Connect ›
Cover: Metamorphic relations: a second judge for the maths, and three bounds measured before they were written

Metamorphic relations: a second judge for the maths, and three bounds measured before they were written

An oracle written from the same formula cannot catch the formula. Fourteen relations over the Core’s quote maths and five over the Solver’s plan ask instead how the output must move when the input moves.

Known formally as Metamorphic Relations in the BlazePhoenix whitepaper.

BlazePhoenix Engineering · updated 2026-09-06 · data through 2026-10-11 · 6 min · written from the deployed bytecode

By Mitra (@Sigmacrit) — anonymous developer of the BlazePhoenix protocol. The code is the résumé.

Abstract in 15 languages · resumo · resumen · 摘要 · 要旨 · ملخص

English — An oracle written from the same formula cannot catch the formula. Fourteen relations over the Core’s quote maths and five over the Solver’s plan ask instead how the output must move when the input moves — and three of the bounds were measured before they were written: one ulp of the square-root price, a plan paying 35 % less than an outlier, and 3 × 10⁻⁷ of the output.

Português — Um oráculo escrito a partir da mesma fórmula não pode apanhar a fórmula. Catorze relações sobre a matemática de cotação do Core e cinco sobre o plano do Solver perguntam antes como é que a saída tem de se mover quando a entrada se move — e três dos limites foram medidos antes de serem escritos: um ulp do preço raiz quadrada, um plano a pagar 35 % menos do que um outlier, e 3 × 10⁻⁷ da saída.

Español — Un oráculo escrito a partir de la misma fórmula no puede atrapar la fórmula. Catorce relaciones sobre la matemática de cotización del Core y cinco sobre el plan del Solver preguntan en cambio cómo debe moverse la salida cuando se mueve la entrada — y tres de las cotas se midieron antes de escribirse: un ulp del precio raíz cuadrada, un plan que paga 35 % menos que un valor atípico, y 3 × 10⁻⁷ de la salida.

Français — Un oracle écrit à partir de la même formule ne peut pas attraper la formule. Quatorze relations sur les maths de devis du Core et cinq sur le plan du Solver demandent plutôt comment la sortie doit bouger quand l’entrée bouge — et trois des bornes ont été mesurées avant d’être écrites : un ulp du prix racine carrée, un plan payant 35 % de moins qu’une valeur aberrante, et 3 × 10⁻⁷ de la sortie.

Deutsch — Ein Orakel, das aus derselben Formel geschrieben ist, kann die Formel nicht fangen. Vierzehn Relationen über die Quote-Mathematik des Core und fünf über den Plan des Solver fragen stattdessen, wie sich die Ausgabe bewegen muss, wenn sich die Eingabe bewegt — und drei der Schranken wurden gemessen, bevor sie geschrieben wurden: ein ulp des Wurzelpreises, ein Plan, der 35 % weniger zahlt als ein Ausreißer, und 3 × 10⁻⁷ der Ausgabe.

Русский — Оракул, написанный по той же формуле, не может поймать эту формулу. Четырнадцать отношений над математикой котировок Core и пять над планом Solver спрашивают иначе: как обязан двигаться выход, когда движется вход — и три из границ были измерены раньше, чем записаны: один ulp корневой цены, план, платящий на 35 % меньше выброса, и 3 × 10⁻⁷ от выхода.

Türkçe — Aynı formülden yazılan bir kâhin (oracle) o formülü yakalayamaz. Core’un teklif matematiği üzerine on dört bağıntı ve Solver’ın planı üzerine beş bağıntı bunun yerine, girdi kımıldadığında çıktının nasıl kımıldaması gerektiğini sorar — ve sınırların üçü yazılmadan önce ölçüldü: karekök fiyatın bir ulp’ü, bir aykırı değerden 35 % daha az ödeyen bir plan ve çıktının 3 × 10⁻⁷’si.

العربية — العرّاف المكتوب من الصيغة نفسها لا يستطيع الإمساك بالصيغة. أربع عشرة علاقة على رياضيات التسعير في Core وخمس على خطة Solver تسأل بدلًا من ذلك كيف يجب أن يتحرك الخرج حين يتحرك الدخل — وثلاثة من الحدود قيست قبل أن تُكتب: وحدة ulp واحدة من سعر الجذر التربيعي، وخطة تدفع 35 % أقل من قيمة شاذة، و3 × 10⁻⁷ من الخرج.

हिन्दी — उसी सूत्र से लिखा गया ऑरैकल उसी सूत्र को नहीं पकड़ सकता। Core के कोट गणित पर चौदह संबंध और Solver की योजना पर पाँच इसके बजाय यह पूछते हैं कि इनपुट हिलने पर आउटपुट को कैसे हिलना चाहिए — और तीन सीमाएँ लिखे जाने से पहले मापी गई थीं: वर्गमूल क़ीमत का एक ulp, एक बाहरी मान से 35 % कम चुकाने वाली योजना, और आउटपुट का 3 × 10⁻⁷।

日本語 — 同じ式から書かれたオラクルは、その式を捕まえられない。Core の見積もり計算に対する十四の関係と Solver の計画に対する五つの関係は、代わりに、入力が動いたとき出力はどう動かねばならないかを問う — そして境界のうち三つは書かれる前に測られた。平方根価格の 1 ulp、外れ値より 35 % 少なく支払う計画、そして出力の 3 × 10⁻⁷。

中文 — 用同一个公式写出的预言机抓不住那个公式。针对 Core 报价数学的十四条关系和针对 Solver 计划的五条关系换个问法:当输入移动时输出必须如何移动 — 其中三条界限是先测量、后写下的:平方根价格的一个 ulp、一份比离群值少付 35 % 的计划,以及输出的 3 × 10⁻⁷。

한국어 — 같은 공식으로 쓴 오라클은 그 공식을 잡아낼 수 없다. Core의 견적 수식에 대한 열네 개의 관계와 Solver의 계획에 대한 다섯 개의 관계는 대신, 입력이 움직일 때 출력이 어떻게 움직여야 하는지를 묻는다 — 그리고 경계 셋은 적히기 전에 측정되었다. 제곱근 가격의 1 ulp, 이상치보다 35 % 덜 지불하는 계획, 그리고 출력의 3 × 10⁻⁷.

Bahasa Indonesia — Sebuah orakel yang ditulis dari rumus yang sama tidak bisa menangkap rumus itu. Empat belas relasi atas matematika kuotasi Core dan lima atas rencana Solver justru bertanya bagaimana keluaran harus bergerak ketika masukan bergerak — dan tiga dari batasnya diukur sebelum dituliskan: satu ulp dari harga akar kuadrat, sebuah rencana yang membayar 35 % lebih sedikit daripada pencilan, dan 3 × 10⁻⁷ dari keluaran.

বাংলা — একই সূত্র থেকে লেখা ওরাকল সেই সূত্রটিকে ধরতে পারে না। Core-এর কোট গণিতের উপর চোদ্দটি সম্পর্ক এবং Solver-এর পরিকল্পনার উপর পাঁচটি সম্পর্ক বরং জিজ্ঞেস করে, ইনপুট নড়লে আউটপুটকে কীভাবে নড়তে হবে — আর তিনটি সীমা লেখার আগেই মাপা হয়েছিল: বর্গমূল দামের এক ulp, একটি বহিরাগত মানের চেয়ে 35 % কম দেওয়া একটি পরিকল্পনা, এবং আউটপুটের 3 × 10⁻⁷।

Filipino — Ang isang oracle na isinulat mula sa parehong pormula ay hindi kayang hulihin ang pormulang iyon. Labing-apat na relasyon sa matematika ng quote ng Core at lima sa plano ng Solver ang nagtatanong sa halip kung paano dapat gumalaw ang output kapag gumalaw ang input — at tatlo sa mga hangganan ay sinukat bago isinulat: isang ulp ng square-root price, isang planong nagbabayad ng 35 % na mas mababa kaysa sa isang outlier, at 3 × 10⁻⁷ ng output.

What you gain from this page is a way to test arithmetic without a reference implementation of it. Every mock in the suite quotes with the Core’s own formulas, so a defect in a formula is invisible to every parity test that uses them: the oracle is the object. Two answers exist. One is a canonical oracle, written from the venue’s published specification rather than from the Core. The other is a metamorphic relation — a statement about how the output must move when the input moves, which the venue’s own curve answers without any implementation at all. Chen, Cheung and Yiu named the technique in 1998; this page is what it measured here.

The relations

test/CoreMetamorphicRelations.t.sol holds fourteen relations over the Core’s quote maths; test/RouteMetamorphicRelations.t.sol holds five over the Solver’s plan, on a two-pool universe with a real Hub and a real Solver. Each row is a property no single expected value can express.

levelrelationwhat it says
Core, V2 · V3 · stableMR1 monotonemore in, never less out
Core, V2 · V3 · stableMR2 sub-additivesplitting an order across the same pool never gains
Core, V2 · stableMR3 no round tripin, then back on the updated reserves, never returns more than went in
Core, V2 · V3 · stableMR4 scale equivariancescaling order and pool together scales the output, to rounding
Core, V2 · V3MR5 fee monotonea higher fee never pays more
Core, V3MR6 direction symmetryat price 1.0 the two arms of outV3 agree to two ulps
Core, SolidlyMR7 identitythe volatile arm is outV2 — one producer
planMR-R1the split never pays less than the best single pool would
planMR-R2monotone in amountIn
planMR-R3adding a pool inside the price band never lowers the plan
planMR-R4registration order moves the plan by at most one weight unit of the split
planMR-R5the attested floor never exceeds the expected output

Source: ASSURANCE.md §4m; CoreMetamorphicRelations.t.sol (2026-09-02, extended 2026-09-05) and RouteMetamorphicRelations.t.sol (2026-09-05), all green

Why a second judge

A parity test compares the Router’s delivery with the Core’s prediction, and passes when they agree. If both are wrong in the same way — because the mock, the Core and the expectation were written from one mental model — the test is green and proves nothing about the formula. A relation escapes that trap because it does not know the answer; it only knows that two answers must stand in a certain order. MR1 does not say what outV3 returns; it says that returning less for more would be wrong on any curve a venue has ever published. That is evidence independent of the Core by construction, which is the only kind the evidence-independence instrument counts.

The canonical oracles are the complementary judge. Three implementations written from the venues’ invariants — Uniswap V2’s constant product with the fee on the input, Uniswap V3’s single-tick square-root-price step with the pool’s own against-the-trader rounding, Solidly’s stable curve solved by Newton’s method — are fuzzed against the Core, 5,000 runs each, asserting the direction first and the tightness second.

familydirectiontightness measured
Uniswap V2the Core never exceeds the specexact to the wei
Solidly stablethe Core never exceeds the curve by more than the solver’s own last stepwithin 4 wei
Uniswap V3the Core never exceeds the spec by more than one ulp of the square-root price, L / 2⁹⁶ weibelow one wei for every pool with L < 2⁹⁶

Source: ASSURANCE.md §4k; forge test --match-path test/regime/CanonicalOracles.t.sol, 5,000 runs per family — the V3 fuzz found 13 wei on a 6.5 × 10³⁴ output at L = 10³⁰, and the assertion is the bound, not the sample

Three bounds measured before they were written

The number in each assertion is the mechanism, not the sample. Each of the three below was seen in a run before it was stated in a test, and the test states the mechanism that produced it.

  1. MR6. At L = 8.5 × 10³⁷ and 1,374 wei in, the zeroForOne arm of outV3 quoted 1,073,741,823 wei — exactly L / 2⁹⁶, one ulp of the square-root price — while the other arm quoted 0, its price step rounded to nothing, failing closed. Both sit inside the canonical-oracle bound; the relation now states it between the arms: two ulps, one per arm, plus the two output floors.
  2. MR-R1 and MR-R3. With one pool priced 10¹⁰ away from the other, the plan paid 35 % less than the outlier alone, and a deep mispriced pool displaced a shallow honest one. That is the Solver’s median filter — MEDIAN_FILTER_BPS, ±5 % — refusing to believe an outlier. The relations hold over pools the filter admits, so the domain keeps the two prices within ±4 %.
  3. MR-R4. Replayed leg by leg: a pool whose depth weight floors to the minimum — 1 of 10,000 against the deepest — is kept as a dust leg when it was registered first and cut when registered second. Both plans are sound; they differ by what one weight unit of the amount earns in one pool against the other, observed at 3 × 10⁻⁷ of the output. The split’s keep-or-cut of a minimum-weight pool depends on its position, and that is now written down where it was found.

What a relation cannot see

Reproduce

forge test --match-path test/CoreMetamorphicRelations.t.sol        # fourteen relations over the quote maths
forge test --match-path test/RouteMetamorphicRelations.t.sol       # five relations over the plan, real Hub, real Solver
forge test --match-path test/regime/CanonicalOracles.t.sol         # the second judge: 5,000 runs per family

Do not trust this page — reproduce it

Every claim above is checkable against the chain. Start here:

forge test --match-path test/CoreMetamorphicRelations.t.sol  # then test/RouteMetamorphicRelations.t.sol — every relation above, green on a fresh run
Cite this article

Licensed CC BY 4.0 — quote, translate and reuse freely, including commercially, with attribution and a link. Copy a ready-made citation:

BlazePhoenix (2026). Metamorphic relations: a second judge for the maths, and three bounds measured before they were written. BlazePhoenix Engineering. https://blazephoenix.xyz/learn/metamorphic-relations
@misc{blazephoenix_metamorphic_relations,
  title  = {Metamorphic relations: a second judge for the maths, and three bounds measured before they were written},
  author = {BlazePhoenix},
  year   = {2026},
  url    = {https://blazephoenix.xyz/learn/metamorphic-relations},
  note   = {Accessed: reproduce the claim with the command above}
}

Writing an answer, a wiki entry or a paper? The claim above is reproducible against the chain before you quote it — which is the only sound basis for citing a technical source at all.

Contracts are verified on every chain we deploy to — addresses in the protocol manifest. Deeper formal treatment: the whitepaper (PDF). Standards cited: T. Y. CHEN, S. C. CHEUNG, S. M. YIU — METAMORPHIC TESTING: A NEW APPROACH FOR GENERATING NEXT TEST CASES, TECHNICAL REPORT HKUST-CS98-01, HONG KONG UNIVERSITY OF SCIENCE AND TECHNOLOGY (1998)

Related engineering

Next in Evidence standards · 5 / 8
Wired is not demonstrated: the difference between a venue family the code supports and one exercised against real chain state ›Support decomposes into three independent stages — found, priced, executed — and a table that reports the union inflates. Five families work end to end, four have been demonstrated against real chain state, and the three rows that fail are described rather than hidden.10 min

Questions, a partnership or a bug to report? Contact us or email contact@blazephoenix.xyz