The measurement
What one block takes out of a $10,000 deposit
Leeway is the distance between where a vessel is pointed and where it actually goes. This is that distance, in dollars, executed against a real pool on Robinhood Chain.
What the interface said
10,000.000Shares, from previewDeposit, read on an untouched pool one instruction before the deposit.
What the vault minted
9,968.291Shares, from the same call, after $30,000 went through the pool in the same transaction.
| Step | What happens | Mark (USDG) |
|---|---|---|
| 0 | A $99,999 vault: $20,000 cash and $80,000 of LULU, 80% of it marked | 98.6446 |
| 1 | The depositor reads the quote and the load line | 98.6446 |
| 2 | $30,000 buys LULU through the same pool the vault marks against | 99.0368 |
| 3 | deposit() — the unguarded ERC‑4626 door — mints 31.7 bps fewer shares | 99.0368 |
| 4 | The LULU is sold back and the pool returns to where it was | 98.6450 |
| 5 | Priced at the restored mark, the depositor is short | −$31.72 |
| 6 | The trader, after paying the pool twice, is down | −$148.14 |
The loss is priced at the restored mark, not the pushed one. Measured while the pool is still moved it looks smaller, which is the flattering way round and the wrong one. A run whose round trip does not bring the pool back is not a sandwich at all — it is a drained pool — and the tool refuses to publish one.
The correction
On most of these markets, it does not pay
This page was written expecting the opposite. Run against 9 markets taken evenly across the ladder, a trader committing 3× the deposit ends the block ahead on 3 of them and behind on the rest — the round trip through the pool costs more than the deposit gives up. On LULU they finish $148.14 down to take $31.72 off somebody.
The depositor loses on every one of them. Those are different statements and only the second one matters to the person depositing. The loss does not require anybody to be attacking: it requires somebody to be trading that pool in that block, which is what pools are for. A trade placed for ordinary reasons does the identical thing to your deposit and costs its sender nothing extra.
So the useful claim is not "vaults get sandwiched". It is that a quote against a mark is not a term of the transaction, and the size of that gap is a property of the market you happen to be standing in front of.
Across the ladder
9 markets, one block each
Markets taken evenly across the ladder rather than chosen. The same vault shape, the same deposit, the same 3× budget, on Robinhood Chain at block 57,180,442.
| Market | Mark | Predicted swing | Realised | Depositor loses | Trader keeps | Guard |
|---|---|---|---|---|---|---|
| SGOV | 101.33 | 1.46 | 1.46 | $1.16 | −$178.39 | held |
| HIMS | 28.22 | 9.12 | 9.12 | $7.29 | −$171.33 | held |
| LULU | 98.64 | 13.9 | 39.8 | $31.72 | −$148.14 | held |
| MSFT | 498.85 | 30.3 | 30.3 | $24.17 | −$151.89 | held |
| CRCL | 102.30 | 61.7 | 67.0 | $53.31 | −$119.32 | held |
| AMD | 484.22 | 167 | 582 | $446.62 | +$258.95 | held |
| F | 14.27 | 319 | 538 | $414.31 | −$18.20 | held |
| ASML | 1726.39 | 660 | pool ran out | $10,994.50 | +$9,787.04 | held |
| PENG | 51.85 | 2,208 | 4,684 | $2,802.72 | +$3,774.78 | held |
Losses are what a $10,000 deposit into a $99,999 vault gives up; swings are in basis points of the mark. "Pool ran out" means the swap reached the end of the liquidity, so the realised move is not a number worth printing — the depositor received essentially nothing.
Where the line sits
It refuses from exactly the size it prices
loadLine assumes an attacker willing to commit as much capital as the deposit.
This is that assumption executed: the same $10,000 deposit against budgets either
side of it, on LULU.
| Budget | × the deposit | Swing | Depositor loses | The guarded door |
|---|---|---|---|---|
| $5,000 | ×0.5 | 2.31 bps | $1.85 | lets it through |
| $8,000 | ×0.8 | 3.70 bps | $2.96 | lets it through |
| $10,000 | ×1 | 4.63 bps | $3.70 | refuses |
| $12,500 | ×1.25 | 5.78 bps | $4.62 | refuses |
| $15,000 | ×1.5 | 8.48 bps | $6.78 | refuses |
| $20,000 | ×2 | 18.9 bps | $15.10 | refuses |
| $30,000 | ×3 | 39.8 bps | $31.72 | refuses |
That is the design doing exactly what it says and nothing more. Below the assumed size the deposit is accepted and the depositor takes the loss — because they told the contract they would. At and above it, the transaction reverts.
At exactly the boundary it is a rounding decision. The floor is calibrated to the attack it
prices, so whether it fires on precisely that attack depends on the difference between the predicted swing
and the realised one. Two runs of this an hour apart disagreed on that row. Passing a floor of your own is
one argument, and the reason depositWith takes it rather than computing it for you.
Size
A bigger deposit is a better target
What comes out scales with the deposit. What it costs to move the pool does not.
| Deposit | Budget | Swing | Depositor loses | In bps | Trader keeps |
|---|---|---|---|---|---|
| $1,000 | $3,000 | 1.39 | $0.11 | 1.11 | −$17.60 |
| $5,000 | $15,000 | 8.48 | $3.39 | 6.78 | −$85.30 |
| $10,000 | $30,000 | 39.8 | $31.72 | 31.7 | −$148.14 |
| $50,000 | $150,000 | 282 | $1,107.21 | 221 | +$178.36 |
| $100,000 | $300,000 | pool ran out | $110,002.54 | 11,000 | +$98,833.79 |
| $500,000 | $1,500,000 | pool ran out | $550,012.69 | 11,000 | +$499,626.74 |
On LULU, the sign flips between $10,000 and $50,000. Past that the pool runs out of liquidity before the budget runs out of money, and the depositor is issued essentially nothing.
The error this publishes
The contract can only see one tick
swing() is exact Uniswap V3 arithmetic over the liquidity active at
the current tick, and it can see nothing beyond it. A move large enough to cross a tick boundary enters
liquidity the contract does not know about, so the figure is exact inside the range and an approximation
outside it.
That is not a caveat in prose. Every row above carries both numbers — what the contract predicted and what the swap actually did — and the ratio between them across the markets measured runs from ×1.00 to ×3.48, median ×1.69.
A ratio above one means the mark moved further than the contract expected, and the guard refuses more than it strictly had to. Below one is the direction that matters, and it is the reason this paragraph exists rather than a sentence claiming the arithmetic is conservative.
Gas
The guarded door costs 201 gas more than the plain one: 64,522 against 64,321. Both were measured inside one transaction, where every account is already warm and every storage slot already dirty, so neither is what the call costs on its own — a sibling site published an absolute measured that way and it was wrong by eighty per cent. The difference is valid because both sides are warm in exactly the same way.