Manifesto

Why we built a new AMM instead of another manager on top of an existing one: the constraints we hit providing liquidity on concentrated-liquidity DEXs, the design space they leave open, and what the Adaptive Inventory Market Maker (AIMM) ships in response: a keeper-pushed external mark, a spline depth profile fitted from observed price density, one multi-asset pool with no pair limit, and coverage-driven inventory skew. Prior art per piece: Foundations.

1. Origin: why BTR

1.1. Where we started

We have provided liquidity for years, on order books and on-chain, on top of existing concentrated-liquidity DEX stacks (Uniswap V3/V4, Raydium CLMM, Meteora DLMM, Orca Whirlpools). That work exposed the structural constraint BTR is built around.

1.2. The constraint

Managing liquidity on a concentrated-liquidity protocol is an execution job more than a pricing job. The DEX supplies almost none of the tooling it takes.

The visible cost is the range: a position earns nothing outside its bounds, so it has to be moved, and every move is a transaction. The larger costs come with each move.

• Rebalancing is not only about ranges. Capital also has to move between pools. Fee tiers are not interchangeable: the same pair at 5 bps and at 30 bps earns differently, and which one pays depends on the regime. A quiet market favours the tight tier; a trending one favours the wide tier, because the fee has to cover what the move costs the position. Tracking that and acting on it is a standing job.
• Moving inventory is itself a trade. Rebalancing means selling one leg to buy another, at size, without giving back the edge the rebalance targets. That requires execution tooling: splitting across venues, routing through aggregators (atomic and intent-based), and measuring realised fill cost. None of it is DEX functionality.
• The optimisation is confined to the tick model. You can choose bounds; you cannot choose how the curve prices between them, and you cannot make the pool quote off anything but its own reserves.
• The decisions need a price the DEX does not have. Off-chain rebalancing logic needs a reference that is faster and more transparent than the pool’s own state, and faster than general-purpose oracles (Pyth, Chainlink) were built to deliver.

The manager ends up running a market-making operation on a venue that supplies none of the primitives it needs. The hard problem is the market making, not the pool: pricing, inventory and execution. A CL DEX leaves all three to the LP and presents the position to depositors as passive.

Uniswap V3 is a good venue for traders and a poor one for liquidity providers: the design assigns the market-making work to LPs it treats as passive. V4 does not change that. Hooks add flexibility for the hook author; for a liquidity provider they add another axis of fragmentation and one more thing to evaluate before depositing.

We did not ship AIMM as a V4 hook. A hook would charge traders gas on every swap to reach logic that does not need V4’s core, and it would tie AIMM to an architecture whose central assumption, that a pool prices off its own reserves, is the one AIMM replaces.

This is why we built multi-asset pools: spline-based, inventory-aware, natively single-sided.

A better DEX design can enable:

• Dynamic fees computed on-chain from keeper-pushed σ / confidence / staleness (plus inventory skew on mid); fee math is on-chain, mark inputs arrive via the keeper feed
• Capital efficiency through unified multi-asset pools: stables, LSTs, and volatiles together, serving different user needs (low risk, yield, exposure) with reduced fragmentation
• Native inventory management eliminating rebalance transactions
• No quote intermediary: the pool prices every swap itself. The one off-chain dependency is the attested mark, and it is re-verified on chain against a k-of-n signer quorum before it can price anything

2. Order books against AMMs

2.1. Order books are mature; AMMs are not

Order books are mature infrastructure. The dominant narrative, that on-chain CLOBs (dYdX, Hyperliquid, Aster, Lighter) represent DeFi’s future, has merit: professional market makers prefer order books, CEXs run on them, and on-chain CLOBs are a natural evolution.

Order book mechanics are well understood; there is little unexplored design space. AMMs are younger. Concentrated liquidity (2021) was the last major architectural shift. The design space for oracle-aware, inventory-conscious, dynamically-priced AMMs is largely open.

2.2. Complementary, not competing

AMMs and order books are not substitutes. Each has structural advantages:

Order books require active market makers willing to quote. No maker interest means no liquidity. The long tail of crypto assets needs AMMs for that reason.

Two structural advantages AMMs have over CLOBs:

1. N-asset pooling: Order books pair assets 1:1. AMMs can pool N assets together, sharing liquidity across all pairs. This is impossible in current CLOB designs and enables capital efficiency that scales with asset count.

2. Dynamic depth curves: volatility-responsive liquidity concentration in an order book requires continuous quote updates across the entire book, at prohibitive infrastructure and gas cost. AMMs encode it natively in the pricing function. Gyroscope’s E-CLP demonstrated concentrated elliptical curves; AIMM extends this with volatility-scaled dispersion that widens or tightens the depth curve with market conditions.

2.3. The same advances that enable CLOBs make AMMs better

The case for on-chain order books rests on blockchain improvements:

• Cheap transactions → market makers can quote/cancel profitably
• Fast block times → real-time price discovery
• Low latency finality → competitive with CEX execution

The same advances benefit AMMs at least as much:

The MEV surface shrinks on fast chains:

• Block time drops from 12s → as low as 10ms on the fastest L2s/alt-L1s = 1000× smaller MEV window
• Arbitrageurs have less time to front-run oracle updates
• Statistical arbitrage becomes harder (price lag approaches zero)
• JIT attacks become unprofitable (must predict sub-second flow)

Dynamic compute is now viable everywhere:

• Since early 2025, L1 Ethereum base fees have dropped by more than 90%, making on-chain volatility tracking and dynamic fee computation economically viable, especially with efficient compute and data storage. Swap gas on AIMM is within the same order of magnitude as Uniswap V4 on L2s.
• On modern L2s (Base, Arbitrum) and fast alt-L1s: basically free.

Fast chains make AMMs competitive with CLOBs: they remove most of the historical AMM weaknesses (lag, static fees, MEV vulnerability).

2.4. Embedding CLOB market-making logic into AMM design

Order books work because the market makers on them:

• Adaptive strategies: Widen spreads during volatility
• Inventory protection: Quote asymmetrically based on position
• Risk pricing: Charge more for adverse conditions

Static AMMs leave adverse-selection management to the LP. AIMM internalizes it in the curve.

AIMM implements the same behaviours in the pool:

2.5. The permissionless imperative

Order books require someone to provide liquidity. That is a centralization risk: market makers can withdraw, coordinate, or be regulated away.

Permissionless liquidity is DeFi’s core property. RFQ systems, solver auctions and off-chain quote infrastructure re-centralize liquidity provision.

AIMM keeps trading permissionless, with two gates outside it: pool creation is owner-only (§8.2), and a leg can restrict deposits to an owner-set allowlist:

• No privileged trading class: no whitelist, no solver set, no manager lease. Every address trades the same quote, and adverse selection is priced in the fee rather than sold to a curated counterparty.
• No price authority in one key: BTR does not acquire or aggregate prices. It consumes attested marks from off-chain mark providers and re-verifies them on chain: price authority is the k-of-n signature set recovered against the granted signer roster, and the allowlisted relayer that pays the gas authors nothing. A compromised attester key is answered by an instant lane halt; the roster rotates only through setAuth at the GOVERNANCE tier. See Mark Relayer.
• Per-asset reference bands: each mark is checked against the same lane’s reference tier, a second attestation of the same pair under its own roster. An agreement check, not a peg test: it catches one feed disagreeing with another, and there is no parent-depeg breaker for an anchor-attested child.
• Open participation: anyone can swap, on every pool, with no approval. Liquidity provision is open on the same terms unless a leg was listed behind the per-leg deposit gate.

Most AMM design research in 2025 trends toward centralization: oracle-dictated pricing, whitelisted market makers, MEV auctions. AIMM addresses the same problems without a privileged party. See Foundations §15 for the comparison with RFQ/intent protocols.

2.6. The transparency thesis

The most effective oracle-referenced market makers in production, the Solana proprietary AMMs (HumidiFi, Obric, SolFi and peers; see Foundations §19.5), are closed-source and privately operated. Quoting methodology, parameter-update policy and on-chain compute-unit optimizations are unpublished, and the outperformance accrues to the operating teams. An LP in a closed prop AMM has no visibility into how their capital is priced or what risk it takes.

BTR’s position: the pricing engine is open. The methodology (mark-centered spline, inventory skew, multi-term spread) and the research it rests on are published in these docs; every parameter that drives live quotes is on-chain state readable by any address, not an off-chain secret; the contract interfaces are public (ABIs served at GET /v1/abis/<ContractName>), so anyone can check the deployed enforcement surface against the published formulas.

The cost: an open method can be studied by adversaries and copied by competitors (BTR makes no “unforkable” claim; see §9.2). A published method is easier for LPs to price and for outside researchers to check.

3. The opportunity: AMM design space is still open

Decentralized exchanges processed $1.3 trillion in spot volume in Q3 2025. The architecture behind that volume is unchanged since concentrated liquidity arrived in 2021: a concentrated-fee CFMM (Curve) or a tick-based CLMM (Uniswap V3), with Uniswap taking 35-50% of it and Raydium CLMM, LFJ’s Liquidity Book, Meteora DLMM and Orca’s Whirlpools all running variations of the same model.

Uniswap v4’s hooks allow more advanced AMMs: volatility tracking, dynamic fees, inventory awareness. Uniswap V4 did not invent hooks: Balancer V3 and Algebra Integral (which calls them “Plugins”) had them first. V4 is infrastructure; default-hook curation is left to integrators.

Three structural trade-offs remain open in the status quo:

3.1. Static price discovery

Current AMMs derive price directly from reserves through rigid invariant formulas:

These parameters are static. Curve’s A coefficient and Gyroscope’s λ stretch factor do not respond to market volatility, price velocity, or inventory imbalance. They mechanically map reserves → price regardless of market conditions.

3.2. Fragmented capital

Isolated pairs, fee tiers and hooks split liquidity across thousands of pools. A single token might have:

• 5+ fee tiers on Uniswap (0.01%, 0.05%, 0.3%, 1%, custom)
• Separate pools on each L2/rollup
• Fragmented TVL across hook-enabled variations
• Multiple competing ranges within each pool

Capital efficiency falls, traders get worse execution, and LPs are spread across competing pools.

3.3. LVR: the largest LP cost center

Loss-Versus-Rebalancing (LVR) is the dominant LP cost, accounting for 5-7% of LP liquidity annually - hundreds of millions in aggregate. Research by Milionis et al. established that AMMs systematically trade at worse-than-market prices, creating guaranteed arbitrage profits.

“Fees do not sufficiently compensate for arbitrage losses in most of the largest Uniswap liquidity pools, historically, returns from fees have been smaller than losses to arbitrageurs.” -Measuring Arbitrage Losses and Profitability of AMM Liquidity (2024)

LVR accounts for more value extraction than frontrunning and sandwich attacks combined. Every major AMM, including Uniswap V4’s hook ecosystem, has the same exposure, whether the pool prices from reserves (CLMMs) or from a TWAP/VWAP (Curve’s EMA): constant fees and reactive reserves admit one-sided extraction in most regimes. V4 hooks are one mitigation surface; AIMM takes a curve-native path.

Uniswap v4 and Balancer V3 hooks host active experiments in LVR minimization, volatility-based fees and impermanent-loss hedging.

A purpose-built AMM with native volatility tracking, dynamic fees, inventory-aware pricing and multi-asset pools carries less overhead and inherits neither the pair-isolation nor the static-invariant constraints of earlier designs.

3.4. Why passive and concentrated liquidity cannot reliably beat HODL

The main motivation for AIMM is a result about the LP position itself: a Uniswap-v3-style concentrated-liquidity LP cannot reliably beat buy-and-hold or a constant-mix (50/50) benchmark, even with optimized ranges, active range-shifting and well-timed rebalancing. The reason is structural:

• LVR is bound to realized volatility. The rebalancing rent a CL position pays scales with σ² and is paid whether price moves up or down (Milionis et al. 2022). Concentrating the range raises fee density and LVR density together; the ratio does not improve.
• Fee income is not tied to LVR paid. Volume varies day to day and there is no mechanism binding fees earned to the toxicity absorbed. A CL position writes an option (gamma) to arbitrageurs and collects fees that are not guaranteed to cover the premium. In most of the largest Uniswap pools, historically, they have not (Measuring Arbitrage Losses and Profitability of AMM Liquidity, 2024 - the empirical companion to the LVR result quoted in §3.3).
• Timing cannot close the gap. Because the loss is symmetric in price direction and the fee stream is exogenous, entry/exit/range timing cannot systematically convert the position into a positive-carry one. This matches the broader oracle-AMM literature (Milionis et al.; Bergault et al.) and our own two-year walk-forward backtests, which find directional CL edge indistinguishable from a random walk out-of-sample.

BTR therefore does not build on passive or concentrated liquidity provision. AIMM prices the toxicity that CL gives away: the fresh mark removes the stale-quote LVR channel, the σ-scaled spread charges for the volatility that drives it, and the inventory skew reprices the position instead of rebalancing it.

4. The evolution: from strict invariants to inventory-first pricing

AIMM does not drop invariants entirely; it loosens the strict relationship between reserves and price. That relationship now lives in the inventory skew, shaped by the asset’s liquidity profile, with a symmetric market-aware spread (volatility, feed confidence, keeper-lag staleness) around the inventory-dictated price.

How AIMM pricing works:

1. Mark = per-asset, read from the contract that asset names: a lane of the pool’s mark store, with an internal par helper reserved for cash collateral. See Mark Relayer.
2. Mid-price = adjusted based on inventory skew (inventory risk management) along pair-specific liquidity profiles with volatility-scaled dispersion. See Anchor-Tree Pricing.
3. Spread = the round-trip fee width, symmetric around the mid-price = volatility band + feed-confidence surcharge + keeper-lag staleness surcharge (no directional term). A single swap pays half of it, once, on the output; total cost is that half plus price impact plus the coverage toll, and impact is the direction-asymmetric part (Slippage & Price Impact §1.1).

4.1. The asset-liability foundation

Platypus Finance and later Wombat Exchange were the earliest on-chain asset-liability AMMs: what the pool owes LPs tracked separately from what it holds, which buys single-sided deposits and an explicit per-token solvency figure, the coverage ratio. Their pricing used coverage only as a slippage modifier on a strict invariant bonding all pooled assets together. AIMM keeps the two ledgers and the ratio and takes the pricing from market-making theory (§4.5). Full derivation and what changed: Foundations §3.

4.2. The PMM lineage (DODO)

DODO’s Proactive Market Maker introduced oracle-anchored, inventory-aware quote adjustment for AMMs. AIMM’s computeInventorySkew takes DODO’s mid shift, measures inventory as the coverage ratio instead of a reserve ratio, and layers it with a spline depth profile and the keeper mark; Avellaneda-Stoikov frames the same object as a continuous-time optimal-control problem, and AIMM is the discrete on-chain instantiation. Curve, formulas and the full delta: Foundations §3.4.

4.3. Per-asset mark sources

Each listed asset names the store lane its mid comes from (OracleConfig.lane): a k-of-n signed push into the pool’s mark store, with an internal par helper reserved for cash collateral whose price is fixed at 1.0. Neither path serves an on-chain price EMA. The provider behind a lane is a deployment fact, not part of the design, and the reference band forces a second tier on the same lane. Mode semantics, reference-feed gating and the selection guidance for a listing live in Mark Relayer.

4.4. Consolidated heritage

BTR is an explicit synthesis, not a clean-room invention: the reservation-price mid from Avellaneda-Stoikov, the optimal-quote structure from Bergault et al., asset-liability accounting with coverage as the inventory measure, and the singleton multi-asset pool from Balancer, Curve V2 and Uniswap V4. Curve V2’s internal price and concentration are replaced outright, and the spline depth curve has no known DeFi AMM precedent. Component-by-component attribution: Foundations §12.1.

4.5. Academic lineage: the oracle-AMM line

The protocol prior art above (DODO, Curve, LFJ) shaped the mechanics; the design intent comes from a specific academic line; AIMM is an on-chain implementation of it:

• Loss-versus-rebalancing (LVR) - Milionis, Moallemi, Roughgarden, Zhang, Automated Market Making and Loss-Versus-Rebalancing (2022, arXiv:2208.06046). LVR is the rent a CFMM pays to arbitrageurs for quoting a stale, reserve-derived price; it is bound to realized volatility and is incurred whether or not fees compensate. This is the cost AIMM is built to price rather than give away.
• Oracle-AMM pricing functions - Bergault, Bertucci, Bouba and Guéant, Automated Market Makers Designs beyond Constant Functions (2022, arXiv:2212.00336) and Price-Aware Automated Market Makers: Models Beyond Brownian Prices (2024, arXiv:2405.03496). This line derives the mean-variance-optimal quotes for an AMM that references an imported mark: markups linear in inventory, a spread that scales with volatility, and liquidity that is not statically fixed. AIMM’s shipped pricing forms map directly onto that structure - a mark-centered spline (external reference), linear inventory skew (the reservation-price markup), a σ-scaled spread (the vol-optimal width), and a σ√τ staleness surcharge (the lagged-oracle pick-off term).
• Inventory reservation price - Avellaneda, Stoikov, High-frequency trading in a limit order book (Quantitative Finance 8(3), 2008). The reservation price $r\left(q\right)=s-q\gamma {\sigma }^2(T-t)$ - fair value shifted against inventory - is the object AIMM’s coverage-driven skew computes on-chain (see §5.3 and Foundations §2). Between keeper pushes, the pool reprices along this reservation curve around the frozen mark: inventory management, not exogenous price discovery.
• Adverse selection & the information content of order flow - Glosten, Milgrom, Bid, Ask and Transaction Prices in a Specialist Market with Heterogeneously Informed Traders (Journal of Financial Economics 14(1), 1985, doi:10.1016/0304-405X(85)90044-3). The founding result that a maker quoting to a mix of informed and noise traders must let the bid-ask reflect the information each trade reveals: inventory-moving flow is, on average, the informed/toxic flow and must pay more than round-tripping noise. This is the basis on which AIMM prices toxicity through the inventory skew rather than a flat fee: the skew is a round-trip-neutral soft fee that only informed one-way flow pays (it walks up the reservation curve and the slippage is retained as LP surplus), while a competitive minFee floor serves the benign majority. The skew law itself is fixed; what tunes competitive-vs-defensive is the depth curve the skewed mid is traversed against (its wQ shape and the live dispersion / dispRef scale) and, on a walled leg, kappaCovBps. See Spread & Fees §7.2.

On the protocol side, the same intent shows up in production: Lifinity and the Solana proprietary market makers, the EVM PropAMMs whose quotes a block builder injects into the block, and Swaap v2. They are the competitive frontier for oracle-AMM design; the factual comparison, and why BTR remains competitive on EVM, is in Foundations §19.4.

5. The solution: AIMM

AIMM (Adaptive Inventory Market Maker) extends the liability model:

5.1. Mark-centered spline pricing

Price is decoupled from reserves: AIMM quotes off a fresh external keeper mark rather than an invariant formula.

1. External mark: a fresh per-asset mark1e18, landed by a quorum-signed push. Cadence is the keeper’s (a per-asset deviation threshold θ, or a heartbeat); what the chain enforces is the per-push deviation band, the feed TTL and the confidence ceiling. The pool quotes off this mark, not off a lagging average.
2. Single pushed volatility σ: one realized-vol value sent with the mark, floored on chain at the realized move, driving dynamic spread adjustment.
3. Spline curves: clamped quartic I-splines (C2 density, monotone) defining liquidity depth at any price point. They live in a per-pool curve table; each asset points at one by curveId.

Every launch pool takes its price from outside, stable-core included. The INTERNAL par helper is not an alternative quote source: it is a fixed 1.0 for cash collateral, never valid on the base token. Tail risk is gated by per-asset depeg bands, each leg’s mark held within refBandBps of an independent reference feed for the same pair, plus a base-token depeg halt. Stables can trade off peg for extended periods; the mark tracks the signed source, and inventory skew prices microstructure around it.

Liquidity profiles are arbitrarily shapeable:

• Concentrate liquidity around expected price ranges
• Create asymmetric depth for directional markets
• Update profiles based on multi-timeframe price density analysis

Spline-based liquidity profiles appear to be novel in DeFi AMM design. For comparison with elliptical (Gyroscope) and parametric curves, see Foundations.

5.2. Multi-asset unified pools

AIMM pools contain any number of tokens priced through a multi-anchor tree rooted at the base token (MAX_DEPTH = 4). Each asset anchors to one parent, which is not required to be the base.

Swaps do not all path through the base token. Each asset anchors to its correlated parent, so the path between two assets runs up to their lowest common ancestor and back down. Two assets can share an ancestor well below the root: USDT -> USDC -> DAI never consults the base mark. Accounting is still in the pool’s base token (the numeraire), and every anchor chain terminates at the root, which is what makes unified accounting and risk management possible. The consequence: a BTC-based or ETH-based pool still quotes stable-to-stable and LST-to-underlying swaps tightly, because those pairs are edges of the tree rather than round trips through an uncorrelated numeraire.

Why this matters:

• O(1) scaling: pairwise designs (Curve v2 CryptoSwap) need N² compute for oracle upkeep, pool configuration and invariant solving; the anchor tree scales linearly. Only two AMM families scale past 10-asset pools: anchor-tree (BTR AIMM) and CCMM/Orbital. They are complementary, not competing: Orbital wins pegged-only deployments through intrinsic geometric risk isolation, BTR wins mixed-volatility baskets (stables + LSTs + majors) where no peg constraint applies and regime-adaptive splines plus inventory skew are required. Sphere invariant, polar-tick maths and the reported capital-efficiency figures: Foundations §10; full side-by-side: Foundations §19.
• Triangulated quoting: All assets quote vs anchors, not directly against each other. This reduces the mispricing arbitrage surface and the exposure to market fragmentation and price manipulation.
• Capital consolidation: One pool depth serves all pairs, eliminating fragmentation. Correlation between the legs is a precondition: when assets move together, flow that drains one leg tends to arrive against another, so the inventory skew that prices an imbalance also attracts the flow that clears it. A roster without that correlation still shares depth but does not net: it accumulates one-sided inventory. This is a tendency, not a guarantee; correlated legs can move together and leave the pool displaced on every leg at once (Pool Composition).

The path between two assets is the unique tree path: up to the lowest common ancestor, then down. Endpoint legs carry full price impact and settle against reserves; interior legs price at mid with inventory skew and carry no impact, since interior reserves never move. Fees, $\sigma$ and confidence compose over every leg. This mirrors FX practice, where a cross settles through the nearest shared vehicle rather than through one global numeraire.

5.3. LVR-aware pricing

AIMM does not eliminate LVR. It prices LVR explicitly, in the quoted spread, rather than leaving the cost implicit on LP balance sheets.

Inventory Skew Adjusts Mid-Price (Avellaneda-Stoikov Framework)

When coverage ratio deviates from target, inventory skew shifts the mid (reservation price); the spread itself stays symmetric:

• Pool accumulating token → mid skews down (both bid and ask shift lower together)
• Pool depleting token → mid skews up (both bid and ask shift higher together)

Symmetric Multi-Premium Spread

The spread (symmetric around the mid) is the sum of three independent widths, one band and two surcharges; the derivation and the full parameter list live in Spread & Fees.

High volatility + wide feed confidence + keeper lag = maximum spread. Stable, fresh conditions = tight execution. Every term is symmetric - there is no directional/deviation term; coverage moves the mid via inventory skew, never the spread.

The spread widens when volatility, feed confidence or keeper staleness rise; the skew moves the mid against coverage-worsening flow and toward coverage-improving flow. The pool charges for adverse selection instead of absorbing it on the LP’s behalf.

6. Why now

6.1. The hooks experiment proves appetite

V4 hooks demonstrate demand for adaptive AMM features (volatility tracking, dynamic fees, inventory awareness); AIMM implements those features in the pricing curve instead of in hooks.

6.2. The LP experience is constrained

Passive V3/V4 LPs face execution complexity: range selection, rebalance cadence, JIT competition. AIMM’s single-sided, natively inventory-aware deposits remove all of it from the LP’s side.

Most liquidity providers do not want to run market-making strategies. AIMM offers a curve geometry that manages inventory risk in the curve itself, so LPs do not have to.

The same applies to institutions. Professional market makers are not uniformly profitable. Large depositors in automated liquidity managers (Kamino, Beefy CLM, Gamma, Arrakis) often overestimate their net result: these applications display short-term yield APRs without netting LVR. AIMM’s LVR-aware pricing puts that cost in the quote.

6.3. DEXs must rival CEX spot markets

We want AIMM to be the spot DEX for everything: stables, yield-bearing assets, majors, alts, and all the existing markets arriving on-chain (FX, commodities, stocks, indices). The design covers every one of those asset classes and stays complementary to order book exchanges.

To capture meaningful spot volume from centralized exchanges, on-chain markets need:

• Tighter spreads on liquid pairs
• Transparent, predictable pricing
• Sustainable LP economics

AIMM pursues all three structurally. There are no emissions.

7. Technical architecture

7.1. Pricing pipeline

7.2. Coverage-aware asset-liability accounting

Inventory is measured per leg as coverage, the asset-liability ratio of §4.1:

• Coverage Ratio: reserves/liabilities per token
• Pooled LP settlement: every mint and exit settles at one pool-level solvency rate $C$, which no exit can move by exiting; a same-asset exit is capped in kind at the leg’s coverage and the rest of the claim is payable in another token
• Convex Coverage Wall: kappaCovBps tolls any swap that drains a walled leg further, on the potential $Q\left(c\right)=\ln c-c+1$, which diverges as $c\to 0$, so the last of a leg is priced out before it can be taken. The toll is charged on the output leg only, and a hard gross cap refuses the part of a trade that would cross it
• Bounded, not breakered: there is no circuit breaker keyed to a coverage level. The inventory skew saturates at $\pm 100$ ($c\le 1/2$ and $c\ge 2$), the gross cap bounds the drain, and halting a leg is a human lever

7.3. Oracle security

External keeper mark (primary quote source):

• The quote is the pushed mark: swaps write no price state and there is no internal accumulator, so pool reserves are not an input to the price an attacker can move
• Trust rests on the k-of-n signer quorum (a leaked key is answered by an instant lane halt; the roster rotates only through setAuth at the GOVERNANCE tier) plus an on-chain guard chain each push must clear per feed: a volatility-adaptive deviation band, a source-timestamp check, a σ floor at the realized move and the confidence ceiling. A lane that breaches the band goes dark, not reverted. The residual risk is a stale or missed push, priced by the staleness surcharge until the TTL expires and the leg fails closed

Per-asset depeg price bands (circuit-breakers against an independently-keyed reference oracle):

• Per-asset refBandBps: halt swaps if the asset’s mark leaves the band around the lane’s reference tier, a second attestation of the same pair under its own roster and signing domain. Mandatory on every non-base leg, in both modes. On the swap path it is halt-only; on the LP and solvency path the mark is clamped into the band instead, so a withdrawal prices at the edge rather than reverting. It is an agreement check between two attestations, not a peg test, and it says nothing about a parent asset depegging (Anchor Path Pricing §7.1). Roster disjointness between the two tiers is what makes the check independent, and nothing on chain can verify it: it is a deployment obligation. Policy halts that a listing-time price bound would express belong to the guardian halt instead, a human decision on a fast on-chain lever.
• Base-token depeg halt: reverts BaseDepegged when |basePrice - 1e18| / 1e18 exceeds the base’s band, its depeg code x 250 bps (2,500 bps at code 0, never wider). There is no configuration in which it is off while swaps are live
• See Flow Guards for the full mechanism

The pushed mark is the price source for every asset; there is no servable on-chain price EMA, TWAP or reserve mid (smoothing lives at the source, the chain quotes the raw fresh mark only).

7.4. Extreme volatility handling

In a flash crash:

1. Volatility fees spike - σ-based component widens spreads automatically
2. The inventory skew index saturates at $\psi =\pm 100$ (an int8, clamped at $c\le 1/2$ and $c\ge 2$), bounding the mid displacement
3. Maximum slippage = liquidity profile edge, dispersion-scaled worst-case execution
4. Halt available: the guardian or the owner can halt a leg (haltAsset, over a refcounted source mask). Halting is the fast direction; lifting takes the owner, or a pool’s seat for its own bits (Access Control §2)

The pool becomes a price-taker at extremes. The mid shift is bounded ($\psi$ saturates at $\pm 100$), but that bounds the quote, not LP claim value: a drained leg pays nothing in kind. Its claim is face · C through a cross exit and falls with $C$. See the Risk Disclaimer.

7.5. Emergency mechanics

When coverage drops below 100% (reserves below liabilities on a leg):

1. Exits settle at the pool rate. A same-asset exit from the leg pays at most its coverage in kind, pro-rata; the rest of the claim is payable at the pool rate $C$ in another token. Early exiters get nothing a later exit cannot, and a real loss is shared by every LP in the pool rather than left to whoever exits last.
2. The convex coverage wall prices further drains. On a walled leg, kappaCovBps tolls the drained output side with a cost that diverges as coverage falls. Nothing reduces LP claims on a clock: the wall makes the next drain expensive, and the toll it keeps raises $C$.
3. Maximum skew offset applies: $\psi =+100$ discourages further drains, bounded as in §7.4.
4. Manual halt available: guardian or owner, per leg. A halt gates the exits as well as the entrances.

7.6. Gas efficiency

AIMM is designed to be gas-competitive with Uniswap v4:

8. Governance and discretion

8.1. The spline governance challenge

Customizable liquidity profiles create a trust question: who sets them, and what stops an LP being front-run by a change.

1. Time-locked parameter changes, in three tiers by what an op changes: tiers, delays and the ops each tier covers are in Access Control §3. A curve shape is the slow lane; pointing a leg at an already-published curve is the fast one. Tightening is instant, and the pre-seal bootstrap window writes untimelocked: a pool refuses public deposits until it is sealed
2. Off-chain fitting, on-chain data: shapes are fitted from observed depth density off chain and installed as on-chain data, not code. The fit is not automated on-chain and no keeper writes curves
3. Transparent on-chain state: every parameter that drives a live quote is readable by any address
4. One seat per pool: the protocol owner is the only caller of createPool, and names the pool’s seat (Pool.poolAdmin()) in the creation call. That seat, not the protocol, administers the pool from there on. A seat of zero is the protocol sentinel and resolves to the chain-wide AccessControl.owner(); every protocol pool is a sentinel pool (Pool Deployment & Curation)

Invariant risk becomes discretion risk, bounded by the tier, by the tighten-only fast lane and by exit.

8.2. White-label architecture

Deployment is owner-gated, administration is not. A partner requests an N-asset pool from the protocol owner, who deploys it through PoolFactory with the partner’s base token and initial fee params and names the partner as the seat in the same call. Creation is onlyAdmin because every pool shares one CREATE3 namespace (the factory is the CREATE3 sender), so any other caller could spend a mined address reservation. Listing assets, installing curves, setting risk config, rotating the fee sink, sealing bootstrap and halting all route through the Admin singleton gated on that seat. Handing the seat on is a GOVERNANCE-tier op plus an accept by the named address.

Two protocol reaches remain over a foreign pool, both disclosed: a guardian may raise its halt bit on any leg, and the shared Pool implementation is upgraded for the whole fleet behind the 7-day tier with no per-pool opt-out. Two things a seat cannot grant itself: the official routing brand, which is an owner-only grant, and a new oracle feed registration. See Pool Deployment & Curation and White labeling.

9. Competitive position

9.1. Why BTR is a separate protocol, not a V5

The tick model is structurally incompatible.

Uniswap’s architecture requires:

• Discrete tick traversal for price discovery
• Per-position liquidity accounting
• LP-managed range selection

AIMM requires:

• Keeper-mark-first pricing with spline depth
• Pool-level inventory accounting
• Seat-managed depth profiles, installed as data behind a timelock

9.2. Structural differentiators

We are not claiming “unforkable”: the design is documented and the live parameters are public on-chain state, so a serious team could replicate the architecture. The claim is a combination of three pieces that no other shipping AMM combines:

1. Regime-adaptive policy substrate - the spline depth profile is admin-mutable on-chain data, not hard-coded code. Concentration, asymmetry, and per-asset shape are re-fit off chain from observed depth density and installed as data, with no contract upgrade. Curve’s A and Gyroscope’s λ are immutable per-pool parameters; AIMM’s spline is the policy itself.
2. Shared-inventory multiplier - the base token’s reserves simultaneously back its approximately $N-1$ pair markets under base-token flow (see Foundations §18). Realistic ranges: ~3-5× V3-equivalent depth at N=5, ~5-10× at N=10, deployment-dependent, with a contention discount γ ∈ [0.5, 1.0]. UniV4’s singleton is a storage optimization; AIMM’s singleton is a liquidity-sharing geometry.
3. Per-asset mark sources + reference bands - every asset in one pool names its own mark lane. Tail risk is gated by a per-asset agreement band against a second attestation plus a base-token parity halt (BaseDepegged past the base’s depeg band, at most 2,500 bps). See Mark Relayer and Flow Guards.

Positioning: liquidity for blue-chip multi-hop, curated, regime-adaptive, mark-synced. The design target is curated 5-15-asset blue-chip baskets. It is not built for stable-stable in-peg flow (Curve V1 leads there), nor for the long tail (UniV3/V4 lead on permissionless pair creation).

10. The BTR vision

We named ourselves BTR (Bayesian True Range) because our early research used Bayesian inference for price estimation. The philosophy persists: we treat every swap as evidence updating our belief about fair price.

• Bayesian: Beliefs (prices) update based on evidence (flow, volatility, coverage)
• True Range: We capture realistic dispersion of price outcomes, not idealized curves
• Adaptive: Every parameter responds to market conditions

Eliminating adverse selection is impossible without eliminating trading. The goal is to price it more accurately, so that LPs are more likely to be compensated fairly (no guarantee; outcomes depend on market regime, oracle health, and adapter behavior; see Risk Disclaimer) and arbitrageurs cannot extract risk-free profits.

A constant-product pool quotes the same curve regardless of what it holds or how uncertain its price is. AIMM re-prices on both.