Risk and inventory

Protections

Block cap, age fade and move premium are set in one board-controls message per ladder and stay in force until you send new ones with a higher nonce. The message carries expiresAt, the last second it can be committed: sign it a few minutes ahead. After that the commit is rejected (ControlsExpired(), reported as CommitRejected kind 4) and the nonce is not consumed. Once committed, the controls do not expire. Auto-dark is the expiry on every price message: expiresAt on ladders and offsets, ttl on anchors.

Dial	Field	Effect	Default	Typical
Block cap	`blockCap`	maximum `tokenIn` the ladder fills in one block, across all takers	`0` (off)	a fraction of the top size
Age fade	`widenPpmPerSqrtSecond`	extra discount of this many ppm times the square root of the quote’s age in seconds	`0` (off)	50 to 200
Move premium	`premiumPpm`	extra discount in ppm after a price change	`0` (off)	a few hundred
	`premiumBlocks`	blocks the premium lasts, counting the commit block	`0` (off)	1 or 2
Auto-dark	`expiresAt`, anchor `ttl`	the ladder stops quoting after this time	required	10 to 30 s

Age fade at widenPpmPerSqrtSecond = 100:

Quote age	Extra discount
1 s	100 ppm (1 bp)
2 s	142 ppm
4 s	200 ppm
25 s	500 ppm

The discount is ceil(sqrt(widenPpmPerSqrtSecond^2 * age)) ppm. The age of a Reprice ladder counts from its anchor’s timestampMs, the age of a Rewrite ladder from its own timestampMs, so a ladder committed late is already aged. A controls commit does not reset the age. The premium window restarts on every depth, anchor and controls commit. If you anchor every block or flashblock with premiumBlocks of 1 or more, the premium applies almost continuously. Size premiumPpm for that, or keep it at 0 and rely on age fade.

{
  "type": "board-controls",
  "payload": {
    "mm": "0xYourSigner",
    "tokenIn": "0x8b414aD7005EeFd315aF2A16538885Eae229bab7",
    "tokenOut": "0xAbbdbbbd6d56593A9c5656c06cB30D61E4a544Df",
    "nonce": "<unix milliseconds>",
    "blockCap": "5000000000000000000",
    "widenPpmPerSqrtSecond": "100",
    "premiumPpm": "500",
    "premiumBlocks": "1",
    "expiresAt": "<unix seconds>",
    "signature": "<EIP-712 signature>",
    "chainId": 84532
  }
}

Aggregators see the block cap before trading: board() reports what is left in the current block, and the venue routes the rest of an order to other makers. controls(mm, tokenIn, tokenOut) on the executor returns your settings.

Maximum payout per ladder

A ladder fills at most its top size, counted across every taker. A new price-ladder or offsets message resets the count. The maximum payout is fixed when you sign:

Step	Cumulative size	Price	Pays at most
1	2 WETH	2000.00	4,000.00 USDC
2	5 WETH	1999.40	5,998.20 USDC
3	12 WETH	1998.20	13,987.40 USDC
4	20 WETH	1995.50	15,964.00 USDC
Total	20 WETH		39,949.60 USDC

Keep at least that much tokenOut in the provider. The executor caps board() remaining and quote() to what your provider’s available(tokenOut) reports, so with less inventory the venue quotes only the part you can pay.

Mode	Top size limits
Rewrite	fills per ladder update
Reprice	fills per `offsets` message, across any number of anchors

Fill tracking

Data	Source
Inventory	`available(token)` on your provider; `balanceOf` for `BasicMMProvider`
Filled and remaining size	`board(mm, tokenIn, tokenOut)`: `filled`, `remaining`
Filled this block	`controls(mm, tokenIn, tokenOut)`: `filledThisBlock`
Each fill	`MMFillExecuted(mmProvider, mmSigner, receiver, tokenIn, tokenOut, amountIn, amountOut, avgPrice, filledAfter, caller, nonce, anchorNonce)` on the executor
Messages that reached the chain	`LadderCommitted`, `OffsetsCommitted`, `AnchorCommitted`, `ControlsCommitted` on the executor

mmProvider, mmSigner and receiver are indexed. caller is the address that called fill (the venue, the hosted settlement or a direct taker), nonce is the depth version that priced the fill and anchorNonce is the pair anchor’s timestampMs at fill time (0 when no anchor exists for the pair). A trade split across makers emits one MMFillExecuted per maker. Its topic0 is 0x0d885e383bb9ad86c7811413207f8eabfcba2be4399cea97266e37996d46d062.

Stop quoting

Action	Effect
Stop sending	ladders expire at their `expiresAt`; Reprice ladders also go dark when the last anchor’s `ttl` runs out
Send a tombstone: a ladder with a dust top size and a higher nonce	replaces outstanding quotes immediately
`setApprovedExecutor` to another address	all fills revert
`withdraw`	provider is empty; `board()` reports no room and fills revert
`setPaused(true)` on the executor, from your signing address	every board of yours goes dark in one transaction: fills revert `BoardInactive()`, `quote()` returns `0`

setPaused needs no signed message and no keeper, so it works even when Biconomy’s keeper is down. It emits MakerPaused(address indexed mm, bool paused); makerPaused(mm) on the executor returns the current state. setPaused(false) lifts the pause; boards still inside their expiry quote again. To resume after the other actions, send new messages with higher nonces.

Getting Started

Market Makers

Aggregators

Reference

Protections

Maximum payout per ladder

Fill tracking

Stop quoting

​Protections

​Maximum payout per ladder

​Fill tracking

​Stop quoting

Protections

Maximum payout per ladder

Fill tracking

Stop quoting