@logswap/sdk 0.5.56 → 0.5.58

package/dist/claims.js

@@ -59,40 +59,21 @@ export async function isRouterApproved(c, owner) {
     });
 }
 export async function checkReadiness(c, key, owner, need = {}) {
-    const erc20 = [
-        {
-            type: "function",
-            name: "allowance",
-            stateMutability: "view",
-            inputs: [
-                { name: "owner", type: "address" },
-                { name: "spender", type: "address" },
-            ],
-            outputs: [{ type: "uint256" }],
-        },
-    ];
-    const [operator, baseAllow, quoteAllow] = await Promise.all([
+    // A token is ready when BOTH legs of its pull path are: the ERC-20 allowance to whoever pulls
+    // (Permit2 when wired) and, with Permit2, its unexpired allowance to the router. This used to
+    // read the ERC-20 allowance to the ROUTER, which on a Permit2 deployment is never granted — so
+    // it said "approve" forever, and approving the router changed nothing.
+    const { checkTokenReadiness } = await import("./onboard.js");
+    const ready = async (token, amount) => {
+        if (amount === undefined)
+            return true;
+        const r = await checkTokenReadiness(c, token, owner, amount);
+        return !r.needsTokenApproval && !r.needsPermit2Approval;
+    };
+    const [operator, baseOk, quoteOk] = await Promise.all([
         need.positions ? isRouterApproved(c, owner) : Promise.resolve(true),
-        need.base
-            ? c.public.readContract({
-                address: key.base,
-                abi: erc20,
-                functionName: "allowance",
-                args: [owner, c.addresses.router],
-            })
-            : Promise.resolve(0n),
-        need.quote
-            ? c.public.readContract({
-                address: key.quote,
-                abi: erc20,
-                functionName: "allowance",
-                args: [owner, c.addresses.router],
-            })
-            : Promise.resolve(0n),
+        ready(key.base, need.base),
+        ready(key.quote, need.quote),
     ]);
-    return {
-        needsOperator: !operator,
-        needsBaseAllowance: need.base !== undefined && baseAllow < need.base,
-        needsQuoteAllowance: need.quote !== undefined && quoteAllow < need.quote,
-    };
+    return { needsOperator: !operator, needsBaseAllowance: !baseOk, needsQuoteAllowance: !quoteOk };
 }

package/dist/client.d.ts

@@ -85,3 +85,10 @@ export declare const EXPECTED_VERSION = 4n;
  */
 export declare const EXPECTED_F_VERSION = 18n;
 export declare function assertVersion(c: LogswapClient, expected?: bigint): Promise<void>;
+/**
+ * The versions say the managers are the right code; this says the rest of the addresses belong
+ * to THEM. A stale router or lens from a previous deployment passes every version check and then
+ * fails in the worst way: approvals go to a router that pulls for another manager, or every pull
+ * reverts because the router's Permit2 is not the one the user approved.
+ */
+export declare function assertWiring(c: LogswapClient): Promise<void>;

package/dist/client.js

@@ -8,7 +8,39 @@
  * the protocol, not configuration that grows.
  */
 export function createLogswapClient(args) {
-    return { public: args.public, wallet: args.wallet, addresses: args.addresses };
+    return { public: args.public, wallet: args.wallet && guardChain(args.wallet, args.public), addresses: args.addresses };
+}
+/**
+ * The wallet, with every signing call first checking that it is on the chain the reads come from.
+ *
+ * An injected wallet switched to another network would otherwise estimate and simulate against
+ * the public client's chain and then sign and send on its own — with deterministic deploy
+ * addresses, possibly into a different contract. Checked at each call, not once: a user can
+ * switch networks mid-session.
+ */
+function guardChain(wallet, pub) {
+    if (typeof wallet.getChainId !== "function")
+        return wallet; // a test double
+    let readChain = pub.chain?.id;
+    const check = async () => {
+        readChain ??= await pub.getChainId();
+        const walletChain = await wallet.getChainId();
+        if (walletChain !== readChain) {
+            throw new Error(`logswap: the wallet is on chain ${walletChain} but this app reads chain ${readChain} — switch the wallet's network`);
+        }
+    };
+    const guarded = new Set(["writeContract", "sendTransaction", "signTypedData"]);
+    return new Proxy(wallet, {
+        get(target, prop, receiver) {
+            const v = Reflect.get(target, prop, receiver);
+            if (!guarded.has(prop) || typeof v !== "function")
+                return v;
+            return async (...a) => {
+                await check();
+                return v.apply(target, a);
+            };
+        },
+    });
 }
 /**
  * Assert the deployment matches the ABI this build was generated against.
@@ -114,4 +146,29 @@ export async function assertVersion(c, expected = EXPECTED_VERSION) {
                 `at least F version ${EXPECTED_F_VERSION}. Upgrade the deployment or point at a newer one.`);
         }
     }
+    await assertWiring(c);
+}
+/**
+ * The versions say the managers are the right code; this says the rest of the addresses belong
+ * to THEM. A stale router or lens from a previous deployment passes every version check and then
+ * fails in the worst way: approvals go to a router that pulls for another manager, or every pull
+ * reverts because the router's Permit2 is not the one the user approved.
+ */
+export async function assertWiring(c) {
+    const { logswapRouterAbi, logswapLensAbi } = await import("./generated.js");
+    const rd = (address, abi, functionName) => c.public.readContract({ address, abi, functionName });
+    const ZERO = "0x0000000000000000000000000000000000000000";
+    const want = [
+        ["router.mgr()", rd(c.addresses.router, logswapRouterAbi, "mgr"), c.addresses.cPoolManager],
+        ["router.permit2()", rd(c.addresses.router, logswapRouterAbi, "permit2"), c.addresses.permit2 ?? ZERO],
+        ["lens.mgr()", rd(c.addresses.lens, logswapLensAbi, "mgr"), c.addresses.cPoolManager],
+    ];
+    if (c.addresses.fPoolManager) {
+        want.push(["router.fmgr()", rd(c.addresses.router, logswapRouterAbi, "fmgr"), c.addresses.fPoolManager]);
+        want.push(["lens.fmgr()", rd(c.addresses.lens, logswapLensAbi, "fmgr"), c.addresses.fPoolManager]);
+    }
+    const got = await Promise.all(want.map((w) => w[1]));
+    const bad = want.flatMap(([what, , expected], i) => got[i].toLowerCase() === expected.toLowerCase() ? [] : [`${what} is ${got[i]}, expected ${expected}`]);
+    if (bad.length)
+        throw new Error(`logswap: the deployment's addresses do not belong together — ${bad.join("; ")}`);
 }

package/dist/fees.d.ts

@@ -30,7 +30,17 @@ export interface SwapFeeWindow {
     swapFees: bigint;
     swaps: number;
 }
-/** The first block with timestamp ≥ `t`, by bisection over `[lo, hi]`; `hi` when none is earlier. */
+/**
+ * The first block with timestamp ≥ `t` in `[lo, hi]`; `hi` when none is earlier.
+ *
+ * A PARALLEL search: each round reads {@link PROBES} evenly spaced blocks at once and keeps the
+ * sixteenth of the bracket that holds the answer, so 64k blocks take 4 round trips. Bisection read
+ * one block per round trip — ~16 sequential `getBlock`s, seconds apiece against a distant node,
+ * before a fee figure could render. Interpolating on timestamps was tried and did no better: a
+ * devnet mines on demand plus a heartbeat, so its blocks are far from evenly spaced in time.
+ * Exact for monotonic timestamps; a chain restored from a snapshot can carry a genesis stamped
+ * after its later blocks, so callers bound `lo` by the block they care about (a pool's own).
+ */
 export declare function blockAtOrAfter(c: LogswapClient, t: bigint, lo: bigint, hi: bigint): Promise<bigint>;
 /**
  * Sum the swap fees of market `m` over a window: from `since` (unix seconds) or `fromBlock`, to

package/dist/fees.js

@@ -17,16 +17,42 @@ const YEAR_SECONDS = 31_536_000;
 export function swapFeeOf(e, phi) {
     return e.baseIn ? (e.amountOut * phi) / (WAD - phi) : (e.amountIn * phi) / (WAD + phi);
 }
-/** The first block with timestamp ≥ `t`, by bisection over `[lo, hi]`; `hi` when none is earlier. */
+/** Probes per round of {@link blockAtOrAfter}: 15 splits the bracket 16 ways. */
+const PROBES = 15n;
+/**
+ * The first block with timestamp ≥ `t` in `[lo, hi]`; `hi` when none is earlier.
+ *
+ * A PARALLEL search: each round reads {@link PROBES} evenly spaced blocks at once and keeps the
+ * sixteenth of the bracket that holds the answer, so 64k blocks take 4 round trips. Bisection read
+ * one block per round trip — ~16 sequential `getBlock`s, seconds apiece against a distant node,
+ * before a fee figure could render. Interpolating on timestamps was tried and did no better: a
+ * devnet mines on demand plus a heartbeat, so its blocks are far from evenly spaced in time.
+ * Exact for monotonic timestamps; a chain restored from a snapshot can carry a genesis stamped
+ * after its later blocks, so callers bound `lo` by the block they care about (a pool's own).
+ */
 export async function blockAtOrAfter(c, t, lo, hi) {
-    while (lo < hi) {
-        const mid = (lo + hi) / 2n;
-        if ((await c.public.getBlock({ blockNumber: mid })).timestamp < t)
-            lo = mid + 1n;
-        else
-            hi = mid;
+    if (lo >= hi)
+        return hi;
+    const stamp = async (n) => (await c.public.getBlock({ blockNumber: n })).timestamp;
+    if ((await stamp(lo)) >= t)
+        return lo;
+    // invariant from here: ts(lo) < t, and the answer is in (lo, hi]
+    while (hi - lo > 1n) {
+        const width = hi - lo;
+        const probes = [...new Set(Array.from({ length: Number(PROBES) }, (_, i) => lo + (width * BigInt(i + 1)) / (PROBES + 1n)))].filter((n) => n > lo && n < hi);
+        if (probes.length === 0)
+            probes.push(lo + width / 2n);
+        const stamps = await Promise.all(probes.map(stamp));
+        const first = stamps.findIndex((ts) => ts >= t);
+        if (first === -1)
+            lo = probes[probes.length - 1];
+        else {
+            hi = probes[first];
+            if (first > 0)
+                lo = probes[first - 1];
+        }
     }
-    return lo;
+    return hi;
 }
 /**
  * Sum the swap fees of market `m` over a window: from `since` (unix seconds) or `fromBlock`, to

package/dist/fpool.js

@@ -45,7 +45,7 @@ export { fPoolManagerAbi, padPolicyAbi, polPolicyAbi, privatePolicyAbi, publicPo
  * in for the base — a call through it to any of the four policies decodes the base's functions.
  */
 export const fPolicyBaseAbi = polPolicyAbi;
-import { signerFor } from "./write.js";
+import { fallBackUnlessRejected, signerFor } from "./write.js";
 const WAD = 10n ** 18n;
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
 /** The optional questions a policy declared at birth, as bits of `Pool.asks`. */
@@ -435,7 +435,7 @@ pullTokens = []) {
     let sendArgs = args;
     if (pullTokens.length) {
         const { permit2SigCalls } = await import("./onboard.js");
-        const sigCalls = await permit2SigCalls(c, pullTokens).catch(() => []);
+        const sigCalls = await permit2SigCalls(c, pullTokens).catch(fallBackUnlessRejected);
         if (sigCalls.length) {
             const { encodeFunctionData } = await import("viem");
             const inner = encodeFunctionData({ abi: logswapRouterAbi, functionName, args });

package/dist/onboard.d.ts

@@ -18,6 +18,17 @@ import type { LogswapClient } from "./client.js";
 export declare const MAX_UINT256: bigint;
 export declare const MAX_UINT160: bigint;
 export declare const MAX_UINT48: bigint;
+/**
+ * How long a Permit2 allowance to the router lives: 30 days, as Uniswap's own interface does. It
+ * used to be `MAX_UINT48` — never — so a router bug or a compromised router could pull every
+ * approved token from every user indefinitely. A lapsed allowance is re-granted by one more
+ * signature, riding inside the next write ({@link permit2SigCalls}).
+ */
+export declare const PERMIT2_EXPIRY_SECONDS: bigint;
+/** The expiry to grant now. */
+export declare const permit2Expiry: () => bigint;
+/** Whether a Permit2 allowance (amount, expiration) covers `need` for long enough to land. */
+export declare const permit2Covers: (amount: bigint, expiration: number, need: bigint) => boolean;
 /** Is this deployment's router wired to Permit2? Decides which approval path applies. */
 export declare function usesPermit2(c: LogswapClient): boolean;
 /** The contract that will actually pull tokens: Permit2 when wired, otherwise the router. */

package/dist/onboard.js

@@ -18,6 +18,20 @@ import { requireWallet } from "./write.js";
 export const MAX_UINT256 = (1n << 256n) - 1n;
 export const MAX_UINT160 = (1n << 160n) - 1n;
 export const MAX_UINT48 = (1n << 48n) - 1n;
+/**
+ * How long a Permit2 allowance to the router lives: 30 days, as Uniswap's own interface does. It
+ * used to be `MAX_UINT48` — never — so a router bug or a compromised router could pull every
+ * approved token from every user indefinitely. A lapsed allowance is re-granted by one more
+ * signature, riding inside the next write ({@link permit2SigCalls}).
+ */
+export const PERMIT2_EXPIRY_SECONDS = 30n * 24n * 3600n;
+/** An allowance that lapses within this window is treated as already lapsed: it could die in flight. */
+const EXPIRY_MARGIN_SECONDS = 3600;
+const nowSeconds = () => Math.floor(Date.now() / 1000);
+/** The expiry to grant now. */
+export const permit2Expiry = () => BigInt(nowSeconds()) + PERMIT2_EXPIRY_SECONDS;
+/** Whether a Permit2 allowance (amount, expiration) covers `need` for long enough to land. */
+export const permit2Covers = (amount, expiration, need) => amount >= need && expiration > nowSeconds() + EXPIRY_MARGIN_SECONDS;
 const ERC20 = parseAbi([
     "function approve(address spender, uint256 amount) returns (bool)",
     "function allowance(address owner, address spender) view returns (uint256)",
@@ -54,7 +68,7 @@ export async function approveToken(c, token, amount = MAX_UINT256) {
  * router, bundled through `multicall`) in production; this transaction form is what a test or a
  * simple UI wants.
  */
-export async function approvePermit2ForRouter(c, token, amount = MAX_UINT160, expiration = MAX_UINT48) {
+export async function approvePermit2ForRouter(c, token, amount = MAX_UINT160, expiration = permit2Expiry()) {
     if (!usesPermit2(c))
         return null;
     const { account } = requireWallet(c);
@@ -89,13 +103,13 @@ export async function onboardToken(c, token, need) {
         sent.push(h);
     }
     if (usesPermit2(c)) {
-        const [amt] = (await c.public.readContract({
+        const [amt, expiration] = (await c.public.readContract({
             address: c.addresses.permit2,
             abi: PERMIT2,
             functionName: "allowance",
             args: [address, token, c.addresses.router],
         }));
-        if (amt < need) {
+        if (!permit2Covers(amt, expiration, need)) {
             const h = await approvePermit2ForRouter(c, token);
             if (h) {
                 await c.public.waitForTransactionReceipt({ hash: h });
@@ -114,13 +128,13 @@ export async function checkTokenReadiness(c, token, owner, need) {
     }));
     let needsPermit2Approval = false;
     if (usesPermit2(c)) {
-        const [amt] = (await c.public.readContract({
+        const [amt, expiration] = (await c.public.readContract({
             address: c.addresses.permit2,
             abi: PERMIT2,
             functionName: "allowance",
             args: [owner, token, c.addresses.router],
         }));
-        needsPermit2Approval = amt < need;
+        needsPermit2Approval = !permit2Covers(amt, expiration, need);
     }
     return { usesPermit2: usesPermit2(c), needsTokenApproval: allowance < need, needsPermit2Approval };
 }
@@ -156,16 +170,16 @@ export async function permit2SigCalls(c, tokens) {
     const chainId = await c.public.getChainId();
     const calls = [];
     for (const token of [...new Set(tokens.map((t) => t.toLowerCase()))]) {
-        const [amt, , nonce] = (await c.public.readContract({
+        const [amt, expiration, nonce] = (await c.public.readContract({
             address: c.addresses.permit2,
             abi: PERMIT2,
             functionName: "allowance",
             args: [owner, token, c.addresses.router],
         }));
-        if (amt >= 1n << 120n)
-            continue; // effectively infinite already
+        if (permit2Covers(amt, expiration, 1n << 120n))
+            continue; // effectively unlimited, and not lapsing
         const message = {
-            details: { token, amount: MAX_UINT160, expiration: Number(MAX_UINT48), nonce },
+            details: { token, amount: MAX_UINT160, expiration: Number(permit2Expiry()), nonce },
             spender: c.addresses.router,
             sigDeadline: BigInt(Math.floor(Date.now() / 1000)) + 1800n,
         };

package/dist/write.d.ts

@@ -12,7 +12,7 @@
  * raw `minOut`/`maxIn` the contract wants. `withSlippage()` derives one from a quote when that is
  * what you have — but the bound is what ships.
  */
-import type { Address, Hash } from "viem";
+import type { Address, Hash, Hex } from "viem";
 import type { LogswapClient } from "./client.js";
 /** Disables the deadline check. Deliberate opt-out, never a default. */
 export declare const NEVER: bigint;
@@ -73,6 +73,18 @@ export declare function sendRouterWrite(c: LogswapClient, args: {
     args: readonly unknown[];
     bufferPct?: bigint;
 }): Promise<Hash>;
+/**
+ * Whether an error is the user saying no in their wallet (EIP-1193 code 4001, viem's
+ * `UserRejectedRequestError`), however deep viem nested it.
+ */
+export declare function isUserRejection(e: unknown): boolean;
+/**
+ * The permit signatures are an optimisation: when they cannot be produced (a wallet without
+ * `signTypedData`, a read that failed) the write goes out plain and relies on a standing
+ * allowance. A REJECTED signature is not that — it was swallowed too, and the user who had just
+ * said no was shown a transaction prompt, which then reverted with a Permit2 error that hid why.
+ */
+export declare function fallBackUnlessRejected(e: unknown): Hex[];
 /** Simulate a router write and return its decoded result, without sending. */
 export declare function simulateRouterWrite<T>(c: LogswapClient, args: {
     abi: readonly unknown[];

package/dist/write.js

@@ -92,6 +92,31 @@ export async function sendRouterWrite(c, args) {
     const gas = (estimate * (100n + (args.bufferPct ?? 30n))) / 100n;
     return c.wallet.writeContract({ ...params, gas });
 }
+/**
+ * Whether an error is the user saying no in their wallet (EIP-1193 code 4001, viem's
+ * `UserRejectedRequestError`), however deep viem nested it.
+ */
+export function isUserRejection(e) {
+    const seen = new Set();
+    for (let x = e; x && typeof x === "object" && !seen.has(x); x = x.cause) {
+        seen.add(x);
+        const o = x;
+        if (o.name === "UserRejectedRequestError" || o.code === 4001)
+            return true;
+    }
+    return false;
+}
+/**
+ * The permit signatures are an optimisation: when they cannot be produced (a wallet without
+ * `signTypedData`, a read that failed) the write goes out plain and relies on a standing
+ * allowance. A REJECTED signature is not that — it was swallowed too, and the user who had just
+ * said no was shown a transaction prompt, which then reverted with a Permit2 error that hid why.
+ */
+export function fallBackUnlessRejected(e) {
+    if (isUserRejection(e))
+        throw e;
+    return [];
+}
 /** Simulate a router write and return its decoded result, without sending. */
 export async function simulateRouterWrite(c, args) {
     const account = args.account ?? c.wallet?.account?.address;
@@ -112,7 +137,7 @@ export async function simulateRouterWrite(c, args) {
  */
 export async function sendRouterWriteWithPermits(c, args, pullTokens) {
     const { permit2SigCalls } = await import("./onboard.js");
-    const sigCalls = await permit2SigCalls(c, pullTokens).catch(() => []);
+    const sigCalls = await permit2SigCalls(c, pullTokens).catch(fallBackUnlessRejected);
     if (sigCalls.length === 0)
         return sendRouterWrite(c, args);
     const { encodeFunctionData } = await import("viem");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logswap/sdk",
-  "version": "0.5.56",
+  "version": "0.5.58",
   "description": "TypeScript SDK for Logswap, the liquidity primitive introducing the logarithmic invariant — typed wrappers over the CPoolManager / FPoolManager / Router / Lens surface.",
   "license": "GPL-2.0-or-later",
   "type": "module",

package/src/claims.ts

@@ -91,42 +91,20 @@ export async function checkReadiness(
   owner: Address,
   need: { base?: bigint; quote?: bigint; positions?: boolean } = {},
 ): Promise<Readiness> {
-  const erc20 = [
-    {
-      type: "function",
-      name: "allowance",
-      stateMutability: "view",
-      inputs: [
-        { name: "owner", type: "address" },
-        { name: "spender", type: "address" },
-      ],
-      outputs: [{ type: "uint256" }],
-    },
-  ] as const;
-
-  const [operator, baseAllow, quoteAllow] = await Promise.all([
+  // A token is ready when BOTH legs of its pull path are: the ERC-20 allowance to whoever pulls
+  // (Permit2 when wired) and, with Permit2, its unexpired allowance to the router. This used to
+  // read the ERC-20 allowance to the ROUTER, which on a Permit2 deployment is never granted — so
+  // it said "approve" forever, and approving the router changed nothing.
+  const { checkTokenReadiness } = await import("./onboard.js");
+  const ready = async (token: Address, amount?: bigint) => {
+    if (amount === undefined) return true;
+    const r = await checkTokenReadiness(c, token, owner, amount);
+    return !r.needsTokenApproval && !r.needsPermit2Approval;
+  };
+  const [operator, baseOk, quoteOk] = await Promise.all([
     need.positions ? isRouterApproved(c, owner) : Promise.resolve(true),
-    need.base
-      ? (c.public.readContract({
-          address: key.base,
-          abi: erc20,
-          functionName: "allowance",
-          args: [owner, c.addresses.router],
-        }) as Promise<bigint>)
-      : Promise.resolve(0n),
-    need.quote
-      ? (c.public.readContract({
-          address: key.quote,
-          abi: erc20,
-          functionName: "allowance",
-          args: [owner, c.addresses.router],
-        }) as Promise<bigint>)
-      : Promise.resolve(0n),
+    ready(key.base, need.base),
+    ready(key.quote, need.quote),
   ]);
-
-  return {
-    needsOperator: !operator,
-    needsBaseAllowance: need.base !== undefined && baseAllow < need.base,
-    needsQuoteAllowance: need.quote !== undefined && quoteAllow < need.quote,
-  };
+  return { needsOperator: !operator, needsBaseAllowance: !baseOk, needsQuoteAllowance: !quoteOk };
 }

package/src/client.ts

@@ -52,7 +52,38 @@ export function createLogswapClient(args: {
   wallet?: WalletClient;
   addresses: LogswapAddresses;
 }): LogswapClient {
-  return { public: args.public, wallet: args.wallet, addresses: args.addresses };
+  return { public: args.public, wallet: args.wallet && guardChain(args.wallet, args.public), addresses: args.addresses };
+}
+
+/**
+ * The wallet, with every signing call first checking that it is on the chain the reads come from.
+ *
+ * An injected wallet switched to another network would otherwise estimate and simulate against
+ * the public client's chain and then sign and send on its own — with deterministic deploy
+ * addresses, possibly into a different contract. Checked at each call, not once: a user can
+ * switch networks mid-session.
+ */
+function guardChain(wallet: WalletClient, pub: PublicClient): WalletClient {
+  if (typeof wallet.getChainId !== "function") return wallet; // a test double
+  let readChain: number | undefined = pub.chain?.id;
+  const check = async () => {
+    readChain ??= await pub.getChainId();
+    const walletChain = await wallet.getChainId();
+    if (walletChain !== readChain) {
+      throw new Error(`logswap: the wallet is on chain ${walletChain} but this app reads chain ${readChain} — switch the wallet's network`);
+    }
+  };
+  const guarded = new Set<PropertyKey>(["writeContract", "sendTransaction", "signTypedData"]);
+  return new Proxy(wallet, {
+    get(target, prop, receiver) {
+      const v = Reflect.get(target, prop, receiver);
+      if (!guarded.has(prop) || typeof v !== "function") return v;
+      return async (...a: unknown[]) => {
+        await check();
+        return (v as (...x: unknown[]) => unknown).apply(target, a);
+      };
+    },
+  });
 }
 
 /**
@@ -164,4 +195,32 @@ export async function assertVersion(c: LogswapClient, expected = EXPECTED_VERSIO
       );
     }
   }
+  await assertWiring(c);
+}
+
+/**
+ * The versions say the managers are the right code; this says the rest of the addresses belong
+ * to THEM. A stale router or lens from a previous deployment passes every version check and then
+ * fails in the worst way: approvals go to a router that pulls for another manager, or every pull
+ * reverts because the router's Permit2 is not the one the user approved.
+ */
+export async function assertWiring(c: LogswapClient): Promise<void> {
+  const { logswapRouterAbi, logswapLensAbi } = await import("./generated.js");
+  const rd = (address: Address, abi: readonly unknown[], functionName: string) =>
+    c.public.readContract({ address, abi, functionName } as never) as Promise<Address>;
+  const ZERO = "0x0000000000000000000000000000000000000000";
+  const want: Array<[string, Promise<Address>, Address]> = [
+    ["router.mgr()", rd(c.addresses.router, logswapRouterAbi, "mgr"), c.addresses.cPoolManager],
+    ["router.permit2()", rd(c.addresses.router, logswapRouterAbi, "permit2"), c.addresses.permit2 ?? ZERO],
+    ["lens.mgr()", rd(c.addresses.lens, logswapLensAbi, "mgr"), c.addresses.cPoolManager],
+  ];
+  if (c.addresses.fPoolManager) {
+    want.push(["router.fmgr()", rd(c.addresses.router, logswapRouterAbi, "fmgr"), c.addresses.fPoolManager]);
+    want.push(["lens.fmgr()", rd(c.addresses.lens, logswapLensAbi, "fmgr"), c.addresses.fPoolManager]);
+  }
+  const got = await Promise.all(want.map((w) => w[1]));
+  const bad = want.flatMap(([what, , expected], i) =>
+    got[i]!.toLowerCase() === expected.toLowerCase() ? [] : [`${what} is ${got[i]}, expected ${expected}`],
+  );
+  if (bad.length) throw new Error(`logswap: the deployment's addresses do not belong together — ${bad.join("; ")}`);
 }

package/src/fees.ts

@@ -36,14 +36,40 @@ export interface SwapFeeWindow {
   swaps: number;
 }
 
-/** The first block with timestamp ≥ `t`, by bisection over `[lo, hi]`; `hi` when none is earlier. */
+/** Probes per round of {@link blockAtOrAfter}: 15 splits the bracket 16 ways. */
+const PROBES = 15n;
+
+/**
+ * The first block with timestamp ≥ `t` in `[lo, hi]`; `hi` when none is earlier.
+ *
+ * A PARALLEL search: each round reads {@link PROBES} evenly spaced blocks at once and keeps the
+ * sixteenth of the bracket that holds the answer, so 64k blocks take 4 round trips. Bisection read
+ * one block per round trip — ~16 sequential `getBlock`s, seconds apiece against a distant node,
+ * before a fee figure could render. Interpolating on timestamps was tried and did no better: a
+ * devnet mines on demand plus a heartbeat, so its blocks are far from evenly spaced in time.
+ * Exact for monotonic timestamps; a chain restored from a snapshot can carry a genesis stamped
+ * after its later blocks, so callers bound `lo` by the block they care about (a pool's own).
+ */
 export async function blockAtOrAfter(c: LogswapClient, t: bigint, lo: bigint, hi: bigint): Promise<bigint> {
-  while (lo < hi) {
-    const mid = (lo + hi) / 2n;
-    if ((await c.public.getBlock({ blockNumber: mid })).timestamp < t) lo = mid + 1n;
-    else hi = mid;
+  if (lo >= hi) return hi;
+  const stamp = async (n: bigint) => (await c.public.getBlock({ blockNumber: n })).timestamp;
+  if ((await stamp(lo)) >= t) return lo;
+  // invariant from here: ts(lo) < t, and the answer is in (lo, hi]
+  while (hi - lo > 1n) {
+    const width = hi - lo;
+    const probes = [...new Set(Array.from({ length: Number(PROBES) }, (_, i) => lo + (width * BigInt(i + 1)) / (PROBES + 1n)))].filter(
+      (n) => n > lo && n < hi,
+    );
+    if (probes.length === 0) probes.push(lo + width / 2n);
+    const stamps = await Promise.all(probes.map(stamp));
+    const first = stamps.findIndex((ts) => ts >= t);
+    if (first === -1) lo = probes[probes.length - 1]!;
+    else {
+      hi = probes[first]!;
+      if (first > 0) lo = probes[first - 1]!;
+    }
   }
-  return lo;
+  return hi;
 }
 
 /**

package/src/fpool.ts

@@ -48,7 +48,7 @@ export { fPoolManagerAbi, padPolicyAbi, polPolicyAbi, privatePolicyAbi, publicPo
  */
 export const fPolicyBaseAbi = polPolicyAbi;
 import type { LogswapClient } from "./client.js";
-import { signerFor } from "./write.js";
+import { fallBackUnlessRejected, signerFor } from "./write.js";
 
 const WAD = 10n ** 18n;
 const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000" as const;
@@ -676,7 +676,7 @@ async function writeRouter(
   let sendArgs: unknown[] = args;
   if (pullTokens.length) {
     const { permit2SigCalls } = await import("./onboard.js");
-    const sigCalls = await permit2SigCalls(c, pullTokens).catch(() => []);
+    const sigCalls = await permit2SigCalls(c, pullTokens).catch(fallBackUnlessRejected);
     if (sigCalls.length) {
       const { encodeFunctionData } = await import("viem");
       const inner = encodeFunctionData({ abi: logswapRouterAbi, functionName, args } as never);

package/src/onboard.ts

@@ -22,6 +22,23 @@ export const MAX_UINT256 = (1n << 256n) - 1n;
 export const MAX_UINT160 = (1n << 160n) - 1n;
 export const MAX_UINT48 = (1n << 48n) - 1n;
 
+/**
+ * How long a Permit2 allowance to the router lives: 30 days, as Uniswap's own interface does. It
+ * used to be `MAX_UINT48` — never — so a router bug or a compromised router could pull every
+ * approved token from every user indefinitely. A lapsed allowance is re-granted by one more
+ * signature, riding inside the next write ({@link permit2SigCalls}).
+ */
+export const PERMIT2_EXPIRY_SECONDS = 30n * 24n * 3600n;
+/** An allowance that lapses within this window is treated as already lapsed: it could die in flight. */
+const EXPIRY_MARGIN_SECONDS = 3600;
+
+const nowSeconds = () => Math.floor(Date.now() / 1000);
+/** The expiry to grant now. */
+export const permit2Expiry = (): bigint => BigInt(nowSeconds()) + PERMIT2_EXPIRY_SECONDS;
+/** Whether a Permit2 allowance (amount, expiration) covers `need` for long enough to land. */
+export const permit2Covers = (amount: bigint, expiration: number, need: bigint): boolean =>
+  amount >= need && expiration > nowSeconds() + EXPIRY_MARGIN_SECONDS;
+
 const ERC20 = parseAbi([
   "function approve(address spender, uint256 amount) returns (bool)",
   "function allowance(address owner, address spender) view returns (uint256)",
@@ -71,7 +88,7 @@ export async function approvePermit2ForRouter(
   c: LogswapClient,
   token: Address,
   amount: bigint = MAX_UINT160,
-  expiration: bigint = MAX_UINT48,
+  expiration: bigint = permit2Expiry(),
 ): Promise<Hash | null> {
   if (!usesPermit2(c)) return null;
   const { account } = requireWallet(c);
@@ -109,13 +126,13 @@ export async function onboardToken(c: LogswapClient, token: Address, need: bigin
   }
 
   if (usesPermit2(c)) {
-    const [amt] = (await c.public.readContract({
+    const [amt, expiration] = (await c.public.readContract({
       address: c.addresses.permit2!,
       abi: PERMIT2,
       functionName: "allowance",
       args: [address, token, c.addresses.router],
     })) as readonly [bigint, number, number];
-    if (amt < need) {
+    if (!permit2Covers(amt, expiration, need)) {
       const h = await approvePermit2ForRouter(c, token);
       if (h) {
         await c.public.waitForTransactionReceipt({ hash: h });
@@ -150,13 +167,13 @@ export async function checkTokenReadiness(
 
   let needsPermit2Approval = false;
   if (usesPermit2(c)) {
-    const [amt] = (await c.public.readContract({
+    const [amt, expiration] = (await c.public.readContract({
       address: c.addresses.permit2!,
       abi: PERMIT2,
       functionName: "allowance",
       args: [owner, token, c.addresses.router],
     })) as readonly [bigint, number, number];
-    needsPermit2Approval = amt < need;
+    needsPermit2Approval = !permit2Covers(amt, expiration, need);
   }
 
   return { usesPermit2: usesPermit2(c), needsTokenApproval: allowance < need, needsPermit2Approval };
@@ -195,15 +212,15 @@ export async function permit2SigCalls(c: LogswapClient, tokens: Address[]): Prom
   const chainId = await c.public.getChainId();
   const calls: Hex[] = [];
   for (const token of [...new Set(tokens.map((t) => t.toLowerCase() as Address))]) {
-    const [amt, , nonce] = (await c.public.readContract({
+    const [amt, expiration, nonce] = (await c.public.readContract({
       address: c.addresses.permit2!,
       abi: PERMIT2,
       functionName: "allowance",
       args: [owner, token, c.addresses.router],
     })) as readonly [bigint, number, number];
-    if (amt >= 1n << 120n) continue; // effectively infinite already
+    if (permit2Covers(amt, expiration, 1n << 120n)) continue; // effectively unlimited, and not lapsing
     const message = {
-      details: { token, amount: MAX_UINT160, expiration: Number(MAX_UINT48), nonce },
+      details: { token, amount: MAX_UINT160, expiration: Number(permit2Expiry()), nonce },
       spender: c.addresses.router,
       sigDeadline: BigInt(Math.floor(Date.now() / 1000)) + 1800n,
     };

package/src/write.ts

@@ -13,7 +13,7 @@
  * what you have — but the bound is what ships.
  */
 
-import type { Address, Hash } from "viem";
+import type { Address, Hash, Hex } from "viem";
 import type { LogswapClient } from "./client.js";
 
 /** Disables the deadline check. Deliberate opt-out, never a default. */
@@ -114,6 +114,31 @@ export async function sendRouterWrite(
   return c.wallet!.writeContract({ ...(params as object), gas } as never);
 }
 
+/**
+ * Whether an error is the user saying no in their wallet (EIP-1193 code 4001, viem's
+ * `UserRejectedRequestError`), however deep viem nested it.
+ */
+export function isUserRejection(e: unknown): boolean {
+  const seen = new Set<unknown>();
+  for (let x: unknown = e; x && typeof x === "object" && !seen.has(x); x = (x as { cause?: unknown }).cause) {
+    seen.add(x);
+    const o = x as { name?: string; code?: number };
+    if (o.name === "UserRejectedRequestError" || o.code === 4001) return true;
+  }
+  return false;
+}
+
+/**
+ * The permit signatures are an optimisation: when they cannot be produced (a wallet without
+ * `signTypedData`, a read that failed) the write goes out plain and relies on a standing
+ * allowance. A REJECTED signature is not that — it was swallowed too, and the user who had just
+ * said no was shown a transaction prompt, which then reverted with a Permit2 error that hid why.
+ */
+export function fallBackUnlessRejected(e: unknown): Hex[] {
+  if (isUserRejection(e)) throw e;
+  return [];
+}
+
 /** Simulate a router write and return its decoded result, without sending. */
 export async function simulateRouterWrite<T>(
   c: LogswapClient,
@@ -142,7 +167,7 @@ export async function sendRouterWriteWithPermits(
   pullTokens: Address[],
 ): Promise<Hash> {
   const { permit2SigCalls } = await import("./onboard.js");
-  const sigCalls = await permit2SigCalls(c, pullTokens).catch(() => []);
+  const sigCalls = await permit2SigCalls(c, pullTokens).catch(fallBackUnlessRejected);
   if (sigCalls.length === 0) return sendRouterWrite(c, args);
   const { encodeFunctionData } = await import("viem");
   const inner = encodeFunctionData({ abi: args.abi, functionName: args.functionName, args: args.args } as never);