The probability of a bad fill: execution as a distribution, not a number

Traders read a quote as a number. It is more useful, and more honest, to read it as the centre of a distribution. What you receive is a random variable whose mean is set by things that are knowable before you sign, and whose spread is set by things that are not. Almost every bad execution outcome comes from confusing the two — or from managing the mean while ignoring the tail.

Decomposing the fill

Realised output decomposes cleanly into three terms. First, the deterministic cost you cause yourself by consuming finite depth: price impact. It is computable in advance from pool state, it is convex in size, and it is not random at all. Second, the stochastic term: the market moving between the instant of the quote and the instant of inclusion — ordinary volatility plus, in an adversarial mempool, the deliberate reordering of trades around yours. Third, fixed costs: gas and protocol fees, which are small and knowable.

These require completely different treatment. The first is an optimisation problem: choose the allocation that minimises it. The second is a risk problem: you cannot predict a draw, you can only shape its distribution and bound its tail. Treating the second like the first — "set slippage to 5% and hope" — is not risk management; it is an unpriced option written to whoever is watching the mempool.

Why the tail is not Gaussian

It is tempting to model ε as symmetric noise. It is not. Ordinary volatility is roughly symmetric, but the adversarial component is one-sided by construction: an actor who can observe pending transactions and choose ordering profits only by moving the price AGAINST the pending trade. Nobody is spending gas to give you a better price.

That asymmetry has a practical consequence. The distribution of realised outcomes has a left tail that is both fatter and more responsive to your own parameters than a naive model suggests — because a wide tolerance does not merely permit a bad outcome, it INVITES one. A published willingness to accept, say, five per cent worse tells any observer exactly how much value can be extracted before the trade stops settling. The tolerance is not a passive safety margin; it is a bid, and the market will meet it.

What splitting actually buys

Distributing an order across independent venues lowers the mean cost, because impact is convex and the sum of the parts is cheaper than the whole. It also does something distinct to the risk term: the realised outcome becomes an average of several draws rather than a single one, so independent deviations partially cancel and the VARIANCE of the fill narrows even when its mean is unchanged.

The size of that benefit depends entirely on independence. Averaging over venues whose prices move together buys almost nothing — correlation is the enemy of diversification here exactly as it is in a portfolio, and two venues that arbitrage keeps welded together within a block are one venue wearing two names. And variance reduction is not tail protection: narrowing the body of a distribution leaves the extreme quantiles largely intact. Splitting improves the expected outcome and the typical outcome. It does not save you in the bad case.

Bounding the tail: the floor as a hard constraint

The only instrument that acts on the tail rather than the body is a hard minimum-output constraint enforced at settlement: below this amount, do not settle — revert. Its effect on the distribution is qualitative rather than incremental. Instead of an unbounded loss with some small probability, the outcome becomes bimodal: either a fill within the acceptable region, or no trade at all and the cost of gas.

This is worth stating precisely, because it changes what "risk" means for the transaction. Without the constraint, the quantity at risk is the trade size and the exposure is open-ended in the left tail. With it, the maximum loss is capped by construction and the residual risk is a small, known execution cost on the reverted path. You have converted an open-ended downside into a bounded one, and paid for it with a probability of not trading.

Two design consequences follow. First, the constraint must be derived from the real trade AT EXECUTION rather than read from data the caller supplied, or it is not a constraint at all — anyone who can widen it can widen it to nothing. Second, tightness has a real cost: a floor set close to the quote will occasionally revert on ordinary volatility, and that revert rate is the premium you pay for the bound. Choosing it is a genuine trade-off between fill probability and tail protection, and it should be chosen deliberately rather than defaulted to whatever number makes the reverts stop.

Reading a quote like a statistician

The practical upshot is a short list. Ask what the quote is a point estimate OF — a number computed by the same code that will execute is a far tighter estimator than one computed by a separate pricing service that may diverge from settlement. Ask which part of the spread is your own impact (reducible by sizing and splitting) and which is market risk (only boundable). Ask what the tolerance advertises to an observer, because it is public information the moment the transaction is pending. And ask what happens in the bad case: if the answer is "you receive whatever arrives", there is no bound, and the distribution has no floor under it.

A protocol that shows you a number is telling you about the centre. A protocol that also tells you the enforced worst case is telling you about the tail — and the tail is the part that decides whether a strategy survives repetition.

Related engineering

• Why splitting a trade across pools costs less: the convexity behind route splitting ›
• The iron floor: a minimum output the contract re-derives for itself ›
• Sandwich attacks, explained: how bots eat your swap and how floors stop them ›
• Slippage, explained: why you got fewer tokens than the screen promised ›