Risks

Myelin is new software that moves money. This page lists what can go wrong, what limits the damage and what does not. Read it before you put anything in.

If you swap

• The fee changes from swap to swap. It moves between 0.0516% and 0.4127% of the amount you trade. The swap panel shows what it would be now. If another swap lands first, yours can be priced differently; set a slippage tolerance, as in any pool (it also caps what a higher fee can cost you).
• The model can be wrong. A fee that is too high costs you; one that is too low costs the liquidity providers. The band above bounds the damage, but within it the model knows nothing about news or about other venues; it sees only this pool’s recent price moves.
• Anyone can compute your fee in advance. The model and the pool’s memory are public. A bot can wait for a cheap moment, or move the price first (see Manipulation). This is true of every dynamic fee, and it is why the fee is capped.
• Sandwiching, price impact and thin pools are as in any Uniswap pool.

If you provide liquidity

• There is no evidence that this fee earns you more. On real swaps the model predicted movement well, and the project’s own test, that the network leaves liquidity providers better off than a one-line rule in a majority of pools, is passed (4 of 4). We do not read the pass as evidence: the rule got weaker on the new inputs, only one pool’s margin is clear of zero, and set against the rule as it was on the first version’s inputs, the network is behind in the busiest pool. In three of the four pools, liquidity providers lose money under every policy tested. See the backtest results. Myelin shows a mechanism, not a result.
• 10% of every fee goes to the Treasury, not to you. It is a fixed part of the fee, set when the hook was deployed. The data does not show that you get it back in a better fee: in the backtest, the part of the fee liquidity providers could give away and still match the better of a static fee and the rule is 9% at most, and nothing in one of the four pools.
• Impermanent loss, adverse selection and a price that leaves your range apply here as in any concentrated pool. A fee that follows risk aims to reduce some of this; it cannot remove it, and the backtest did not show that it does.
• The hook cannot lock your position. It takes no part in adding or removing liquidity, so even if it failed, you can take your position out through the position manager. If the hook fails, swaps in the pool revert.

Manipulation

Everything the model reads is public: the pool’s own recent price moves and the block’s time. Anyone can call the model for free, compute the fee of the next swap exactly, and try to shape the pool’s memory first. We measured how far that goes (research/V2_SPEC.md, section 8.4).

• The band is the hard limit, and it is wide. The fee is clamped between 0.0516% and 0.4127% whatever the model says, so the same trade can cost 8 times as much at the top as at the bottom.
• The memory moves only when the price does. A swap is an observation only if the pool’s tick is at least 3 ticks from the tick of the last observation and the block is later than that observation’s. A swap of one wei, a flicker between two adjacent ticks and a burst inside one second write nothing. In our tests 1,000 swaps of one wei changed the memory in none of 480 real pool states, and no sequence of swaps produced two observations in one second. The first version of the memory counted every swap: 64 swaps of one wei in one second took a fee from 0.1011% to the 0.4127% cap.
• Moving the fee now takes a real move of the price. In a search over 480 real pool states, the cheapest way found to push the fee to its cap took a median of 68 ticks of price movement over about 21 seconds, or 358 ticks if it must all happen inside one block (and in 17% of the states not even that reaches the cap in one block). The first version needed 2 ticks, and none at all in nearly half of the states. Pulling the fee down to its floor is no faster than waiting: a median of 1,151 seconds, against 8 before. These are upper bounds from a search; a cleverer attacker may do somewhat better.
• What it costs grows with the pool’s depth. In ETH/USDG the median move of 91 ticks is about 1.65 million USDG of net buying at the liquidity of those states (a rough estimate). In the shallower pools of the research it is 53 to 63 ticks: about 6,000 USDG in NVDA/USDG and about 2 ETH or less in the two token / ETH pools. The protection scales with depth, and in a shallow pool it is small in absolute terms, where the fee at stake is small too. The move is the price the attacker has to push, not what the attacker loses: that is the fees paid and what arbitrageurs take back.
• Most inputs are damped moving averages, so one ordinary observation moves them only part of the way.

What this means: nobody can take your principal this way, and nobody can move the fee for the price of a wei, but the fee you pay, and the fees liquidity providers earn, can still be moved by someone who will move the price, at any moment. Treat the fee the swap panel shows as the fee now. The memory also sees less than before: in the deepest pool about 5% of the swaps are observations, and what the network reads is mostly when the price moved, not how far (The model).

The contracts

• Nothing can be changed or paused. There is no owner, no admin function and no upgrade path. That is a feature, and it means a bug cannot be patched: the fix is a new hook and a new pool.
• The hook never holds a token. Its share of a fee is minted straight to the Treasury inside the swap. The tests check this as an invariant.
• If the model call fails the hook charges a fixed fallback fee (0.1032%), emits ModelFailed, and the swap goes through. The model has no storage and clamps its inputs, so it is not expected to fail.
• It costs gas. About 60,000 more than a swap without the hook when the swap leaves the memory alone, and about 76,600 when it writes it, of which the model is 21,890.
• Myelin relies on Uniswap v4’s pool manager, on transient storage, and on the chain’s block timestamps (many blocks share one second, and the limit of one observation per second is counted in timestamps, so it is only as good as they are). A fault in any of them is a fault in Myelin.
• The chain’s sequencer orders transactions, and can reorder or censor them. That is a property of the chain.

The Treasury and the token

• The buyback’s price limit holds a sandwich to the band, not to the slice. The swap of a call never pays more than 300 ticks (about 3%) above the pool’s average price of the last 30 minutes, which an oracle records and which cannot be moved inside one transaction. In our tests a sandwich costs the Treasury at most that band: front-running one or two slices makes it pay 1% and 2% over the honest price, and front-running five or more makes the call revert. The first design measured its guard against the spot price in the same transaction, and there a sandwich cost the Treasury 2% to 17% of a call’s burn while a position placed at the moved price took about 63% of a slice. See Treasury.
• What the limit does not stop. Holding the price up for minutes moves the average by the share of the 30-minute window for which it is held (20 minutes moves it by two thirds), which costs whoever does it against everyone who trades. A new buyback pool has no 30 minutes of price history, so no call goes through in its first half hour. Each call spends at most 5% of the claims in a currency, once an hour.
• Someone has to call it. Nothing calls the buyback by itself, and nothing pays the caller. If nobody calls, the claims pile up unspent. Anyone can call, and the repository has a keeper script that does; a keeper risks only the gas.
• The buyback pools can run dry. Their liquidity belongs to whoever holds the position NFTs, which is the deployer unless they were given to an address nobody controls. If it is withdrawn, a call buys nothing and fails until someone adds liquidity. A slice that is too big for the pool is filled in part, and the rest stays as claims, so nothing is lost.
• Claims in a currency with no buyback pool can never be spent. The hook only opens pools whose two currencies the Treasury can spend, but anyone can send the Treasury claims in any currency, and nothing else can move them.
• Burning is not a promise about a price. It reduces a supply; it says nothing about what anyone will pay.
• The project token is MYL, contract 0x6C71AB1c7CbbA4194Fe956AA9e1fe4895d09fF43. Check the address before you buy anything that calls itself a Myelin token. Burning is not a promise about a price.

This website

• The site is a static page that reads the chain through a public RPC, which is free and rate limited. If it is slow or down, the contracts are not affected, and you can use them from any other interface.
• Your wallet signs what you approve. Check the contract address in the wallet’s prompt against the Networks page and the block explorer before you confirm.
• Swaps and positions are made through Uniswap’s own router and position manager, not through contracts of ours.

What has and has not been done