Clause reference

The figures below are the mandate used in the recorded incident. They are a mandate, not a protocol constant: an owner signs whatever bounds they choose, and the guard enforces exactly those.

The measure the composition clauses are taken over

Sixty minutes, and trailing rather than tumbling. A window that reset on the hour would not be a bound at all: an agent spends the whole aggregate, waits for the boundary and spends it again, which is the structuring this product exists to name, one level up. The guard keeps the previous bucket beside the current one and decays it linearly out of the measure as the current one fills.

That is an approximation of a rolling window, and the approximation is stated rather than hidden: the estimate assumes the previous bucket's volume was spread evenly across it, so against a burst at the very end of that bucket it understates by at most previous × elapsed ÷ window. The alternative — a bucket per minute — costs gas on every action, multiplied by the delegation depth, to close a gap that is bounded and disclosed.

Child mandates narrow monotonically and must carry an equal windowSeconds: a shorter child window resets faster than the parent it debits, which would be the bypass. Clause 2.5 narrows upward — a child that would accept less back than its parent does is the same widening, written the other way up. A window of zero seconds is refused at registration, because every action would roll the epoch and the composition tier would silently measure nothing.

Clause 2.5, and why it is not a slippage setting

The guard calls the venue with calldata the agent wrote, and every production router takes a recipient. So a mandate that bounds only how much leaves does not bound what the owner keeps: the agent can address the proceeds elsewhere, or accept a tenth of their value, and every notional clause is satisfied. minAmountOut is the agent's parameter, and a value the caller controls is not a constraint.

Clause 2.5 is the owner's term instead: a floor in basis points of what left, expressed in the output leg's own units — both legs' decimals are read once, at registration, and stored with the instrument. It is checked twice. Before the branch, so an agent asking for less than the floor is held and recorded like any other breach. And on the measured result, where proceeds that went somewhere else appear as a balance that never arrived — a hold is impossible at that point, so that one reverts.

It needs no oracle, because it is not a price feed: it is a bound the owner states, the way they state every other one. A mandate may state no floor at all, and zero says so explicitly rather than leaving a protection quietly missing.