Safety constraints

Extensions are third-party code running on the path of a trade, which is only acceptable because the pool contract bounds what they can do. The list below holds for every extension, official or not.

What no extension can do

Stop a trade. A fee calculator that fails is skipped and the pool falls back to its flat fee. An observer that fails is ignored and the swap completes. There is no configuration of extensions that leaves a coin untradable.

Both fallbacks are automatic, decided by the pool contract on the swap itself. Nobody is notified, nobody intervenes, and there is no switch for anyone to reach: a block that misbehaves stops mattering within the same transaction. The official blocks have no owner and no administrative function at all, which is why the protection has to work this way rather than by someone turning something off.

Hold anyone's funds. Extensions never take custody of a trader's ETH or coins. A fee recipient receives the creator's own share after the split has already happened, and nothing else passes through it.

Exceed the fee ceiling. No swap pays more than 10%, whatever a calculator returns. The single exception is a sniper tax window, capped at 50%, declared at creation and expiring on its own.

Reduce the protocol's cut. The protocol keeps an incompressible 0.03% of every fee, taken before any creator-chosen code is consulted.

Change the split the coin launched with. The liquidity providers' share and the protocol's share are applied by the pool contract itself. An extension cannot redirect either.

Change anything after the fact. Bindings and settings are written at creation. An extension cannot be swapped, retuned, added or removed on a live coin, by the creator or by the protocol team.

What an observer can do

Observers are notified after a swap has settled, with the fee that swap paid rather than its size. They can record, count and trigger other contracts. They cannot see a trade before it happens or influence its outcome.

Observers on a coin share one gas budget per swap, so a greedy observer leaves less for the ones after it. The creator sets the order.

Review and listing

Extensions are not gated on-chain: an address blacklist is trivially bypassed and a per-swap check would be a permanent cost on every trade. Control is at the interface instead. The protocol reviews the blocks it lists, and the app lists coins whose blocks are reviewed, marking the ones running anything else.

A coin using unreviewed code still works on-chain. It is simply not presented as if it had been checked.

What this does not protect against

The cage is about mechanics, not intent. A creator can legitimately configure a market that is expensive to trade or generous to itself, and every one of those settings is public before anyone buys. Reading them is the trader's job: Pre-trade checks.