Security and trust

What a seat holder can do

• Set the swap fee, up to 3%.
• Keep the fees it charges and swap at zero fee.
• Withdraw its own deposit down to what the rules require.

What a seat holder cannot do

• Touch LP reserves. Reserves move only by the constant-product rule in swap, add_liquidity and remove_liquidity.
• Raise the fee above 3% (FeeAboveCap).
• Change the fee inside the slot a swap lands in: set_fee applies from the next slot.
• Keep the seat without paying: when its deposit cannot pay another full slot, the seat ends.

Griefing is bounded by the delay

Every bid prepays 900 slots of rent and waits 900 slots. A bidder who wants the seat for one moment must pay for about 3.3 minutes and announce itself 3.3 minutes ahead.

Withdrawal fee

LPs pay 110 parts per million (0.011%) to the seat holder when they withdraw. The paper derives it (appendix B) as 1 - 2 sqrt(1 + c) / (2 + c) for the cap c = 3%: it stops LPs from pulling liquidity after a price move and before the holder can trade it.

No admin

The only privileged write is init_config, callable once by the program's upgrade authority to set the LEASE mint and its two burn pools. There is no admin fee switch, no pause and no way to move pool funds.

Burn crank guard

crank_burn spends at most 0.1% of the burn pool's input reserve per call and must receive at least 98% of what the burn pool's own 30 minute time-weighted price pays. A manipulated price makes the call fail rather than overpay.

Token-2022 bases

Base mints carrying extensions the pool cannot hold safely are refused (BaseMintUnsupported).