Kadia DEX: know your assumptions

Source: kadia-dex docs/guide/assumptions.md at commit 4b2bbee (4b2bbeeff4c2df397d4090a1214542923338941c). The IDs (S1, N3, …) are the guarantee and non-guarantee tables in the DEX design specification, §2.3, which has the exact wording.

What you’re trusting

You trust	For	If it fails
Ergo consensus	Running the contracts exactly as written	Everything on Ergo is affected, not just Kadia.
The contract code	Every guarantee below	Funds in markets and orders can be lost. The contracts haven’t been audited.
Your wallet	Showing you the real transaction before you sign	You could sign something the app didn’t describe. Check what your wallet shows.
The app you use	Showing correct prices, balances and order status	It can mislead you, but it can’t take funds you didn’t sign away. The contracts enforce your minimum and your refund.
That someone runs a settler	Your order getting filled	Nothing is lost. Your order waits until expiry, then anyone can refund it.
That someone runs a keeper	Timely refunds and fresh markets	You can always cancel with your own key. See storage rent below.

You don’t trust Kadia’s servers, the settler or the keeper with your funds. None of them have on-chain privileges.

If you trade

Guaranteed by the contracts:

You get at least your minimum, or nothing happens. An order is spent in exactly one of three ways (S1):
- you cancel it;
- a settlement pays you at least your entitlement and your minOut;
- after expiry, it’s refunded to you minus at most your execution-fee cap.
The same price as everyone in your batch. Every order filled in one transaction is priced from the same reference price and fee (S2).
Your payout can’t be redirected. It must go to the payout address in your order, tagged with your order’s id (S3).
You cap the fee. Your order refuses a market whose fee is higher than the maximum you set, or whose band is wider than you accept.

Not guaranteed:

That your order fills at all (N1, N6). A settler can leave any order out, and large orders may be too big for the pool’s band to absorb.
The best possible price (N2). The settler picks the batch and can move the price anywhere the rules allow above your minOut. minOut is your protection, so keep it tight.
Timing (N5). Everything is measured in block heights, about 2 minutes each, not wall-clock time.
Automatic refunds (N7). Anyone can refund an expired order and keep up to your execution-fee cap. Kadia’s keeper does so on a best-effort basis.
Partial fills. In v1 an order fills completely or not at all.

If you provide liquidity

Guaranteed:

An exit always exists (S7). A finite sequence of removal steps (redeem orders in the contract) returns your LP share without needing traders or anyone else’s liquidity. That guarantees the transactions exist, not that they get included (see N9 below).
The pool is paid at least the fair post-trade price plus the pool fee on each block’s net flow (S4). Orders matched against each other in a batch never touch the pool, so not every trade pays the pool fee.
The market’s parameters never change after it’s created (S5).
Within a block, the price stays within the band around the block’s opening price (S6).

Not guaranteed:

Protection from arbitrage (N3).
- Within a block, a settler can chain several settlements and capture another trade’s price impact.
- Across blocks, the price can move by up to the band each block, and that compounds.
- Arbitrageurs take the difference from liquidity providers, as on every AMM.
That the market stays tradeable (N13). A market can reach a state where no swap is possible. Your funds aren’t trapped: you can still exit.
That your LP order goes through promptly (N9). LP orders only run at the start of a block, and someone willing to pay for a swap every block can delay them.
Exact pro-rata amounts on exit (N14). Each removal step rounds down, losing under one raw unit per step. On ERG/token markets, an isolated exit can also leave the market’s box minimum behind.
That trading continues after large exits (G4). A market can end up below its trading floors. Swaps are then impossible until added liquidity lifts both reserves, but exits still work.
Token-to-token collateral (N12). A token-to-token market’s ERG collateral stays in the market box for good and is never paid to liquidity providers.
The value of burned LP tokens (N10). LP tokens burned outside the market leave their share in the pool, where nobody can remove it and it isn’t redistributed.

System-level risks

Storage rent (N8). Ergo lets anyone spend a box that is about four years old, whatever its script.
- Orders expire long before then, and the keeper refunds them.
- Markets are kept fresh by normal use and by keeper maintenance.
- If every keeper stopped for about four years, an idle market could be claimed through rent.
- Your own payouts carry a rent reserve by default, so your tokens survive a rent collection.
Custom payout scripts (A04). Whoever fills or refunds your order picks the payout box’s extra registers and its creation height. The Kadia app always pays to your wallet address, which ignores them.
Rust and Scala node disagreement on rent (S04). The two Ergo node implementations currently disagree on some rent cases. Kadia won’t launch until a fix gives identical results on both.
Market history. The guarantees assume every spend of a market since its creation followed the contract rules. The registry replays every market and quarantines any that fail. The Kadia app only trades markets the registry lists as verified.
Pause and upgrade keys (r12). A market linked to Kadia’s official governance box can be paused by 2 of 5 guardians, for up to 30 days at a time. It can be wound down for good, or upgraded, by 3 of 5 upgraders. An upgrade takes effect only after 14 days’ notice (10,080 blocks), and none can take effect from block 2,550,000. Removing liquidity, cancelling and refunding never read the governance box, so they work in every state. A market linked to another governance box is controlled by whoever holds that box, and the Kadia app doesn’t trade it. Source: kadia-dex docs/specs/r12-governance.md at a75c9ec.

See Fees for who pays what.