feat(core): set min_amount_out from the pAMM fallback amount

[tamaralipows]

Fynd side of the pAMM simulation fix. Contract side: propeller-heads/tycho#1278.

Problem

propeller-heads/tycho#1278 makes the PropAMMRouter fall back to a Uniswap V3 pool when a stale pAMM quote reverts the venue. That is not enough, because Fynd writes min_amount_out before the fallback runs.

The pAMM quotes 2000 USDC. The user accepts 1% slippage.

1. Fynd quotes the pAMM leg          -> 2000 USDC
2. Fynd writes min_amount_out        -> 1980 USDC   (2000 less 1%)
3. Integrator simulates. pAMM stale. Router falls back to Uniswap V3.
4. Uniswap V3 pays                   -> 1950 USDC
5. TychoRouter compares 1950 < 1980  -> revert

Step 3 works. Step 5 fails, so the revert moves from StaleUpdate to NegativeSlippage.

How it works

Four steps, one per commit.

Learn which pool the router would use. The router picks it with resolvedFee(tokenIn, tokenOut), a public view function. A background task reads that on a timer and caches it. Governance changes it rarely, and only about 12 pairs across Fermi and Kipseli need one, so the quote path never waits on RPC.

Keep the candidate pools indexed. Each solver worker holds an index of Uniswap V3 pools by token pair and fee tier, built once and updated from market events. A pool qualifies on its component alone, so the index only moves when the market adds or removes one. Rebuilding it per block would cost 97 ms.

Price the fallback while solving. When a worker produces a route with a pAMM leg, it replays that route with each pAMM leg swapped for its fallback pool, and stamps the result on the route. Replay is the existing replay_route, so split fractions and shared-pool depletion behave as they do everywhere else. A route whose fallback cannot be priced is dropped rather than quoted — with no fallback amount there is no min_amount_out we can justify.

Use it when encoding. The encoder derives min_amount_out from the stamped amount instead of the pAMM quote. amount_out in the response stays the pAMM quote; only the floor moves.

No client impact

Clients change nothing.

The wire format is untouched — clients/openapi.json is identical to main, so there is no field to set and no client to regenerate.

Nothing emits propammfallback: yet, so today every route reports no pAMM leg and behaviour is unchanged. Venue selection turns it on.

Once on, amount_out still carries the pAMM quote. Only min_amount_out drops, on pAMM routes, which is what lets those quotes simulate.

Still open

Selecting which venues use the propammfallback: prefix. That belongs in tycho-simulation's PriceLevelStreamBuilder (propeller-heads/tycho#1212) and must read the router's on-chain whitelist.

Limits

bopAMM does not work. The PropAMMRouter whitelist does not contain its venue, so bopAMM quotes continue to fail simulation.

A venue outside the whitelist is worse than not doing this. Every swap then executes on Uniswap V3 at a worse price than the pAMM gives.

Large trades get weak slippage protection. One pool in one fee tier moves 60 bps on 1000 WETH to USDC (about $1.87M), and 7 bps on $2M USDC to USDT. min_amount_out also bounds a sandwich attack, so a low floor widens it — about $11,200 of headroom on that WETH trade.

Set a cap before this ships: trade size, or refuse the pAMM leg when the fallback sits more than N bps below it. Open decision.

🤖 Generated with Claude Code

[tamaralipows]

This is the file I've reviewed the least. Please use extra care here