# The enforced invariants: INV-1 to INV-20, properties that hold in every reachable state

> Canonical: https://blazephoenix.xyz/learn/the-invariants
> License: CC BY 4.0 (attribution + link) · © 2026 BlazePhoenix
> Updated: 2026-08-16

Twenty properties, INV-1 to INV-20, hold in every reachable state of the BlazePhoenix contracts — not monitored, enforced: a transaction that would violate one does not execute. The full enumeration with enforcement sites and boundaries, plus three invariants you can spot-check from a terminal in one minute.

An invariant, in this protocol's usage, is not a goal and not a monitoring target. It is a property that holds in every reachable state because the shape of the code enforces it at a named site, and a transaction that would violate it does not execute. The whitepaper enumerates all twenty in an appendix with stable numbering — cite them as INV-1 through INV-20 — and each row carries the same three-part form this site uses everywhere: the claim, the enforcement site, and the boundary.

The list is worth reading as a design in itself. Fifteen govern the aggregator, five the staking engine, and between them they cover custody, atomicity, pricing honesty, fee honesty, adaptive-state quarantine, and solvency. Nothing on the list is aspirational: every one is checkable against the verified source, and several are checkable against the live chain with one command.

## The aggregator: INV-1 to INV-15

Custody and atomicity first. INV-1: the Router holds no funds between transactions — its balance at rest is zero, because settlement sweeps every balance out. INV-2: every swap is atomic; no state exists in which part of a trade settled. INV-3: no oracle — no external price feed is an input to admission, ordering, splitting, flooring or fees, in either engine. INV-4: the fee rate, the fee split, the floor constants and the emission schedule have no setters in the deployed bytecode; they are compile-time constants, and immutability means there is no owner who could quietly move them later.

Protection next. INV-5: caller-supplied route fields can tighten protection, never loosen it — the effective minimum is a three-way maximum computed from in-frame measurements. INV-6: a swap with a zero minimum output does not execute, rejected at every entry point. INV-7 is the adaptive-state quarantine: the Vitality Field Ψ ranks and truncates candidates, but no quote, floor or allocation reads it — a score can hide a venue, never misprice a fill. INV-8 bounds the registry at sixteen pools per pair with a +25% eviction hurdle; INV-9 admits no address without runtime bytecode; INV-10 confines the universal callback to paying only the committed pool, only mid-leg, never above the leg's recorded budget, via transient storage.

Then the hard-won ones. INV-11: a V4 hook whose address declares delta-altering permissions is rejected before any token moves, without being called — the screen is an AND-mask over immutable address bits. INV-12 and INV-13 are the arithmetic discipline: every dangerous multiplication is factored through 512-bit mulDiv so no pricing product can overflow, and every division floors — accumulated rounding can only leave the contracts holding more than they owe. INV-14 is the posture in one line: where a bound cannot be proven, the computation returns zero and the venue is surrendered — never a guess. INV-15 closes the fee: the base never exceeds the smaller of quote and delivery, and an understated quote charges on delivery, so forging quotes downward loses money.

## The staking engine: INV-16 to INV-20

INV-16 is the one the others lean on: every value-moving staking entry point conserves — held and owed move by equal amounts within 10⁻⁸ BZPX, or the transaction reverts. That is the Master Conservation Identity enforced per transaction by the conserves modifier, and it is why an insolvent state is unreachable rather than merely unlikely. INV-17 is the single-writer rule: exactly one function writes the global boosted denominators, re-deriving both contributions atomically — the discipline that closed an entire class of disclosed findings and now also carries the emergency accounting's non-negative-equity accumulator. INV-18 pins time: a lapsed lock is paid at 1.00× from the instant of expiry, because every boost derives through effective lock time.

INV-19 bounds credit: debt is fixed at origination, interest is deducted from the borrower's own stake and never compounds, per-position debt stays at or below a third of stake, and aggregate utilisation at or below 75%. INV-20 is the Permissionless Breaker: anyone on earth may halt the contract, if and only if they can prove it insolvent — the trip condition is an objective on-chain fact (balance plus dust below owed()) that no caller can assert into existence, the breaker cannot be cancelled while the breach holds, and renunciation through the One-Way Door is written true at one site and false at none.

> equation: balance+totalDebt+totalBadDebt=totalStaked+rewardReserve+protocolReserve+pending — The Master Conservation Identity (E18), enforced per transaction by the conserves modifier (INV-16): a transaction that would unbalance it reverts, which is why insolvency is unreachable rather than monitored.

## Spot-check three of them right now

INV-6, from any RPC: submit an eth_call to any Router entry point with minOut = 0 and watch it revert — the mandatory-minimum check runs before anything moves. INV-16's public face: cast call 0x3f60C7aa0c36a78D200405feBE143d2Cf3fA0c77 "isSolvent()(bool)" against Base returns the live verdict free, at any block, and auditInvariants() exposes every term of the identity for independent summation. INV-4: pull the verified source from any explorer and grep for setter functions on the fee, the floor constants or the emission schedule — there are none to find.

That is what the list is for. A protocol description made of enforced invariants is falsifiable line by line, which is precisely what makes it safe to cite: not that the claims are modest, but that every one of them names the code that would have to be wrong for the claim to fail.

**Verify it yourself:** INV-6 in one step: eth_call any Router entry point with minOut = 0 and observe the revert; then cast call 0x3f60C7aa0c36a78D200405feBE143d2Cf3fA0c77 "isSolvent()(bool)" --rpc-url https://mainnet.base.org for the live face of INV-16

Related: https://blazephoenix.xyz/learn/the-primitive-equations · https://blazephoenix.xyz/learn/master-conservation-identity · https://blazephoenix.xyz/learn/iron-floor · https://blazephoenix.xyz/learn/permissionless-circuit-breaker · https://blazephoenix.xyz/learn/invariants-and-time · https://blazephoenix.xyz/learn/meta-equation-projection