Explanation

Trading architecture decisions and limitations

Trading is deliberately small. This page records why each decision was made and which features are out of scope, so that future work does not weaken the pair's one hard invariant.

Decisions

  1. Two reserves only. A pair holding Yes × No shares avoids the three-way quadratic and does not price Invalid.
  2. Exact SecurityPool identity. A pair is keyed by the pool address, so parent and child branch pools always map to different pairs even when they share one ShareToken. The factory's canonical validation stops a pool from borrowing another market's identity.
  3. One immutable fee per factory. There is no owner, protocol fee switch, or mutable parameter.
  4. Balance-delta integration. The router measures complete-set creation and redemption by observed share and ETH balance deltas because holding fees change the ETH-to-share rate; it never assumes a fixed ratio. Its custody checks are listed in the router reference.
  5. Minimum-reserve LP scale. Initial LP supply follows the smaller reserve rather than a geometric mean, which would overflow at large share scales; only proportional ownership matters. The liquidity-provider position gives the rule.
  6. Donations accrue to LPs. Reserve-dependent operations first synchronize reserves up to actual balances, so unsolicited Yes or No shares benefit existing LPs instead of the next trader. The security model covers the related custody defenses.
  7. No automatic fork behavior. Parent liquidity is removed as parent shares. The user explicitly chooses migration targets and initializes distinct child pairs.

Limitations and non-goals

The MVP intentionally does not implement a three-way invariant, Invalid-share trading, an invalidity-probability oracle, weighted reserves, quadratic solvers, flash swaps, a protocol fee, governance controls, upgradeable proxies, automatic branch selection, automatic LP migration, an insured-position NFT, or per-user on-chain position accounting.

It also has no TWAP, routing across markets, guaranteed deep liquidity, or mechanism to withdraw more early ETH than complete-set insurance and reserves permit. Trading is unaudited; the Trading security model states what it defends against and what it assumes.

Future work may add separate Invalid markets, safer oracle observations, routing, or bounded convenience flows. Those are distinct designs and must not weaken the invariant that this pair never accepts or holds Invalid shares.