HOT Manager

Functions

• setManager: Changes the manager of the HOT contract.

• setSigner: Changes the signer of the HOT contract.

• setMaxTokenVolumes: Changes the maximum token volumes available for a single HOT quote.

• setMaxAllowedQuotes: Updates the maximum number of HOT quotes allowed in a single block.

• setMaxOracleDeviationBips: Sets the maximum allowed deviation between AMM and Oracle price.

• setPause: Sets the pause flag, which instantly pauses all critical functions except withdrawals.

Security Model

1. All HOT manager functions except setPause should be placed under an appropriate timelock. LPs should verify that they are comfortable with the timelock value before depositing into the pool.

2. The manager acts like a guardian over the security parameters of the pool. This role should be controlled by a neutral, independent entity, completely separate from the signer and liquidityProvider roles.

3. The manager should actively monitor HOT transactions and pause the pool if any malicious activity is observed.

4. The maxAllowedQuotes variable should be set to relatively low values considering the signer's needs and the chain's block time. Higher maxAllowedQuotes values could allow the signer to sign a malicious HOT and drain some portion of LP funds in a single block. In most practical systems, a maxAllowedQuotes > 5 should not be needed.

5. The maxTokenVolumes values should be set to relatively low values, proportional to the reserves in the pool. It should be updated regularly as the reserves increase or decrease.

6. The maxOracleDeviationBips variable should be set to a relatively low value, considering the token pair's volatility and the oracle's latency.

Trust Assumptions

If bounds are set incorrectly, then at least two known attacks could become possible:

1. Malicious Signer Threat

2. Deposit Sandwich Threat