# Defeating dust-pool price manipulation: the capital-anchored split allocator

> Canonical: https://blazephoenix.xyz/learn/capital-anchored-split
> License: CC BY 4.0 (attribution + link) · © 2026 BlazePhoenix
> Updated: 2026-07-27

An aggregator that routes by best marginal price can be fooled by a tiny pool quoting a great rate it cannot honour at size. Anchoring the price filter on the deepest pool by REAL output-token balance separates price quality from depth and prices dust-pool manipulation out of reach.

When an aggregator splits your trade across several pools, it has to decide which pools deserve a share and how much. The naive rule is "take the best price". The problem is that a price, on its own, says nothing about how much of your trade that price can absorb — and an attacker who understands this can build a trap out of a pool with almost nothing in it.

## The dust-pool attack

Create a pool with a tiny amount of liquidity and set its ratio so it advertises a spectacular marginal rate — better than every real pool for the pair. An aggregator that ranks candidates by marginal price sees this dust pool at the top and routes toward it. But the pool holds almost nothing: past the first few tokens the price collapses, and the portion of your trade sent there is filled at a far worse rate than promised. The great quote was real for one wei and fiction for everything after it.

The subtle version poisons a MEDIAN. If the allocator picks a reference price by taking the median across candidate pools, seeding the set with several dust pools drags the median toward the fake rate, distorting how the whole trade is split — not just the slice sent to the dust. The manipulation does not need to win the route outright; it only needs to move the number the allocator trusts.

## The fix: anchor on real capital, not on quoted price

BlazePhoenix filters candidates with a marginal-rate test ANCHORED on the deepest pool by real output-token balance — the balance the pool actually holds on-chain, read directly, not the depth it reports. The pool with the most genuine capital sets the reference against which every other candidate's marginal rate is judged. A dust pool cannot pass, because its spectacular rate is measured against an anchor it has no capital to rival, and its tiny real balance excludes it from setting the reference in the first place.

This is the same move as the phantom-liquidity defence, applied to routing: trust the balance the chain can prove, never the depth a market advertises. The anchor separates the two things a naive allocator conflates — PRICE QUALITY (is this a good rate?) and DEPTH (can it fill my size?) — and it refuses to let the first be claimed without the second.

## Then split by depth

Once the anchor has admitted only pools with real capacity, allocation across them is DEPTH-WEIGHTED: each admitted pool receives a share proportional to how much of your trade it can absorb near the anchored price, across two routing topologies (a direct single-hop and multi-hop paths through a bridge asset). The trade lands where the liquidity genuinely is, so the realised average price tracks the quote instead of decaying into a pool that could never have filled its allocation.

The result is a router that cannot be steered by a cheaply-built lie. An attacker can always create a pool that quotes a wonderful price; what they cannot cheaply create is a pool that HOLDS a great deal of the token you are buying. By anchoring on the second thing rather than the first, the allocator prices manipulation out of reach.

**Verify it yourself:** Read the real output-token balanceOf the pools for a pair, then check that our route sends size toward the pools with genuine capital rather than toward whichever pool advertises the best marginal rate — the anchor is a balance you can read, not a price you must trust

Related: https://blazephoenix.xyz/learn/solidly-solver · https://blazephoenix.xyz/learn/phantom-liquidity · https://blazephoenix.xyz/learn/capacity-clamp · https://blazephoenix.xyz/learn/eightfold-dispatcher