Massimo Bartoletti , James Hsin-yu Chiang , Alberto Lluch-Lafuente Universit`a degli Studi di Cagliari, Cagliari, Italy Technical University of Denmark, DTU Compute, Copenhagen, Denmark
Abstract.
Automated market makers (AMMs) are one of the mostprominent decentralized finance (DeFi) applications. They allow usersto exchange units of different types of crypto-assets, without the need tofind a counter-party. There are several implementations and models forAMMs, featuring a variety of sophisticated economic mechanisms. Wepresent a theory of AMMs. The core of our theory is an abstract opera-tional model of the interactions between users and AMMs, which can beinstantiated with any desired economic design mechanism. We exploitour theory to formally prove a set of fundamental properties of AMMs,characterizing both structural and economic aspects. We do this by ab-stracting from the actual economic mechanisms used in implementations,by identifying sufficient conditions which ensure the relevant properties.Notably, we devise a general solution to the arbitrage problem , the maingame-theoretic foundation behind the economic mechanisms of AMMs.
Decentralized finance (DeFi) is emerging as an alternative to the traditionalfinance, boosted by blockchain-based crypto-tokens and smart contracts. One ofthe main DeFi applications are
Automated Market Makers (AMMs) , which allowusers to exchange crypto-tokens of different types without the intermediation ofthird parties. The two AMM platforms leading by user activity, Uniswap [12]and Curve Finance [5], alone hold $ $ $ $ § funds invariants , which algorithmicallydetermines exchange rates between crypto-tokens. This makes our model generalenough to encompass the most popular models and implementations of AMMs.With respect to economic models, our model considers implementation detailsthat are crucial to guarantee (efficient) computability in practice. Our model hasbeen indeed designed to have an executable semantics so to serve as the basis ofimplementations and analysis tools. As a matter of fact, an executable semanticsin Ocaml has been used as a proof of concept for the design of the model. In addition, we provide a set of properties characterizing novel and well-accepted structural ( §
3) and economic ( §
4) aspects of AMMs. With respect toprevious works, which focus on specific AMM models, all the results presentedhere are parametric with respect to funds invariants. We identify indeed for eachresult a set of sufficient properties of fund invariants. Our results include funda-mental structural properties such as net worth preservation (“value cannot becreated/destroyed”), liquidity (“assets can’t be frozen by an AMM”), and trans-action concurrency (“ transactions T and T ′ can be executed in any order”),as well as fundamental economic properties such as incentive-consistency whichensures an incentive feedback loop between deposits and exchanges of assets.Most notably, we generalize the formulation and the solution to the so-called arbitrage problem , the main game-theoretic foundation behind the economic as-pects of AMMs, which ensures that an AMMs exchange rates track the actualexchange rate of external markets.Overall, our theory encompasses and generalizes the main functional and eco-nomic aspects of the mainstream AMM implementations, providing solid groundsfor the design of future AMMs. We introduce a formal, operational model of AMMs, focussing on the commonfeatures implemented by the main AMM platforms. We discuss in § https://github.com/blockchain-unica/defi [70 : τ ,
80 : τ ] | B [30 : τ ] xfer A ( B , τ ) −−−−−−−−→ A [70 : τ ,
70 : τ ] | B [30 : τ ,
10 : τ ] (1) dep A (70: τ , τ ) −−−−−−−−−−−→ A [70 : ( τ , τ )] | B [ · · · ] | (70 : τ ,
70 : τ ) (2) swapL B (30: τ , τ ) −−−−−−−−−−−−→ A [ · · · ] | B [0 : τ ,
31 : τ ] | (100 : τ ,
49 : τ ) (3) swapR B (29: τ , τ ) −−−−−−−−−−−−→ A [ · · · ] | B [30 : τ ,
10 : τ ] | (70 : τ ,
70 : τ ) (4) rdm B (30:( τ ,τ )) −−−−−−−−−−→ A [30 : τ ,
30 : τ ,
40 : ( τ , τ )] | B [ · · · ] | (40 : τ ,
40 : τ ) (5) swapL B (30: τ , τ ) −−−−−−−−−−−−→ A [ · · · ] | B [0 : τ ,
27 : τ ] | (70 : τ ,
23 : τ ) (6) rdm A (30:( τ ,τ )) −−−−−−−−−−→ A [82 : τ ,
47 : τ ,
10 : ( τ , τ )] | B [ · · · ] | (18 : τ , τ ) (7) Fig. 1: Interactions between two users and an AMM.
We assume a set of users A , ranged over by A , A ′ , . . . , and a set of token types T , ranged over by τ, τ ′ , . . . . We denote with T ⊆ T the subsetof initial token types ( T includes e.g. the native blockchain tokens). We use v, v ′ , r, r ′ to range over nonnegative real numbers ( R +0 ), and we write r : τ todenote r units of token type τ . We model the wallet of a user A as a term A [ σ ],where the partial map σ ∈ T ⇀ R +0 represents A ’s token holdings. We modelan AMM as a pair of the form ( r : τ , r : τ ), representing the fact that theAMM is holding, respectively, r and r units of token types τ and τ . States
We formalise the interaction between users and AMMs as a labelledtransition system (LTS). Its labels T , T ′ , . . . represent blockchain transactions ,while the states Γ, Γ ′ , . . . are compositions of wallets and AMMs: A [ σ ] | · · · | A n [ σ n ] | ( r : τ , r ′ : τ ′ ) | · · · | ( r k : τ k , r ′ k : τ ′ k )where all A i are distinct, and τ i = τ ′ i = τ j for all i = j . Note that two AMMs canhave a common token type τ , as in ( r : τ , r : τ ) , ( r ′ : τ, r ′ : τ ′ ), so allowing forindirect trades between token pairs not directly provided by any AMM. A state Γ is initial when it only contains wallets with initial tokens. We treat states assets of terms (wallets/AMMs): hence, Γ and Γ ′ are equivalent when they containthe same terms; for a term Q , we write Q ∈ Γ when Γ = Q | Γ ′ , for some Γ ′ . Example 1.
Figure 1 shows an execution trace in our model. The write Γ T −→ Γ ′ for a state transition from Γ to Γ ′ , triggered by a transaction T . The first twostates are initial, while the others contain an AMM for a token pair ( τ , τ ). ⊓⊔ Token supply
We define the supply of a token type τ in a state Γ as the sumof the balances of τ in all the wallets and the AMMs occurring in Γ . Formally: sply τ ( A [ σ ]) = σ ( τ ) sply τ ( Γ | Γ ′ ) = sply τ ( Γ ) + sply τ ( Γ ′ ) sply τ ( r : τ , r : τ ) = ( r i if τ = τ i xample 2. Consider the first state in Figure 1, Γ A [70 : τ ,
80 : τ ] | B [30 : τ ].We have that sply τ ( Γ
1) = 70 + 30 = 100, while sply τ ( Γ
1) = 80. Observethat the supply of both token types remains constant in Figure 1; we will showin Lemma 2 that the supply of initial token types is always preserved. ⊓⊔ Token prices and net worth
Assume that initial tokens are priced by aglobal oracle P ∈ T → R +0 . We then define the price P τ ( Γ ) of a token τ ∈ T (either initial or minted) in a state Γ inductively as follows: P τ ( Γ ) = P ( τ ) if τ ∈ T P ( τ ,τ ) ( Γ ) = r · P τ ( Γ ) + r · P τ ( Γ ) sply ( τ ,τ ) ( Γ ) if ( r : τ , r : τ ) ∈ Γ (8) Example 3.
Let Γ A [82 : τ ,
47 : τ ,
10 : ( τ , τ )] | · · · be the final state in Fig-ure 1. We have that sply ( τ ,τ ) ( Γ
7) = 10. Assume that the prices of initial tokensare P ( τ ) = 5 and P ( τ ) = 9. The price of the minted token ( τ , τ ) is hence: P ( τ ,τ ) ( Γ
7) = 110 (cid:16) · P τ ( Γ
7) + 6 · P τ ( Γ (cid:17) = 1810 · · . ⊓⊔ We now define a key concept to understand the incentives for users to par-ticipate in AMMs, namely the net worth of a user A in a state Γ : W A ( Γ ) = (P τ ∈ dom σ σ ( τ ) · P τ ( Γ ) if A [ σ ] ∈ Γ global net worth W ( Γ ) of a state Γ is the sum of the net worth in users’wallets. The token units held in AMMs are not accounted for by W ( Γ ), becausetheir value is already recorded by minted tokens held in users’ wallets. Indeed,the equality sply ( τ ,τ ) ( Γ ) · P ( τ ,τ ) ( Γ ) = r · P τ ( Γ ) + r · P τ ( Γ ) between the netvalue of a minted token and the value of the AMM is a direct consequence ofthe definition of price in (8).As we shall see later, one of the main goals of users is to maximize their networth. This can be achieved through different interactions with the AMM (e.g.,by investing tokens or trading units of differently priced token types). Example 4.
Recall from Figure 1 the state Γ A [70 : τ ,
80 : τ ] | B [30 : τ ],where τ and τ are initial tokens. Assume again that the prices are P ( τ ) = 5and P ( τ ) = 9. The users’ net worth in Γ W A ( Γ
1) = 70 · P ( τ ) + 80 · P ( τ ) = 1070 W B ( Γ
1) = 30 · P ( τ ) = 150In Γ A [82 : τ ,
47 : τ ,
10 : ( τ , τ )] | B [0 : τ ,
27 : τ ] | (18 : τ , τ ) we have: W A ( Γ
7) = 82 · P τ ( Γ
7) + 47 · P τ ( Γ
7) + 10 · P ( τ ,τ ) ( Γ
7) = 977 W B ( Γ
7) = 27 · P τ ( Γ
7) = 243Note that the net worth of A has decreased w.r.t. the initial state, while the networth of B has increased. One may think that B has been more successful than A , but this is depends on the users’ goals. Note, e.g., that A holds 10 units of theminted token ( τ , τ ), whose price may increase in the future, as fees accrue. ⊓⊔ fer A ( B , v : τ ) A transfers v : τ to Bdep A ( v : τ , v : τ ) A deposits v : τ and v : τ to an AMM ( r : τ , r : τ ),receiving in return some units of the minted token ( τ , τ ) swapL A ( v : τ , v : τ ) A tranfers v : τ to an AMM ( r : τ , r : τ ), receiving inreturn at least v units of τ swapR A ( v : τ , v : τ ) A tranfers v : τ to an AMM ( r : τ , r : τ ), receiving inreturn at least v units of τ rdm A ( v : τ ) A redeems v units of minted token τ = ( τ , τ ) from an AMM( r : τ , r : τ ), receiving in return some units of τ and τ Table 1: AMM transactions.
We now formally describe the interactions of the AMM that give rise to statetransitions. State transitions are triggered by the transactions in Table 1. Weformalise below their behaviour, but we give before an overview of our runningexample from Figure 1.
Example 5.
Figure 1 actually displays a sequence of transitions in the LTS ofour model. To keep the example simple, we have used there the constant product funds invariant, which requires swap transactions to preserve the product be-tween the amounts of the two tokens in the AMM; further, we have assumed nofees. In step (1), A transfers 10 : τ from her wallet to B ’s. In step (2), A createsa new AMM, depositing 70 : τ and 70 : τ ; in return, she receives 70 units ofthe minted token ( τ , τ ). In step (3), B swaps 30 of his units of τ for at least
20 units of τ . The actual amount of units of τ received by B is 21: indeed,(70 + 30) · (70 −
21) = 70 ·
70, hence 21 satisfies the constant product fundsinvariant. In step (4), B reverses his prior action by swapping 21 of his units of τ for at least
29 units of τ . Here, the actual amount of units of τ received by B is 30, which also satisfies the constant product funds invariant. In step (5), B redeems 30 units of the minted token ( τ , τ ), accordingly reducing the funds inthe AMM. Note that the received tokens exhibit the same 1-to-1 ratio as in theinitial deposit at step (2). In step (6), B swaps 30 of his units of τ for at least τ . Unlike in the previous swap at step (3), now the actual amount of τ received by B is 17. Note that the implied swap rate between received τ unitsand sent τ units has deteriorated w.r.t. step (3), where the pair had the same1-to-1 ratio of funds. This is caused by the reduction in funds resulting from A ’s redeem action: thus, the swap rate is sensitive to both the ratio of fundsin the pair as well as their absolute balances, a key property of the incentivemechanisms, as we shall see later in §
4. Finally, in step (7) A performs anotherredeem of 30 units of the minted token ( τ , τ ), thereby extracting 52 units of τ and 17 units of τ from the AMM. Note that the ratio of redeemed tokens isno longer 1-to-1 as in the previous redeem action (5), as the prior left swap haschanged the ratio between the funds of τ and τ in the AMM. ⊓⊔
5e now formalise the transition rules. We use the standard notation σ { v / x } toupdate a partial map σ at point x : namely, σ { v / x } ( x ) = v , while σ { v / x } ( y ) = σ ( y )for y = x . Given a partial map σ ∈ T ⇀ R +0 , a token type τ ∈ T and a partialoperation ◦ ∈ R +0 × R +0 ⇀ R +0 , we define the partial map σ ◦ v : τ as follows: σ ◦ v : τ = ( σ { σ ( τ ) ◦ v / τ } if τ ∈ dom σ and σ ( τ ) ◦ v ∈ R +0 σ { v / τ } if τ dom σ Token transfer
A user A can transfer some of her tokens to another user B ,provided that there are enough units of the token in A ’s wallet. Formally: σ A ( τ ) ≥ v A [ σ A ] | B [ σ B ] | Γ xfer A ( B ,v : τ ) −−−−−−−→ A [ σ A − v : τ ] | B [ σ B + v : τ ] | Γ [Xfer] A consequence of this rule is that tokens (both initial and minted) are fungible ,i.e. individual units of the same token type are interchangeable. In particular,amounts of tokens of the same type can be split into smaller parts, and twoamounts of tokens of the same type can be joined.
Deposit
Any user can create an AMM for a token pair ( τ , τ ) provided thatsuch an AMM is not already present in the state. This is achieved by the trans-action dep A ( v : τ , v : τ ), through which A transfers v : τ and v : τ to thenew AMM. In return for the deposit, A receives v units of a new token type( τ , τ ), which is minted by the AMM. We formalise this behaviour by the rule: σ ( τ i ) ≥ v i > i ∈ { , } ) τ = τ ( : τ , : τ ) , ( : τ , : τ ) Γ A [ σ ] | Γ dep A ( v : τ ,v : τ ) −−−−−−−−−−−→ A [ σ − v : τ − v : τ + v : ( τ , τ )] | ( v : τ , v : τ ) | Γ [Dep0] Once an AMM is created, any user can deposit tokens into it, as long as doingso preserves the ratio of the token holdings in the AMM. When a user deposits v : τ and v : τ to an existing AMM, it receives in return an amount of mintedtokens of type ( τ , τ ). This amount is the ratio between the deposited amount v and the redeem rate of ( τ , τ ) in the current state Γ , i.e. the ratio betweenthe amount r of τ stored in the AMM, and the total supply sply ( τ ,τ ) ( Γ ) ofthe minted token in the state. σ ( τ i ) ≥ v i > i ∈ { , } ) r v = r v v = v r · sply ( τ ,τ ) ( Γ ) Γ = A [ σ ] | ( r : τ , r : τ ) | Γ ′ dep A ( v : τ ,v : τ ) −−−−−−−−−−−→ A [ σ − v : τ − v : τ + v : ( τ , τ )] | ( r + v : τ , r + v : τ ) | Γ ′ [Dep] Note that the premise r v = r v ensures that the ratio between the holdingsof τ and τ in the AMM is preserved by the dep transaction, i.e.: r + v r + v = r r As we shall see in §
4, users are incentivized to invest tokens into AMMs bythe fact that trading operations (i.e., swaps) are subject to a fee mechanism thatmakes the redeem rate increase over time.6 wap
As shown Example 5, users can increase their net worth by swappingtokens. Any user A can swap units of τ held in her wallet for units of τ heldin an AMM ( r : τ , r : τ ) by firing a transaction swapL A ( v : τ , v : τ ). Here, v is the amount of τ that is transferred from A ’s wallet to the AMM, while v is a lower bound on the amount of τ that A will receive in return. The actualamount v is determined by a funds invariant I ∈ R +0 × R +0 → R +0 , that imposesa relation between the amounts of τ and τ held in the AMM before and afterthe swap. In determining v , the AMM requires a fraction 0 < φ ≤ v , whilethe rest is considered as a fee . This is formalised by the following rule: σ ( τ ) ≥ v > I ( r + φ v , r − v ) = I ( r , r ) 0 < v ≤ v ≤ r A [ σ ] | ( r : τ , r : τ ) | Γ swapL A ( v : τ ,v : τ ) −−−−−−−−−−−−→ A [ σ − v : τ + v : τ ] | ( r + v : τ , r − v : τ ) | Γ [SwapL] The effect of the fee is that the redeem rate of minted token increases; in-tuitively, the AMM retains a portion of the swapped amounts, but the overallreserve is still distributed among all minted tokens, thereby ensuring liquidity(as we shall formally establish liquidity later on in Lemma 4).Although actual AMM implementations use a variety of different funds in-variants, with the common aim to incentivize users to perform swaps, all theseinvariants share a few common design choices. A crucial one is that there ex-ists exactly one v which satisfies the equation in the premise of [SwapL] ; further,swapping 0 units of τ results in 0 units of τ . Formally, for all r , r > ∀ v ∈ R +0 : ∃ ! v ′ ∈ R +0 : I ( r + v, r − v ′ ) = I ( r , r ) (10) ∀ v ∈ R +0 : I ( r , r − v ) = I ( r , r ) = ⇒ v = 0 (11)Hereafter, we assume that I always respects these conditions. A common fundsinvariant, implemented e.g. by Uniswap [11] and Mooniswap [6] (and also usedin Example 5), is the constant product invariant , which requires that the productof the amounts of τ and τ in the AMM remains constant, i.e. I ( r , r ) = r · r .The rule [SwapR] allows for swaps in the other direction: σ ( τ ) ≥ v > I ( r − v, r + φ v ) = I ( r , r ) 0 < v ≤ v ≤ r A [ σ ] | ( r : τ , r : τ ) | Γ swapR A ( v : τ ,v : τ ) −−−−−−−−−−−−→ A [ σ + v : τ − v : τ ] | ( r − v : τ , r + v : τ ) | Γ [SwapR] where we assume that I enjoys the “right” version of the conditions (10) and (11).It is worth to explain why the swap transactions specify lower bounds for theamount of return tokens, instead of an exact amount. In practice, when a useremits a transaction, she cannot predict the exact state in which the transactionwill be actually committed. This makes it unfeasible to guess the exact amountthat will preserve the funds invariant: hence, users can only specify a lower boundthat they are willing to accept. 7 edeem Any user can redeem units of a minted token ( τ , τ ), obtaining inreturn units of the underlying tokens τ and τ . The redeemable amounts aredetermined by the redeem rate: each unit of ( τ , τ ) can be redeemed for equalfractions of τ and τ remaining in the AMM: σ ( τ , τ ) ≥ v > v = v r sply ( τ ,τ ( Γ ) v = v r sply ( τ ,τ ( Γ ) Γ = A [ σ ] | ( r : τ , r : τ ) | Γ ′ rdm A ( v :( τ ,τ )) −−−−−−−−−−→ A [ σ + v : τ + v : τ − v : ( τ , τ )] | ( r − v : τ , r − v : τ ) | Γ ′ [Rdm] We now establish some structural properties of AMMs, which do not depend onthe design of the economic mechanisms, i.e. on the choice the funds invariant.We denote with −→ ∗ the reflexive and transitive closure of −→ , and given a finitesequence of transactions λ = T · · · T k , we write Γ λ −→ Γ ′ when Γ T −→ · · · T k −−→ Γ ′ .We say that a state Γ is reachable if Γ −→ ∗ Γ for some initial Γ . We denotewith type ( T ) the type of T (i.e., xfer , dep , . . . ), with wal ( T ) the set of walletsaffected by T (e.g., wal ( xfer A ( B , v : τ )) = { A , B } ), and with tok ( T ) the set oftoken types affected by T (e.g., tok ( swapL A ( v : τ , v : τ )) = { τ , τ } ).First, we establish that the AMMs’ LTS is deterministic. Note that, in swap rules, an unconstrained funds invariant I could admit different solutions to theequation in the premise: determinism is ensured by condition (10), which weassume to be true for all funds invariants. Lemma 1 (Determinism). If Γ T −→ Γ ′ and Γ T −→ Γ ′′ , then Γ ′ = Γ ′′ . We can lift the statement to sequences of transactions by using a simpleinductive argument. The same applies to other single-step results in this section.Lemma 2 ensures that the supply of each initial token type τ is preservedby transitions (of any type). Note that preservation does not hold for minted tokens, as they can be created (by rule [Dep] ) and destroyed (by rule [Rdm] ). Lemma 2.
For all τ ∈ T , if Γ −→ Γ ′ then sply τ ( Γ ) = sply τ ( Γ ′ ) . Lemma 3 ensures that the global net worth is preserved by transactions,whereas the user’s net worth is preserved only by redeems/deposits.
Lemma 3 (Preservation of net worth).
Let Γ T −→ Γ ′ . Then, W ( Γ ) = W ( Γ ′ ) . Further, if type ( T ) ∈ { dep , rdm } or A wal ( T ) , then W A ( Γ ) = W A ( Γ ′ ) . Lemma 4 ensures that funds cannot be frozen in an AMM, i.e. that userscan always redeem arbitrary amounts of the tokens deposited in an AMM.
Lemma 4 (Liquidity).
Let Γ be a reachable state such that ( r : τ , r : τ ) ∈ Γ with r + r > . Then: (a) sply ( τ ,τ ) ( Γ ) > ; (b) for all r ′ ≤ r , there exists r ′ ≤ r such that Γ −→ ∗ ( r ′ : τ , r ′ : τ ) | · · · ; (c) for all r ′ ≤ r , there exists r ′ ≤ r such that Γ −→ ∗ ( r ′ : τ , r ′ : τ ) | · · · .
8e now study the concurrency of transactions. Two finite sequences of trans-actions λ and λ are observationally equivalent , in symbols λ ∼ λ , when, forall states Γ , if Γ λ −→ Γ and Γ λ −→ Γ then Γ = Γ . We say that two distincttransactions T , T ′ are concurrent (in symbols, T T ′ ) if TT ′ ∼ T ′ T . Lemma 5provides sufficient conditions for two transactions to be concurrent: intuitively,two non- swap transactions are always concurrent, while swap transactions areconcurrent with xfer transactions, and with any transactions which do not affectthe same token types. Lemma 5.
Two distinct transactions T , T are concurrent if, for i ∈ { , } , iftype ( T i ) ∈ { swapL , swapR } , then tok ( T i ) ∩ tok ( T − i ) = ∅ or type ( T − i ) = xfer . As we shall see later in §
4, it is actually desirable, and crucial for the economicmechanism of AMMs, that swap transactions interfere with other transactionsthat trade the same token type.The theory of Mazurkiewicz’s trace languages [23] allows us to lift Lemma 5to sequences of transactions. Let R be a symmetric and irreflexive relation onthe set X of all transactions. The Mazurkiewicz equivalence ∼ R is the least con-gruence in the free monoid X ∗ such that: ∀ T , T ′ ∈ X : T R T ′ = ⇒ TT ′ ∼ R T ′ T .Theorem 1 states that the Mazurkiewicz equivalence constructed on the concur-rency relation Theorem 1 (Concurrent transactions can be reordered). ∼ ⊆ ∼ . A direct consequence of Theorem 1 is that we can transform a finite se-quence of transactions into an observationally equivalent one by repeatedly ex-changing adjacent concurrent transactions — provided that both sequences areexecutable in the LTS. For example, sequences of rdm A ( ) transactions can befreely reordered, resulting in the same, unique state. This is exploited in thefollowing lemma, which supports the inductive definition of the price of mintedtokens in (8): indeed, computing the net worth of a user A under that pricedefinition corresponds to making A first redeem all her minted tokens, and thensumming the price of the resulting initial tokens. Lemma 6.
For all states Γ and users A , let rdm A ( Γ ) be the unique state reachedfrom Γ by performing only rdm A ( ) actions, such that A ’s wallet in rdm A ( Γ ) ,only contains initial tokens. Then: W A ( Γ ) = P τ ∈ dom σ σ ( τ ) · P ( τ ) if A [ σ ] ∈ rdm A ( Γ ) Example 6.
Recall from Example 4 that W A ( Γ
7) = 977. Assume that A performsa further transaction to redeem all 10 units of ( τ , τ ) from her wallet. Theresulting state is Γ = A [100 : τ ,
53 : τ ] | · · · . We compute A ’s net worth in thatstate, using the oracle token prices: W A ( Γ ) = 100 · P ( τ ) ( Γ
7) + 53 · P ( τ ) ( Γ
7) =100 · · ⊓⊔ Properties of AMM incentives
We now study the incentive mechanisms of AMMs. We start in § exchange rate , which are pivotal to understanding thesemechanisms. In § incentive-consistency , which guarantee that AMMs enjoy relevant eco-nomic properties. In § arbitrage problem , which isthe key to incentivize users to perform swap operations towards an ideal statewhere the AMM’s exchange rates align with the exchange rates set by price ora-cles. Finally, in § The exchange rate between two token types corresponds to the number ofunits of one token needed to buy a single unit of the other token at the price setby oracles in the current state. We define left ( L ) and right ( R ) versions of thisnotion, reflecting the direction of the exchange: XL Γ ( τ , τ ) = P τ ( Γ ) / P τ ( Γ ) XR Γ ( τ , τ ) = P τ ( Γ ) / P τ ( Γ )The swap rate represents the ratio between the units of type τ and τ whena swap is performed on an AMM ( r : τ , r : τ ). We first introduce an auxiliarynotion, parameterized over the amounts r and r , instead of the token types.The left version is as follows (the right version is symmetrical, so we omit it): XL swap φ ( v , r , r ) = v/v if I ( r , r ) = I ( r − φv , r + v ) (12)Note that the swap rate is parameterized over the fee φ : the case where φ = 1 rep-resents an ideal scenario with no fees: in this case, we write just XL swap ( v , r , r ).We then define the swap rate between two token types in a state Γ : XL swap Γ,φ ( v , τ , τ ) = XL swap φ ( v , r , r ) if ( r : τ , r : τ ) ∈ Γ (13)Using similar intuitions, we also define the redeem rate . The left version is: XL rdm Γ ( τ , τ ) = r / sply ( τ ,τ ) ( Γ ) if ( r : τ , r : τ ) ∈ Γ (14) We proceed to describe a set of properties, which if satisfied by a funds invariant,ensures that the AMM exhibits incentive-consistency , required to motivate usersto perform the arbitrage game (thus ensuring price tracking) and to deposit funds(thus ensuring that funds are available to enable swap actions).
Swap-rate continuity
A funds invariant is SR-continuous if, for all r , r > v → XL swap ( v , r , r ) = 1 / lim v → XR swap ( v , r , r ) ∈ R + (15)Informally, this ensures that the relative price of the AMM tokens impliedby the swap rate limit is independent from the swap direction.10 emand-sensitivity A funds invariant is demand-sensitive if the swap ratestrictly decreases with demand. Formally, for all r , r > < v < v ′ : XL swap ( v, r , r ) > XL swap ( v ′ , r , r ) lim v → + ∞ XL swap ( v, r , r ) = 0 (16)We implicitly require that (16) and the subsequent properties stated for theleft version of an exchange rate also hold for the right version. Demand-sensitivityincentivises users to align the AMM’s swap rate to the exchange rate. Namely, ifan AMM offers a better swap rate than the exchange rate (in a given direction),rational users will perform swaps, until the gap is closed, i.e. until the swap ratecoincides with the exchange rate.The swap rate tends to 0 as the amount v tends to ∞ , as does the swap ratein the opposite direction: since swap rates in opposing directions are consistent(15), we can infer that swap rates in each direction range from 0 to ∞ , enablingthe AMM pair to coincide with any positive, real exchange rate. Non-depletion
Another desirable property of funds invariants is to ensure thatthe balance of token types within an AMM cannot be zeroed via swaps. Formally,a funds invariant I is non-depleteable if, for all r , r > r ′ , r ′ ≥ I ( r , r ) = I ( r ′ , r ′ ) = ⇒ r ′ , r ′ > Swap-rate-consistency
The design of AMMs aims to ensure that redeemsand deposits do not interfere with the alignment of the swap rate towards theexchange rate. Since both deposits and redeems preserve the balance ratio of atokens pair, we require swap rate limits for all balances of a given ratio to beconstant. Formally, for all r , r , r ′ , r ′ > r r = r ′ r ′ ⇐⇒ lim v → XL swap ( v, r , r ) = lim v ′ → XL swap ( v ′ , r ′ , r ′ ) (18) Funds-sensitivity
If depositing to an AMM results in improved swap rates forthe user in both directions, the funds invariant is funds-sensitive . Here, the swaprate sensitivity (16) to increasing swap amounts is reduced as funds are added.Formally, we call a funds invariant funds-sensitive if for all r , r , r ′ , r ′ > I ( r , r ) = I ( r ′ , r ′ ) = ⇒ ∀ c > I ( c · r , c · r ) = I ( c · r ′ , c · r ′ ) (19)The effect of funds-sensitivity on swap rates is formalized later on in Theorem 3.The following lemma establishes that the constant product funds invariant(the one used e.g. by Uniswap and Mooniswap) is indeed incentive-consistent.We conjecture that the same is true for the funds invariants implemented by theother mainstream AMM platforms. Lemma 7.
The constant-product funds invariant is incentive-consistent. .3 The arbitrage game The incentive mechanisms of AMMs can be better understood by taking a game-perspective. Indeed, AMMs can be seen as multi-player games where users col-laborate or compete to achieve possibly conflicting goals. In such games theallowed moves of users are the interactions among them and with AMMs, whiletheir goals are typically to increase their share of tokens or their net worth.The arbitrage problem is an interesting example of an AMM game sinceit is directly linked to the incentive of swaps in a way that makes AMMs trackexchange rates. The arbitrage problem has been formalized for concrete fundsinvariants, namely the weighted and constant-product funds invariant [15,17]. Wegeneralize here the arbitrage problem for arbitrary funds invariants. We providesufficient conditions for the existence of solutions, and we link the solutions tothe expected relation between AMMs and exchange rates.We model the arbitrage problem as a single-player, single-round game. The initial game state is Γ = A [ σ ] | ( r : τ , r : τ ), where A is the only player . Theplayer moves are all possible transactions of A or to do nothing. The goal of A is to maximize her net worth, i.e. to maximize W A ( Γ ) − W A ( Γ ), where Γ is thestate resulting from executing the selected move. A solution to the game is amove that satisfies the goal, i.e. one of the optimal moves.Before presenting the solution to the game we discuss the potential candidatesfor the solution. First, it is easy to see that transfers are not valid solutions, asthey can only decrease A ’s net worth. A second observation is that doing nothing,depositing or redeeming do not alter the player’s net worth (cf. Lemma 3). Hence,if one of such moves is a solution, so are the other two. Last, the only movesthat may alter A ’s net worth are swap transactions. For a swap to provide asolution to the game, it must, first of all, result in a positive change of A ’s networth. This happens when XL swap Γ ,φ ( v, τ , τ ) > XL Γ ( τ , τ ) or XR swap Γ ,φ ( v, τ , τ ) > XR Γ ( τ , τ ). Theorem 2 presents the solution to the game. Theorem 2.
Let I be demand-sensitive and non-depleteable, and let the initialstate of the game be Γ = A [ σ ] | ( r : τ , r : τ ) , with r , r > . Let σ ( τ ) , σ ( τ ) be large enough to enable any needed swap. Then, the solution to the game is: – swapL A ( v : τ , v : τ ) if Γ swapL A ( v : τ ,v : τ ) −−−−−−−−−−−−→ Γ , and: (1) lim v → XL swap Γ ,φ ( v, τ , τ ) > XL Γ ( τ , τ ) (2) lim v → XL swap Γ,φ ( v, τ , τ ) = XL Γ ( τ , τ ) – swapR A ( v : τ , v : τ ) if Γ swapR A ( v : τ ,v : τ ) −−−−−−−−−−−−→ Γ , and: (1) lim v → XR swap Γ ,φ ( v, τ , τ ) > XR Γ ( τ , τ ) (2) lim v → XR swap Γ,φ ( v, τ , τ ) = XR Γ ( τ , τ ) – do nothing (or do any deposit or redeem), otherwise. Intuitively, condition (1) requires that swapping infinitesimal amounts resultsin an swap rate greater than the exchange rate; (2) requires in the new state Γ ,swapping infinitesimal amounts makes the swap rate tend to the exchange rate.12ote that after executing the move of the solution, the initial state Γ reachesan equilibrium state Γ , where no player’s move can improve her net worth. Inother words, doing nothing is a solution for the arbitrage problem in Γ . Moreover,state Γ is such that the swap rate on infinitesimal amounts tends to be equal tothe exchange rate, thus achieving one of the main desiderata on AMMs.For the swap action solutions in Theorem 2, the swapped amounts mustbe unique, since the funds invariant satisfies (10). Furthermore, for a specificinstance of a funds invariant, such a solution must be efficiently computable:this has been shown for the constant product funds invariant in [15].For φ = 1 we can be observed by inspection of (15) that the no-action solutionfor theorem 2 only holds for:lim v → XL swap Γ ( v, τ , τ ) = 1 / lim v → XR swap Γ ( v, τ , τ ) = XL Γ ( τ , τ ) (20)Thus, the solution to the game results in the AMM tracking global exchangerates precisely: any infinitesimal deviation of the global exchange rate implies aswap action in the arbitrage game.The assumption that the players’ wallets are sufficiently large is commonin formulations of the arbitrage problem. We note that any rational agent isincentivized to perform such a swap: the optimal solution to the arbitrage gamecan thus be approximated by multiple users exchanging smaller swap amounts.Furthermore, the availability of flash-loans [25, 26] can provide up-front funds,and thus significantly reduce the balance requirements for arbitrage swaps. Example 7.
We consider the arbitrage game with player B and executed on Γ A [82 : τ ,
47 : τ ,
10 : ( τ , τ )] | B [0 : τ ,
27 : τ ] | (18 : τ , τ ), the finalstate in Figure 1. In this state, the exchange rates are: XL Γ τ , τ ) = P ( τ ) / P ( τ ) = 5 / XR Γ τ , τ ) = 9 / v → XR swap Γ ( τ , τ ) = r /r if ( r : τ , r : τ ) ∈ Γ lim v → XR swap Γ τ , τ ) = 18 / > XR Γ τ , τ )Theorem 2 states that the net wealth of B is maximized by performing a swapR : Γ swapR A (3: τ , τ ) −−−−−−−−−−−→ A [ · · · ] | B [4 : τ ,
25 : τ ] | (13 : τ , τ ) (8)such that lim v → XR swap Γ ( v , τ , τ ) = XR Γ ( τ , τ ) holds in the resulting state.Note that this condition is approximated in this example, due to rounding andthat B has sufficient funds to perform this optimal action. It is easy to checkthat any other action will result in a lower net worth of the user. ⊓⊔ .4 Incentivizing deposits and swaps Theorem 2 ensures that incentive-consistent AMMs will incentivize swaps to fol-low exchange rates. In this section we provide formal results that explain whydeposits and swaps incentivize each other, under certain conditions. The roughintuition is that larger reserves (obtainable via deposits) provide better swaprates, therefore attracting users interested in swaps (who may have the optionto trade in other AMMs), which, in turn, result in larger fees being distributedamong depositors, making the AMM attractive for further deposits. The follow-ing theorem shows that deposits decrease swap rates, hence incentivizing swaps.
Theorem 3.
Let I be incentive-consistent. Let ( r : τ , r : τ ) ∈ Γ with r , r > . If Γ dep A ( v : τ ,v : τ ) −−−−−−−−−−−→ Γ ′ then for all v ∈ R +0 , XL swap Γ ′ ,φ ( v, τ , τ ) > XL swap Γ,φ ( v, τ , τ ) and XR swap Γ ′ ,φ ( v, τ , τ ) > XR swap Γ,φ ( v, τ , τ ) . Vice-versa, under certain conditions, swaps incentivize deposits since redeemrates are increased by other user’s actions. In particular, a user who depositsfunds in state Γ = ( r : τ , r : τ ) where the AMM pair features a balance ratio r /r , will be guaranteed higher redeem rates in any subsequent state Γ ′ =( r ′ : τ , r ′ : τ ) where the funds ratio is again ( r ′ /r ′ = r /r ) despite anyintermediate actions such as swaps. Theorem 4.
Let I be incentive-consistent. Let Γ = ( r : τ , r : τ ) be a reach-able state and Γ −→ ∗ Γ ′ . If r /r = r ′ /r ′ then XL rdm Γ ( τ , τ ) ≤ XL rdm Γ ′ ( τ , τ ) andXR rdm Γ ( τ , τ ) ≤ XR rdm Γ ′ ( τ , τ ) . For stable exchange rates, the arbitrage game ensures stable fund ratios.Users are hence incentivized to provide funds, as subsequent swap will result ina more tokens upon redeem, which at stable prices, imply a gain in net worth.
To the best of our knowledge, our work is the first to study AMMs abstractingfrom the funds invariant. All works in literature consider concrete funds invari-ants; most of them focus on the constant product, popularized by Uniswap [11].The arbitrage problem for constant-product funds invariants has been for-malized in [15,17], which shows that the solution can be efficiently computed, andsuggest that constant-product AMMs accurately tend towards exchange rates.Our work generalizes such results. Furthermore, as we have shown in § n -tokens, allowing usersto swap any non-intersecting sets of token types. For example, the constant-product funds invariant becomes I ( r , . . . , r n ) = r w · . . . · r w n n where P ni =0 w i = 1. We have proposed a theory of AMMs, featuring a model of their behaviour anda formally proven set of fundamental properties, characterizing both structuraland economic aspects. Our theory is parametric w.r.t. platform-specific features(e.g., funds invariants), and it abstracts from implementation-specific features,and from the features that are orthogonal to the core functionality of AMMs(i.e., governance, exchange of crypto-assets).There are a some differences between our model and the existing AMM plat-forms. Uniswap implements flash-loans as part of the swap action: here, theuser can optionally lend available pair funds [8], whilst returning these withinthe same atomic group of actions. Further, Uniswap implements an exchangerate oracle, allowing smart contracts to interpret recent swap rate averages asexchange rates [9]. Balancer [3] extends token pairs to token tuples : a user canswap any two non-coinciding sets of supported tokens, such that the funds invari-ant is maintained. All AMM implementations feature token balances recorded asinteger types: consequently, they are subject to rounding errors [1]. AMM plat-forms frequently implement a governance logic, which allow “governance token”holders to coordinate changes to AMM fee-rates or fund invariant parameters.AMM platforms like Uniswap [11] and Curve [19] have overtaken centralizedcryptocurrency markets in size and usage. On the one hand, a better under-standing of AMM design in cases where it hosts the majority of the token’sglobal swap volume is critical [16]. It would be interesting to investigate how ourtheory can be used to formally explain such behaviours. On the other hand, thegrowth of AMMs is making them more attractive for malicious users and current15esearch efforts [18, 20, 24, 27] are devoted to understanding vulnerabilities andattacks, which we plan to investigate formally, exploiting our theory.
References
1. Formal specification of constant product market maker model &implementation (2018), https://github.com/runtimeverification/verified-smart-contracts/blob/uniswap/uniswap/x-y-k.pdf
2. Improving frontrunning resistance of x*y=k market makers (2018), https://ethresear.ch/t/improving-front-running-resistance-of-x-y-k-market-makers/1281
3. Balancer whitepaper (2019), https://balancer.finance/whitepaper/
4. Curve statistics (2020),
5. Curve website (2020),
6. Mooniswap implementation (2020), https://github.com/1inch-exchange/mooniswap/blob/02dccfab2ddbb8a409400288cb13441763370350/contracts/Mooniswap.sol
7. Mooniswap whitepaper (2020), https://mooniswap.exchange/docs/MooniswapWhitePaper-v1.0.pdf
8. Uniswap flash loan implementation (2020), https://github.com/Uniswap/uniswap-v2-core/blob/4dd59067c76dea4a0e8e4bfdda41877a6b16dedc/contracts/UniswapV2Pair.sol
9. Uniswap oracle template (2020), https://github.com/Uniswap/uniswap-v2-periphery/blob/dda62473e2da448bc9cb8f4514dadda4aeede5f4/contracts/examples/ExampleOracleSimple.sol
10. Uniswap statistics (2020), https://info.uniswap.org
11. Uniswap token pair implementation (2020), https://github.com/Uniswap/uniswap-v2-core/blob/4dd59067c76dea4a0e8e4bfdda41877a6b16dedc/contracts/UniswapV2Pair.sol
12. Uniswap website (2020),
13. Curve computation of invariant constant (2021), https://github.com/curvefi/curve-contract/blob/a1b5a797790d3f5ef12b0e358892a0ce47c12f85/contracts/pool-templates/base/SwapTemplateBase.vy
14. Curve token pair implementation (2021), https://github.com/curvefi/curve-contract/blob/a1b5a797790d3f5ef12b0e358892a0ce47c12f85/contracts/pool-templates/base/SwapTemplateBase.vy
15. Angeris, G., Chitra, T.: Improved price oracles: Constant function market makers.In: ACM Conference on Advances in Financial Technologies (AFT). pp. 80–91.ACM (2020). https://doi.org/10.1145/3419614.3423251, https://arxiv.org/pdf/2003.10001
16. Angeris, G., Evans, A., Chitra, T.: When does the tail wag the dog? curvature andmarket making. arXiv preprint arXiv:2012.08040 (2020), https://arxiv.org/pdf/2012.08040
17. Angeris, G., Kao, H.T., Chiang, R., Noyes, C., Chitra, T.: An analysis ofUniswap markets. Cryptoeconomic Systems Journal (2019), https://ssrn.com/abstract=3602203
18. Daian, P., Goldfeder, S., Kell, T., Li, Y., Zhao, X., Bentov, I., Breidenbach, L.,Juels, A.: Flash boys 2.0: Frontrunning in decentralized exchanges, miner ex-tractable value, and consensus instability. In: IEEE Symposium on Security andPrivacy. pp. 910–927. IEEE (2020). https://doi.org/10.1109/SP40000.2020.00040
9. Egorov, M.: Stableswap - efficient mechanism for stablecoin (2019),
20. Eskandari, S., Moosavi, S., Clark, J.: SoK: Transparent Dishonesty: Front-RunningAttacks on Blockchain. In: Financial Cryptography. pp. 170–189. Springer Inter-national Publishing, Cham (2020). https://doi.org/10.1007/978-3-030-43725-1 1321. Evans, A., Angeris, G., Chitra, T.: Optimal fees for geometric mean market makers(2021), https://web.stanford.edu/˜guillean/papers/g3m-optimal-fee.pdf
22. Krishnamachari, B., Feng, Q., Grippo, E.: Dynamic curves for decentralizedautonomous cryptocurrency exchanges. arXiv preprint arXiv:2101.02778 (2021), https://arxiv.org/pdf/2101.02778
23. Mazurkiewicz, A.W.: Basic notions of trace theory. In: Linear Time, BranchingTime and Partial Order in Logics and Models for Concurrency. LNCS, vol. 354,pp. 285–363. Springer (1988). https://doi.org/10.1007/BFb001302524. Qin, K., Zhou, L., Gervais, A.: Quantifying blockchain extractable value: How darkis the forest? (2021), https://arxiv.org/pdf/2101.05511
25. Qin, K., Zhou, L., Livshits, B., Gervais: Attacking the DeFi Ecosystem with FlashLoans for Fun and Profit. In: Financial Cryptography (2021), (to appear) https://arxiv.org/pdf/2003.03810
26. Wang, D., Wu, S., Lin, Z., Wu, L., Yuan, X., Zhou, Y., Wang, H., Ren, K.: Towardsunderstanding flash loan and its applications in defi ecosystem. arXiv preprintarXiv:2010.12252 (2020), https://arxiv.org/pdf/2010.12252
27. Zhou, L., Qin, K., Torres, C.F., Le, D.V., Gervais, A.: High-Frequency Tradingon Decentralized On-Chain Exchanges. arXiv preprint arXiv:2009.14021 (2020), https://arxiv.org/pdf/2009.14021 Proofs
Proof of Lemma 1
Straightforward inspection of the rules in § ⊓⊔ Proof of Lemma 2
We proceed by cases on the rule used in the last transition:it is straightforward to check that, in all the rules, changes applied to initialtokens cancel out. ⊓⊔ Proof of Lemma 3
We first prove that the net worth of a user A , i.e. W A ( Γ ),is preserved by transactions of type dep and rdm , or by transactions which donot affect A ’s wallet. More precisely, we prove that: Γ T −→ Γ ′ ∧ ( type ( T ) ∈ { dep , rdm } ∨ A wal ( T )) = ⇒ W A ( Γ ) = W A ( Γ ′ ) (21)We have the following cases: – [Xfer] . Let xfer C ( B , v : τ ) be the fired transaction. By hypothesis, it must be A wal ( T ) = { B , C } , hence the thesis follows by inspection of the rule. – [Dep0] . Let dep B ( v : τ , v : τ ) be the fired transaction. We have that: Γ = B [ σ ] | Γ Γ ′ = B [ σ − v : τ − v : τ + v : ( τ , τ )] | ( v : τ , v : τ ) | Γ If B = A , then A ’s net worth is unaffected. Otherwise, if B = A , then: W A ( Γ ′ ) = W A ( Γ ) − v P τ ( Γ ) − v P τ ( Γ ) + v P ( τ ,τ ) ( Γ )= W A ( Γ ) − v P τ ( Γ ) − v P τ ( Γ ) + v v P τ ( Γ ) + v P τ ( Γ ) v = W A ( Γ ) – [Dep] . Let dep B ( v : τ , v : τ ) be the fired transaction. We have that: Γ = B [ σ ] | ( r : τ , r : τ ) | Γ Γ ′ = B [ σ − v : τ − v : τ + v : ( τ , τ )] | ( r + v : τ , r + v : τ ) | Γ where v = ( v · s ) /r ), with s = sply ( τ ,τ ) ( Γ ). If B = A , then A ’s net worthis unaffected. Otherwise, if B = A , then: W A ( Γ ′ ) = W A ( Γ ) − v P τ ( Γ ) − v P τ ( Γ ) + v P ( τ ,τ ) ( Γ )= W A ( Γ ) − v P τ ( Γ ) − v P τ ( Γ ) + v r P τ ( Γ ) + r P τ ( Γ ) s = W A ( Γ ) − v P τ ( Γ ) − v P τ ( Γ ) + v r (cid:16) r P τ ( Γ ) + r P τ ( Γ ) (cid:17) = W A ( Γ ) − v P τ ( Γ ) + v r r P τ ( Γ )= W A ( Γ )where the last equality follows from the premise r v = r v of rule [Dep] .18 [SwapL] . Let swapL B ( v : τ , v : τ ) be the fired transaction. By hypothesis,it must be A wal ( T ) = { B } . The thesis follows by inspection of the rule. – [SwapR] . Similar to the previous case. – [Rdm] . Let rdm B ( v : ( τ , τ )) be the fired transaction. We have that: Γ = B [ σ ] | ( r : τ , r : τ ) | Γ Γ ′ = B [ σ + v : τ + v : τ − v : ( τ , τ )] | ( r − v : τ , r − v : τ ) | Γ where v = ( vr ) /s and v = ( vr ) /s , with s = sply ( τ ,τ ) ( Γ ). If B = A , then A ’s net worth is unaffected. Otherwise, if B = A , then: W A ( Γ ′ ) = W A ( Γ ) + v P τ ( Γ ) + v P τ ( Γ ) − v P ( τ ,τ ) ( Γ )= W A ( Γ ) + v P τ ( Γ ) + v P τ ( Γ ) − vr s P τ ( Γ ) − vr s P τ ( Γ )= W A ( Γ ) + vr s P τ ( Γ ) + vr s P τ ( Γ ) − vr s P τ ( Γ ) − vr s P τ ( Γ )= W A ( Γ ) ⊓⊔ We now prove that the global net worth is preserved by any transactions. First,we recall the definition of global net worth. Let: Γ = A [ σ ] | · · · | A n [ σ n ] | ( r : τ , r ′ : τ ′ ) | · · · | ( r k : τ k , r ′ k : τ ′ k )The global net worth of Γ is defined as: W ( Γ ) = P i ∈ ..n W A i ( Γ ) (22)We prove that: Γ T −→ Γ ′ = ⇒ W ( Γ ) = W ( Γ ′ ) (23)We have the following cases: – [Xfer] . A xfer transaction subtracts an amount of tokens from the wallet ofa user, and adds an equal amount of the same token type to the wallet ofanother user. Therefore, it preserves the global net worth. – [Dep0] , [Dep] , [Rdm] . These rules affect the number of tokens in AMMs, whichdoes not contribute to the global net worth, and the balances of users, whichare preserved (21). Therefore, the global net worth is preserved. – [SwapL] . We have that: Γ = A [ σ ] | ( r : τ , r : τ ) | Γ Γ ′ = A [ σ − v : τ + v : τ ] | ( r + v : τ , r − v : τ ) | Γ sply τ ( Γ ′ ) = sply τ ( Γ ), and sply τ ( Γ ′ ) = sply τ ( Γ ). By (8), we havethat P τ ( Γ ′ ) = P τ ( Γ ) Therefore: W ( Γ ′ ) = W ( Γ ) − v P τ ( Γ ′ ) + v P τ ( Γ ′ ) − sply ( τ ,τ ) ( Γ ) P ( τ ,τ ) ( Γ ) + sply ( τ ,τ ) ( Γ ′ ) P ( τ ,τ ) ( Γ ′ )= W ( Γ ) − v P τ ( Γ ) + v P τ ( Γ ) − sply ( τ ,τ ) ( Γ ) · (cid:0) P ( τ ,τ ) ( Γ ) + P ( τ ,τ ) ( Γ ′ ) (cid:1) = W ( Γ ) − v P τ ( Γ ) + v P τ ( Γ ) − r P τ ( Γ ) + r P τ ( Γ ) + ( r + v ) P τ ( Γ ) + ( r − v ) P τ ( Γ )= W ( Γ ) – [SwapR] . Similar to the previous case. ⊓⊔ Proof of Lemma 4
For item (a) we proceed by induction on the length ofthe computation Γ −→ ∗ Γ , with Γ initial. The base case is trivial, since Γ contains no AMMs. For the inductive step, we must show that (a) is preservedby single transitions. Assume that Γ satisfies (a), and that Γ −→ Γ ′ . Assume that Γ ′ contains an AMM ( r ′ : τ , r ′ : τ ) with r ′ + r ′ >
0, i.e. r ′ > r ′ > Γ −→ Γ ′ : – [Xfer] , [SwapL] , [SwapR] . trivial, because these actions do not affect the supplyof minted tokens. – [Dep0] , [Dep] . trivial, because deposits increase the supply of minted tokens. – [Rdm] . Assume that the state of the AMM in Γ is ( r : τ , r : τ ). By contra-diction, suppose that the [Rdm] action burns all the v = sply ( τ ,τ ) ( Γ ) unitsof the minted token. The rule premise requires v >
0, and it implies: r ′ = r − v r sply ( τ ,τ ) ( Γ ) = 0 r ′ = r − v r sply ( τ ,τ ) ( Γ ) = 0Therefore, we would have r ′ = r ′ = 0 — contradiction.For item (b), we proceed by induction on the number of AMMs in the state.The base case is trivial, since the premise of (b) is false. For the inductive step,let Γ = ( r : τ , r : τ ) | Γ ′′ be a reachable state such that r + r >
0. Let r ′ ≤ r , and let v = sply ( τ ,τ ) ( Γ ). By item (a) we have that v >
0. By theinduction hypothesis, there exists a sequence of transactions Γ ′′ −→ ∗ Γ whereusers can redeem v : ( τ , τ ) from other AMMs. From Γ , users can performanother sequence of transactions Γ −→ ∗ Γ to transfer these units to the walletof a user, say A . Summing up, we have that Γ −→ ∗ ( r : τ , r : τ ) | Γ . Now, let:˜ v = ( r − r ′ ) r sply ( τ ,τ ) ( Γ )20ince ˜ v < v , A can fire rdm A (˜ v : ( τ , τ )), obtaining, for some r ′ ≤ r :( r : τ , r : τ ) | Γ −→ Γ ′ = (cid:0) r − ˜ v r sply ( τ ,τ ) ( Γ ) : τ , r ′ : τ (cid:1) | · · · = ( r ′ : τ , r ′ : τ ) | · · · The proof of item (c) is similar. ⊓⊔ Proof of Lemma 5
Let Γ T T −−−→ Γ and Γ T T −−−→ Γ with the followingintermediate states: Γ T −→ Γ T −→ Γ Γ T −→ Γ T −→ Γ We have the following exhaustive cases on the type of the two transactions:1. T = xfer A ( B , v : τ ).(a) T = xfer A ( B , v : τ ). Straightforward from rule [Xfer] .(b) T = dep A ( v : τ , v ′ : τ ′ ). We have that: Γ = A [ σ A ] | B [ σ B ] | Γ ′ Γ = A [ σ A − v : τ ] | B [ σ B + v : τ ] | Γ ′ If A = A , B , then the two transactions affect different part of thestate, so the thesis follows trivially. Otherwise, we have two subcases,depending on whether [Dep0] or [Dep] was used.If [Dep0] was used, then: Γ = A [ σ A − v : τ − v ′ : τ ′ + v : ( τ , τ ′ )] | ( v : τ , v ′ : τ ′ ) | Γ ′ If A = A , then σ A = σ A , and the thesis Γ = Γ follows by: Γ = A [ σ A − v : τ − v : τ − v ′ : τ ′ + v : ( τ , τ ′ )] | B [ σ B + v : τ ] | ( v : τ , v ′ : τ ′ ) | Γ ′ Γ = A [ σ A − v : τ − v ′ : τ ′ + v : ( τ , τ ′ ) − v : τ ] | B [ σ B + v : τ ] | ( v : τ , v ′ : τ ′ ) | Γ ′ If A = B , then σ B = σ A , and the thesis Γ = Γ follows by: Γ = A [ σ A − v : τ ] | B [ σ B + v : τ − v : τ − v ′ : τ ′ + v : ( τ , τ ′ )] | ( v : τ , v ′ : τ ′ ) | Γ ′ Γ = A [ σ A − v : τ ] | B [ σ B − v : τ − v ′ : τ ′ + v : ( τ , τ ′ ) + v : τ ] | ( v : τ , v ′ : τ ′ ) | Γ ′ The case where [Dep] was used is similar. In the following cases we omitthe detailed computation of the states as done here, and we appeal theintuition to argue for the equivalence of the reached states.21c) T = swapL A ( v : τ , v ′ : τ ′ ). The equality of Γ and Γ follows fromthe fact that neither the updated users’ balances nor the amounts whichupdate the AMM depend on the current state. In particular, the fundsinvariant only depends on the values r and r ′ .(d) T = swapR A ( v : τ , v ′ : τ ′ ). Similar to the previous case.(e) T = rdm A ( v : τ ). The thesis follows from the fact that the only partof the state which affects the update of the users’ balances and the AMMis the supply of the minted token, which is not affected by T .2. T = dep A ( v : τ , v ′ : τ ′ ).(a) T = xfer A ( B , v : τ ). Symmetric to case (1b).(b) T = dep A ( v : τ , v ′ : τ ). If ( τ , τ ′ ) = ( τ , τ ′ ), then the thesis isstraightforward. Otherwise, note that the amount of tokens minted bythe AMM only depends on the ratio between the amounts of τ and τ ′ initially held by the AMM, and the values subsequently transferred tothe AMM by T and T .(c) T = swapL A ( v : τ , v ′ : τ ′ ). By hypothesis, { τ , τ ′ } and { τ , τ ′ } aredisjoint. The thesis is straightforward, because AMMs operating on dis-tinct token pairs do not interfere.(d) T = swapR A ( v : τ , v ′ : τ ′ ). Similar to the previous case.(e) T = rdm A ( v : τ ). If ( τ , τ ′ ) = ( τ , τ ′ ), then the thesis is straightfor-ward. Otherwise, note that the amount of tokens minted by the AMM inresponse of T only depends on the ratio between the amounts of τ and τ ′ initially held by the AMM, and the values transferred to the AMMby T . Similarly, the tokens paid by the AMM in response of T onlydepend on the ratio between the amounts of τ and τ ′ initially held bythe AMM, which are constrained to preserve the ratio, and the amountdeposited by T . Then, the two transactions are concurrent.3. T = rdm A ( v : τ ).(a) T = xfer A ( B , v : τ ). Symmetric to case (1e).(b) T = dep A ( v : τ , v ′ : τ ′ ). Symmetric to case (2e).(c) T = swapL A ( v : τ , v ′ : τ ′ ). By hypothesis, { τ , τ ′ } and { τ , τ ′ } aredisjoint. The thesis is straightforward, because AMMs operating on dis-tinct token pairs do not interfere.(d) T = swapR A ( v : τ , v ′ : τ ′ ). Similar to the previous case.(e) T = rdm A ( v : τ ). The tokens paid by the AMM in response of T and T only depend on the ratio between the amounts of τ and τ ′ initiallyheld by the AMM, which are constrained to preserve the ratio.4. T = swapL A ( v : τ , v ′ : τ ′ ). The only case not covered by the previousone is when T = swapL A ( v : τ , v ′ : τ ′ ). By hypothesis, { τ , τ ′ } and { τ , τ ′ } are disjoint. The thesis is straightforward, because AMMs operatingon distinct token pairs do not interfere.5. T = swapR A ( v : τ , v ′ : τ ′ ). Similar to the previous case. ⊓⊔ Lemma 8. λ ∼ λ ′ = ⇒ ∀ λ , λ : λ λλ ∼ λ λ ′ λ .Proof. Direct from the fact that semantics of transactions is a function (Lemma 1),and it only depends on the states after the execution of λ and λ ′ , which are equalstarting from any state Γ , since λ ∼ λ ′ .22 roof of Theorem 1 By definition, is the least equivalence relation closedunder the following rules (where ε denotes the empty sequence): ε ∼ ε [0] T ∼ T [1] T T ′ TT ′ ∼ T ′ T [2] λ ∼ λ ′ λ ∼ λ ′ λ λ ∼ λ ′ λ ′ [3] Let λ ∼ λ ′ . We have to show λ ∼ λ ′ . We proceed by induction on the rulesabove. For rules [0] and [1] , the thesis follows by reflexivity, since ∼ is an equiv-alence relation. For rule [2] , the thesis follows immediately by definition of theconcurrency relation [3] , first note that λ = λ λ and λ ′ = λ ′ λ ′ . Bythe induction hypothesis it follows that: λ ∼ λ ′ and λ ∼ λ ′ Therefore, by two applications of Lemma 8: λ = λ λ ∼ λ λ ′ ∼ λ ′ λ ′ = λ ′ ⊓⊔ Proof of Lemma 6
Define the rank k τ k of a token τ inductively as follows: k τ k = ( τ ∈ T max {k τ k , k τ k} if τ = ( τ , τ )and accordingly define the rank of A in Γ as: k Γ k A = ( max {k τ k | τ ∈ dom σ } if A [ σ ] ∈ Γ n = k Γ k A . In the base case n = 0, A ’s wallet in Γ contains only initial tokens: here, rdm A ( Γ ) = Γ , so the thesis is immediate.For the inductive case, let n >
0, and assume that the statement holds for all n ′ < n . Let τ , . . . , τ k be the tokens of rank n in A ’s wallet A [ σ ]. Let: Γ = Γ rdm A ( σ ( τ ): τ ) −−−−−−−−−−→ Γ rdm A ( σ ( τ ): τ ) −−−−−−−−−−→ · · · rdm A ( σ k − ( τ k ): τ k ) −−−−−−−−−−−−→ Γ k where Γ i = A [ σ i ] | Γ ′ i for all i < k . The rank of each token in A ’s wallet in Γ k isstrictly less then n . Therefore, by the induction hypothesis: W A ( Γ k ) = P τ ∈ dom σ k σ k ( τ ) · P ( τ )By Lemma 3, we have that W A ( Γ ) = W A ( Γ k ), from which the thesis follows. ⊓⊔ roof of Theorem 2 Proof by cases. For ( r : τ , r : τ ) ∈ Γ – (a) lim v → XL swap Γ ,φ ( v , τ , τ ) = φ · lim v → XL swap ( v , r , r ) > XL Γ ( τ , τ ) – (b) lim v → XR swap Γ ,φ ( v , τ , τ ) = φ · lim v → XR swap ( v , r , r ) > XR Γ ( τ , τ ) – (c) OtherwiseWe first show that (a), (b) and (c) are both exclusive and exhaustive. Givenswap-rate-continuity (15), case (b) can be rewritten as1 φ lim v → XL swap ( v , r , r ) < XL Γ ( τ , τ ) (24)Thus, it can be observed that (a) and (b) written as (24) are exclusive: sincethe lhs of (24) is larger than the lhs of (a) for 1 ≥ φ > P ( τ ) / P ( τ ) which satisfiesboth. Furthermore, lhs’s of (a) and (24) differ such that it is possible that neitherinequality is fulfilled, implying case (c). Taking the boolean negation of (a) and(b) as (24) results in the conditions for case (c):1 φ lim v → XL swap ( v , r , r ) ≥ P ( τ ) / P ( τ ) ≥ φ · lim v → XL swap ( v , r , r ) (25)Thus, cases (a), (b) and (c) are exhaustive.We prove case (a) by inspection of [SwapL] , swap-rate-continuity (15), demand-sensitivity (16) and non-depletion (17). In order for the net worth of user A toincrease with a left swap, the following must hold: W A ( Γ ) − W A ( Γ ) = − v · P ( τ ) + v · XL swap Γ ,φ ( v , τ , τ ) · P ( τ ) > XL swap Γ ,φ ( v , τ , τ ) > P ( τ ) / P ( τ ) (26)Given case (a), there must exist a finite v which satisfies (26). Demand-sensitivity (16) ensures that XL swap Γ ,φ ( v , τ , τ ) decreases to zero with increasing v . To find optimal v which maximizes the user net worth, we consider thebehaviour of XL swap Γ ,φ ( v , τ , τ ) = XL swap ( v , r , r ) as v is increased by ∆ for( r : τ , r : τ ) ∈ Γ : XL swap φ ( v , r , r ) = v φ · v XL swap φ ( v + ∆, r , r ) = v + ∆ ′ φ · ( v + ∆ ) (27)By definition of the swap rate (12): I ( r + φ · v , r − v ) = I ( r + φ · ( v + ∆ ) , r − v − ∆ ′ ) = I ( r , r )(28)Thus from and and swap rate definition we can infer: XL swap φ ( ∆, r + φ · v , r − v ) = ∆ ′ /∆ (29)24or an incremental increase in swap amount v by ∆ , the net wealth is onlyfurther increased if ∆ ′ /∆ > P ( τ ) / P ( τ ) (26). Due to demand-sensitivity, thisratio is ever decreasing at higher values of v . Thus, for optimal v :lim ∆ → XL swap φ ( ∆, r + φ · v , r − v ) = lim ∆ → XL swap Γ,φ ( ∆ : τ , τ ) = XL Γ ( τ , τ )(30)Any infinitesmal increase in v no longer increases net wealth. We omit the prooffor case (b) as it follows that of (a).To prove case (c), we observe that since neither (a) nor (b) hold, there existsno swap which results in a net positive increase in net wealth. Thus, the strategyof the user will be to perform no action at all. ⊓⊔ Proof of Theorem 3
By inspection of swap rate definition (19) and funds-sensitivity (19). For ( r : τ , r : τ ) ∈ Γ and ( c · r : τ , c · r : τ ) ∈ Γ ′ where c >
1, the following must hold: XL swap Γ,φ ( v, τ , τ ) = r ′ − r v I ( r , r ) = I ( r + φ · v, r ′ ) XL swap Γ ′ ,φ ( c · v, τ , τ ) = c · r ′ − c · r c · v I ( c · r , c · r ) = I ( c · ( r + φ · v ) , c · r ′ )such that XL swap Γ,φ ( v, τ , τ ) = XL swap Γ ′ ,φ ( c · v, τ , τ ). Note that is implied by (19).Thus, due to demand-sensitivity, reducing the swap amount in XL swap Γ ′ ,φ ( c · v, τ , τ )to v will imply: XL swap Γ,φ ( v, τ , τ ) < XL swap Γ ′ ,φ ( v, τ , τ ) ⊓⊔ Proof of Theorem 4
Proof by inspection of transaction rules and definitionsof incentive-consistency.We begin with some auxiliary definitions. Firstly, we define sets of pairs,which fulfill a specific incentive-consistent funds invariant constraint, as con-tours : c k = { ( r , r ) | I ( r , r ) = k } (31)From definitions of incentive-consistency we can infer the following. (a) Thereexist a unique pair ( r , r ) in c k which features a given (balance) ratio r /r = r ∈ R + : swap-rate-consistency (18) implies that swap rate limits are unique topair ratios. Demand-sensitivity (16) and swap-rate-continuity (15) imply thatswap rate limits must range from 0 to infinity (16) for pairs in each contour.Thus, for each r ∈ R + , each contour must feature a unique pair which satisfiesfunds ratio r . (b) In conjunction with funds-sensitivity (19), this implies that foreach ( r , r ) in a contour c k , there must exist a pair c · r , c · r in each alternativecontour c k ′ , where c > projected redeem rate XL rdm Γ,r ( τ , τ ) where ( r : τ , r : τ ) ∈ Γ as XL rdm Γ,r ( τ , τ ) = r ′ sply ( τ ,τ ) ( Γ ) if I ( r , r ) = I ( r ′ , r · r ′ ) (32)25ere, r is the balance ratio of the pair in the initial state Γ = Γ of Theorem 4.The right version is similar. Thus, the projected redeem rate in any state Γ reachable from Γ can be interpreted as equal to the redeem rate if the balanceratio in Γ is equal to that in Γ . Thus, by subsequently proving that the projectedredeem rate is increasing with each step, we prove that redeem rate in Γ ′ mustbe higher than in the initial state Γ , since, in Theorem 4 the balance ratio r in Γ ′ equals that of Γ .We now consider how the projected redeem rate evolves for each AMM action.For a state ( r : τ , r : τ ), we interpret deposit/redeem as a step from contour c k to c ′ k , which can be defined as: c k = { ( r , r ) | I ( r , r ) = k } c k ′ = { ( r , r ) | I ( r , r ) = k ′ = k ∧ ( r , r ) /c ∈ c k } (33)where c is the change of the token balances resulting from a deposit ( c > > c ≥
0) action. In other words, for any given balance r , r andbalance ratio r = r /r in c k , a unique balance pair ( c · r , c · r ) exists in s k ′ which maintains the balance ratio r due to funds-sensitivity (19). The projectedredeem rate must be maintained for a redeem or deposit, because the numeratoris scaled by the same factor c as the denominator: the evolution of the projectedredeem rate can be described as XL rdm Γi,r ( τ , τ ) = r ′ sply τ ,τ ( Γi ) 1 I ( r , r ) = I ( r ′ , r · r ′ ) XL rdm Γi +1 ,r ( τ , τ ) = c · r ′ c · sply τ ,τ ( Γi +1) 2 I ( c · r , c · r ) = I ( c · r ′ , r · c · r ′ ) (34)Here, holds by definition of the projected exchange rate, and holds bydefinition of funds-sensitivity (19). Thus, XL rdm Γi,r ( τ , τ ) = XL rdm Γi +1 ,r ( τ , τ ) forredeem and deposit actions.A swap action in Γ = ( r : τ , r : τ ) can be interpreted as (a) a traversalwithin the contour c k = { ( r , r ) | I ( r , r ) = k } to pair ( r ′ , r ′ ) such that( r ′ , r ′ ) ∈ c k r ′ = r + φ · v r ′ = r − v · XL swap φ ( v , r , r ) (35)and (b) a subsequent traversal to pair ( r ′′ , r ′′ ) in contour c k ′ such that c k ′ = { ( r , r ) | I ( r ′′ , r ′′ ) = k ′ = k } r ′′ = r + v r ′′ = r − v · XL swap φ ( v , r , r ) (36)The proof of k ′ = k in (36) is inferred from (15): the balance pair ( r ′ , r ′ ) in (35)cannot belong in the same set s k ′ as this would imply a zero swap rate given r ′ = r ′′ , thereby contradicting swap-rate-continuity (15). Furthermore, theremust exist a pair ( r ′ + ∆, r ′ − ∆ ′ ) ∈ c k with the same balance ratio r ′′ /r ′′ (see(b) in preceding discussion of contours): r ′′ r ′′ = r ′ − ∆ ′ r ′ + ∆ = r ′′ − ∆ ′ r ′ + ∆ (37)26ote that and are equal since r ′ = r ′′ . Since numerator of the mustbe less than the numerator of the , the same must hold for the denominators,implying that all pairs in c k ′ feature higher balances than pairs in c k for a givenbalance ratio r . Note that no tokens are minted in a swap action, such that XL rdm Γ,r ( τ , τ ) must increase. ⊓⊔ σ A τ ≥ v A [ σ A ] | B [ σ B ] | Γ xfer A ( B ,v : τ ) −−−−−−−→ A [ σ A − v : τ ] | B [ σ B + v : τ ] | Γ [Xfer] στ i ≥ v i > i ∈ { , } ) τ = τ ( : τ , : τ ) , ( : τ , : τ ) Γ A [ σ ] | Γ dep A ( v : τ ,v : τ ) −−−−−−−−−−−→ A [ σ − v : τ − v : τ + v : ( τ , τ )] | ( v : τ , v : τ ) | Γ [Dep0] στ i ≥ v i > i ∈ { , } ) r v = r v v = v r · sply ( τ ,τ ) ( Γ ) Γ = A [ σ ] | ( r : τ , r : τ ) | Γ ′ dep A ( v : τ ,v : τ ) −−−−−−−−−−−→ A [ σ − v : τ − v : τ + v : ( τ , τ )] | ( r + v : τ , r + v : τ ) | Γ ′ [Dep] στ ≥ v > I ( r + φ v , r − v ) = I ( r , r ) 0 < v ≤ v ≤ r A [ σ ] | ( r : τ , r : τ ) | Γ swapL A ( v : τ ,v : τ ) −−−−−−−−−−−−→ A [ σ − v : τ + v : τ ] | ( r + v : τ , r − v : τ ) | Γ [SwapL] στ ≥ v > I ( r − v, r + φ v ) = I ( r , r ) 0 < v ≤ v ≤ r A [ σ ] | ( r : τ , r : τ ) | Γ swapR A ( v : τ ,v : τ ) −−−−−−−−−−−−→ A [ σ + v : τ − v : τ ] | ( r − v : τ , r + v : τ ) | Γ [SwapR] σ ( τ , τ ) ≥ v > v = v r sply ( τ ,τ ( Γ ) v = v r sply ( τ ,τ ( Γ ) Γ = A [ σ ] | ( r : τ , r : τ ) | Γ ′ rdm A ( v :( τ ,τ )) −−−−−−−−−−→ A [ σ + v : τ + v : τ − v : ( τ , τ )] | ( r − v : τ , r − v : τ ) | Γ ′ [Rdm] Fig. 2: Operational semantics of AMMs.
B Constant-product swap rate limit
For a right swap, the following invariant must hold for the constant productfunds invariant( r − v )( r + φ · v ) = r · r if ( r : τ , r : τ ) ∈ Γ (38)27hus for a given v , the received amount v : τ must be v = φ · v · r r + φ · v (39)By definition, the right swap rate is simply v /v , or XR swap Γ ( τ , τ ) = φ · r r + φ · v (40)The right swap rate limit is thuslim v → XR swap Γ ( τ , τ ) = φ · r r1