Design decisions
Four choices that cost nothing to get wrong on a good day. Each one is written here with the alternative it beat, since a decision without its rejected option is just an assertion.
The breaker publishes the real price
The problem. An update arrives that moves the price further than any plausible market move. It might be a broken feed. It might be a genuine dislocation, which is exactly when the vault most needs to know where the price is.
The choice. Record the real value and raise a flag. The vault then refuses to spend until the flag is cleared. Rejecting the update would freeze the feed at a stale number during the event; clamping it would publish a figure the contract knows to be false. Writing the truth and declining to act on it is the only option that leaves no lie on chain. More on the oracle.
The defence is symmetric
The problem. A vault funded only in quote currency can buy its coin when it trades cheap. When it trades rich it has nothing to sell, so half the band is decoration.
The choice. Seed the vault with token inventory at launch, so it can push in both directions from the first block. This is the gap covertskins describes in its own documentation and leaves open.
The vault is born before the curve
The problem. Pons timelocks the creator fee recipient for 72 hours. A vault deployed after the launch would watch three days of fees — the busiest days a bonding curve ever has — land somewhere else.
The choice. The vault's constructor takes only what exists before the curve: the oracle, the skin id, the quote asset, the supply and the multiplier. The token is pinned afterwards by setCurve(), which reverts on a second call. The cost is a slightly awkward deployment; the benefit is that the fee stream is correct from block one. The timelock, measured.
Sorting the signers is a security measure
The problem. Reporters sign off-chain and anyone may relay. Nothing about that stops a relayer from submitting the same signature several times to reach quorum.
The choice. Require strictly ascending signer addresses. It deduplicates the whole set in a single pass with no extra storage, and it reads like a gas trick — but without it one reporter reaches quorum alone and the median of n copies of their number is their number.
A fifth, found by a test
Not a design decision so much as a bug the suite caught, kept here because it is the kind that ships. The helper that reduced a position took the sign of the change rather than the sign of the position. Reducing a long therefore released a negative cost basis and realised exactly zero profit or loss — plausible-looking numbers, wrong in a way no demo would reveal. It is now named for what it computes rather than what it does.
Snapshot data last refreshed Sep 23, 2026 UTC.