The math of Orbital

1Notation and state

In shortWe follow the paper's notation. Every later formula lives in one plane, $(\alpha, \|w\|)$ , and the whole state fits in four storage words. In the text, a symbol shows its definition when you hover or tap it.

Symbol	Meaning
$x$ , $n$	Virtual reserves, one per asset; $n$ assets. The contract fixes $n = 3$ .
$v$	$(1, \dots, 1)/\sqrt{n}$ , the direction of equal reserves.
$\alpha$ , $w$	$\alpha = x \cdot v$ and $w = x - \alpha v$ . With $n = 3$ , $\alpha = S/\sqrt{3}$ and $\\|w\\|^2 = Q - S^2/3$ .
$S$ , $Q$	$\sum x_i$ and $\sum x_i^2$ , exact integers recomputed from the stored reserves.
$(r, k)$ , $s$	A tick's radius and plane constant, and its boundary circle radius $s = \sqrt{r^2 - (k - r\sqrt{n})^2}$ .
$\kappa$	$k/r$ , a tick's normalized plane.
$r_{int}$	$\sum r_i$ over interior ticks: the radius of the consolidated sphere.
$k_{bound}$ , $s_{bound}$	$\sum k_i$ and $\sum s_i$ over boundary ticks.
$R$	$\sum r_i$ over all ticks, the total radius.
$x_{min}$	A tick's lowest reserve on its cap. Their sum $\sum x_{min}$ is the pool's floor.
partition	The set of boundary ticks: always a prefix of the initialized ticks, selected by $S$ alone (section 4).

Split the reserves into their component along $v$ , $\alpha = x \cdot v$ , and the rest, $w = x - \alpha v$ . The consolidated invariant only sees $\alpha$ and $\|w\|$ :

(\alpha - \htmlClass{tb}{k_{bound}} - \htmlClass{ti}{r_{int}}\sqrt{n})^2 + (\|w\| - \htmlClass{tb}{s_{bound}})^2 = \htmlClass{ti}{r_{int}}^2

highlighted boundary sums · plain interior radius

In the $(\alpha, \|w\|)$ plane, this is a circle of radius $r_{int}$ centred at $(k_{bound} + r_{int}\sqrt{n},\ s_{bound})$ . Turned around the line of $v$ , it sweeps a torus. A tick's plane becomes a vertical line, at the $\alpha$ where the interior point reaches it; when the reserves cross it, the tick changes class and the circle changes with it.

Figure 1. Left: the torus is one circle turned around the line of

v

, at height

s_{bound}

. Right: the same circle in the

(\alpha, \|w\|)

plane, where the surface is its arc nearest the peg (solid). Every later figure is drawn in this plane.

The state the invariant needs fits in four storage words: the three real reserves $x_i - \sum x_{min}$ , from which the pool recomputes $S$ and $Q$ exactly; the interior radius $r_{int}$ , the boundary sums $k_{bound}$ and $s_{bound}$ , the total radius and the floor $\sum x_{min}$ ; and one integer for the current partition. A one-word bitmap marks initialized ticks (bits 40 to 238). A swap touches two reserves and reads one tick record per partition it walks: the paper's constant cost in $n$ holds in practice.

Figure 2. The hot state, least significant bit first, to scale. The narrow black fields locate the current partition and cache the next tick up; the last one is the shutdown flag. The bitmap has a slot of its own.

2The boundary radius is a sum, not a root

In shortThe paper consolidates boundary ticks in two places, and the two forms disagree. The sum is the right one: with it, the surface stays smooth and the marginal price continuous when a tick crosses.

Paper · Tick Consolidation, case 2

Two boundary ticks combine into one sphere in the subspace orthogonal to $v$ , with radius $s_c = s_a + s_b$ .

Paper · Global Trade Invariant

All boundary ticks are treated as a single tick $(r_{bound}, k_{bound})$ , with $\|w_{bound}\|^2 = s_{bound}^2 = r_{bound}^2 - (k_{bound} - r_{bound}\sqrt{n})^2$ .

Where they differ

The two forms agree for a single boundary tick, or for several on the same normalized plane. Otherwise they differ, and always in the same direction: the root form is larger.

What we use

The case-2 argument is the right one: boundary reserves add along a common direction orthogonal to $v$ . So $s_{bound} = \sum s_i$ , with $r_{int} = \sum r_i$ over interior ticks and $k_{bound}$ summed over boundary ticks.

Why the root form overstates

As a function of $(r, k)$ , the boundary radius $s$ is concave and homogeneous of degree one, hence superadditive. The root of the sums is therefore at least the sum of the roots, with equality only when all boundary ticks share the same $k/r$ .

Proof

$r^2 - (k - r\sqrt{n})^2 = (r - k + r\sqrt{n})(r + k - r\sqrt{n})$ , a product of two linear forms in $(r, k)$ that are both positive on every valid tick.
So $s(r, k)$ is their geometric mean: concave and homogeneous of degree one, hence superadditive.
The root of the sums is therefore at least the sum of the roots. Equality holds only when all boundary ticks share the same $k/r$ .

Figure 3. Take

n = 3

with boundary ticks at 0.99 and 0.90, computed from the catalog's plane formula. With equal radii, the root form overstates

s_{bound}

by 30%. With the 0.99 tick ten times larger, it overstates it by 76%.

What the sum buys

With the sum, the invariant is a circle in the $(\alpha, \|w\|)$ plane. When tick $i$ crosses, $r_i$ moves between $r_{int}$ and the boundary sums, and its $s_i$ moves with it. The circles of the two partitions are then internally tangent at the crossing point: their radii are $R$ and $R - r_i$ , and their normals there are parallel. With the root form, the new partition's circle generally misses the crossing point, and the invariant jumps.

Figure 4. The surface (solid) follows the circle of radius

R

around

C

up to the plane of tick

i

, then the circle of radius

R - r_i

around

C'

. With

s_{bound} = \sum s_i

C

C'

and the crossing lie on one line (dotted): the circles are tangent there. Switch to the root form: it moves the second center, and the surface jumps at the plane. Schematic, not to scale.

Result 1provedtested

With $s_{bound} = \sum s_i$ , the surface is not only continuous across a crossing, it is smooth. The marginal price does not jump when a tick flips. In exact arithmetic, a fee-free round trip through a crossing returns exactly to its start.

We checked the consolidated model against an independent convex program, which maximizes output under per-tick sphere and plane constraints. The two agreed to about $10^{-13}$ on swaps that cross ticks, including swaps that pass the point where the two traded reserves are equal.

3Why the path breaks in integers

In shortThe paper's trade segmentation does not survive integer rounding: near a crossing, several independently rounded conditions can leave no valid integer at all.

The paper computes the trade in the current torus. If the common interior point has crossed the nearest plane, it solves a quadratic for the exact crossover, flips that tick, and repeats with the remaining input. Inside a segment, it solves the quartic by Newton's method.

Figure 5. The paper's procedure on a surface of three tangent circles: Newton on the quartic inside each segment, a quadratic for the exact crossover at each plane, then a flip. Schematic.

Our first engine followed this procedure. In integers, every event must satisfy several independently rounded computations at once: the classification of the reserve sum against the plane, the closed-form crossover, the segment solver's root, and a tolerance on both sides of the flip. Near an event, sometimes no integer satisfies all of them, and a fail-closed engine reverts a swap that should succeed.

Figure 6. Four rounded conditions near one crossing. Each holds on its own interval of inputs; their real intersection exists but holds no integer, so the engine reverts. Schematic.

Two rounds of fixes closed specific configurations, and others stayed open. Bands of input 607 wei wide reverted, and isolated inputs failed while their neighbours passed. The case space (event type × direction × regime × rounding side) is combinatorial. Separately, an unbounded Newton on the quartic could converge to the mirror root on the other side of the pair diagonal.

4The endpoint search

In shortAdd the whole input, cut the line of outcomes at integer thresholds, and solve once in the piece that holds the endpoint. The geometry is the paper's; the algorithm is not.

Add the whole net input first. The input reserve $a$ and the untouched reserve $z$ are then fixed, and only the output reserve $u$ is free. Along that line, $S = a + z + u$ grows with $u$ , and every tick plane becomes an integer threshold on $S$ . In partition $m$ , the next tick $T_m$ is a boundary tick exactly when

S \geq \sigma_m = \left\lceil \sqrt{3}\,\big(\htmlClass{tb}{k_{bound,m}} + \htmlClass{ti}{r_{int,m}}\,\kappa_{T_m}\big) \right\rceil

where $\kappa = k/r$ is the tick's normalized plane. These thresholds cut the line into pieces, each with one fixed torus. Neighbouring partitions compute the same integer, so pieces share their seams exactly.

The engine finds the piece that holds the endpoint and solves once there. On a sphere, when every tick is interior, it uses a closed form. On a torus, it runs Newton, then bisection, inside a certified bracket. A state's partition is a function of its reserve sum alone: no event history is needed. Inside a piece, the offset to the surface falls at a guaranteed rate, and at a seam it can rise by at most half a unit; the endpoint is the first point certified on the pool side. How it works draws this line.

Take the feeon the gross input
Locate the piecethresholds on $S$
Solve onceclosed form or Newton
Certifyon or inside the surface
Commitreserves, partition, flips
Credit feesfrom the two ends

Exact output

An exact-output swap runs the same search on the inverse line. The output reserve falls by exactly the requested amount and the untouched reserve stays fixed; only the input reserve is free. One solve gives the smallest certified input reserve, within the same bound of its integer optimum, and the pool commits that endpoint. It charges the smallest gross input whose net input reaches that endpoint, rounded up to raw units.

Figure 7. The same search on two lines. Exact input fixes

a

and

z

and finds the largest certified output; exact output fixes

u

and

z

and finds the smallest certified input reserve. Schematic.

The state follows from the output, not from the input, so the swap emits its own event. The exact input of the amount charged certifies a different point and, near a seam, can pay a few wei less than the requested output.

5What we proved

For the stored integers and the pinned constant $\sqrt{3}$ :

Theorem 1 · Up-setproved

Every piece lies on the near side of its circle's center, where the arc is steeper than any output line can climb. Inside a piece, the pool side of the line is therefore an up-set of integers. Root selection disappears, and the mirror root with it.

Theorem 2 · Seamsproved

Consecutive stored circles are internally tangent to within half a unit.

Theorem 3 · Boundproved

The search terminates and reverts only for capacity. It returns an output at most 50 wei below the exact integer optimum, or 77 wei at the largest supported radius.

0numerical reverts across about 780 swaps on six pool states; every refusal was a capacity limittested

0–3 weifrom the integer optimum, on 864 swaps checked against an independent oracletested

151,117gas for a public swap on our reference fixture, down from 280,760; the contract got smallermeasured

6Rounding, everywhere

In shortTwo rules replace every tolerance of the first engine, and they set the rounding of every operation in the pool.

Rule 1

Certified inside

Every stored state is proven on or inside the surface of the partition its sum selects. The proof uses the exact integers $S$ and $Q$ , one square root and outward rounding.

Rule 2

Doubt favours the pool

When a sign is uncertain, the engine takes the pool-favourable integer: a few wei less output. It reverts only for capacity, slippage or zero output.

Operation	Rounded	Toward the pool	§
Exact-input swap	output	down: at most 50 wei below the integer optimum, 77 at the largest radius	5
Exact-output swap	gross input	up, to raw units	4
Deposit	deposit	up: a few wei more when a repair is needed	7
Withdrawal	withdrawal	down: a few wei less when a repair is needed	7
Fee split	each share	down; the interior class takes the remainder	8

7Deposits keep the depth

In shortThe paper assumes “each tick has only a single LP” and does not describe deposits or withdrawals once some ticks sit on their boundary. Homogeneity gives the rules; integer states need one more step, or the next trader collects the difference.

The invariant is homogeneous of degree 2 in $(x, r)$ , which gives two rules:

Interior tick

Adding $dr$ scales the consolidated interior circle by $(r_{int} + dr)/r_{int}$ about its offset $(k_{bound}, s_{bound})$ .

Boundary tick

Adding liquidity translates the point and the circle together, by the tick's own $dk$ along the axis and $ds$ orthogonally.

In both cases, no tick changes class. The virtual reserves $\sum x_{min}$ become dynamic and move with every deposit and withdrawal.

The trap

An integer state sits slightly inside the surface, and a plain homothety of the reserve point scales that depth too. After a large mint, the point sits far inside every output line, and the next swap captures the surplus. Our 1,000-run fuzz campaign found exactly this: a minimal round trip returned 390 wei more than its input.

Figure 8. 1: a stored state sits inside the surface by a few units, δ. 2: a plain homothety multiplies that depth with the pool, and the next swap takes the surplus. 3: the fix scales the point's radial projection on the circle, then restores the same δ. Schematic.

The fix applies the homothety to the point's radial projection on the circle and keeps the depth unchanged.

Rounding

Each new state goes through the same certification as a swap endpoint. If rounding leaves it outside, the scarcest reserve is raised along its own line, with the same search a swap uses. The LP pays the difference: the minter deposits a few wei more, the burner receives a few wei less.

97.6%of 1,076 certifications in our test suite needed no repairtested

1–3 weifor the rest, paid by the LPtested

8Fees from two states

In shortThe paper does not discuss fees. Ours are charged on the gross input. The net input enters the reserves, and the fee stays outside the invariant, owed to LPs. There is no protocol fee. Each tick's share is read from the swap's start and end states.

A tick's holding is a function of the state

The paper shows that $w_{int}$ is parallel to $w_{bound}$ . So a boundary tick holds $k/\sqrt{n} + s\,\hat{w}_i$ of asset $i$ , where $\hat{w} = w/\|w\|$ . The interior ticks share the rest,

x_i - \htmlClass{tb}{k_{bound}}/\sqrt{n} - \htmlClass{tb}{s_{bound}}\,\hat{w}_i

in proportion to their radii. The holdings of all ticks sum to $x_i$ at every state. What each tick absorbs of the input is therefore read from the swap's start and endpoint alone, with no event path and no crossing point.

Figure 9. The input asset's reserve

x_i

, split by tick at the start and at the end of a swap. Each holding is a function of the state, so the change in each segment is what that tick absorbed. Schematic.

A holding is continuous where its tick flips: on the tick's plane, the interior ticks' common point is the tick's own point, so its interior and boundary holdings coincide.

Three classes of ticks

The boundary ticks are a prefix of the initialized ticks, so a swap flips one run of consecutive ticks and keeps the class of the others. Each class is paid in proportion to what it absorbs.

Class	What each tick absorbs	How it is paid
Boundary at both ends	Its own $s$ times $\Delta\hat{w}_{in}$	One boundary stream, per unit of $s$ , pays them all.
Flipped	Its own gain	Credited per unit of its own $r$ , and nothing from either stream for that swap.
Interior at both ends	In proportion to its radius	One interior stream, per unit of $r$ , pays them the rest of the fee.

Each tick keeps a fee history that is updated at every flip. Fees survive flips, full burns and the re-creation of a tick, without granting old growth to a new position.

Result 2provedtested

The total fee is exact, and the split is exact up to a few wei: every gain is a lower bound, every share rounds down, and the interior class takes the remainder. LPs are never paid more than the fee taken.

A separate oracle, which evaluates every tick's holding at both ends, gives the same class fees on 13 swaps, 7 of them with flips. Vectors computed to 90 digits are met to the wei.

Attribution pays net absorption. Input that a tick absorbs and gives back within one swap, as on a path that turns at pair parity, earns it nothing, and a class whose holding falls is paid nothing for that swap. Question 1 asks whether that is the right choice.

ABeyond three assets

In shortThe contract fixes $n = 3$ . The proof's numeric premises, however, can be recomputed for any $n$ with the same 199-price catalog. The endpoint bound grows slowly with $n$ , and gas limits $n$ before the proof does.

The up-set property holds for every $n$ . For a tick at depeg price $p$ , the premise that the arc is steeper than any output line reduces to $p > 0$ .

The endpoint bound has a closed form. Along an output line, the offset to the surface falls at a rate of at least

\mu = \frac{p_{min}}{\sqrt{p_{min}^2 + n - 1}}

where $p_{min} = 0.10$ is the widest tick's price. The endpoint bound is about $3.5/\mu$ wei.

$n$	$\mu$	Bound, $R \le 10^{30}$	Bound, $R = 10^{36}$
3 · deployed	0.0705	50 wei	77 wei
4	0.0576	61 wei	94 wei
5	0.0499	71 wei	109 wei
10	0.0333	107 wei	163 wei
20	0.0229	157 wei	239 wei

Figure 10. The table's bounds against

n

(dots:

R \le 10^{30}

; rings:

R = 10^{36}

) and the closed form

3.5/\mu

(dashed). Highlighted: the deployed pool,

n = 3

What tightens is precision at the tightest tick. There, $(s/r)^2 = (n-1)(1-p)^2 / \big(n(p^2 + n - 1)\big)$ , which shrinks like $1/n$ . From $n = 8$ , one constant in the liquidity-repair bound has to be re-derived.

These results cover the premises only. Other steps of the proof use identities specific to $n = 3$ and would have to be redone. In practice, gas limits $n$ before the proof does: each tick a swap flips updates two fee words per asset.

Next · [3]Against the paperWhere we follow Paradigm's design, where we depart from it, and the questions we would ask its authors.