Remove overshoot trimming during swaps (#148)

* fix overshoot bridging

* reset allowance after swap

* revert bridging cap

* lint

* Apply suggestions from code review

Co-authored-by: Jordan Schalm <jordan.schalm@gmail.com>
Co-authored-by: Alex <12097569+nialexsan@users.noreply.github.com>

* fix test

---------

Co-authored-by: Jordan Schalm <jordan.schalm@gmail.com>

Author: nialexsan

cadence/contracts/connectors/evm/UniswapV3SwapConnectors.cdc

@@ -660,15 +660,15 @@ access(all) contract UniswapV3SwapConnectors {
             let pathBytes = self._buildPathBytes(reverse: reverse, exactOutput: false, numHops: nil)
 
             // Approve
-            var res = self._call(
+            let allowanceRes = self._call(
                 to: inToken,
                 signature: "approve(address,uint256)",
                 args: [self.routerAddress, evmAmountIn],
                 gasLimit: 120_000,
                 value: 0
             )!
-            if res.status != EVM.Status.successful {
-                UniswapV3SwapConnectors._callError("approve(address,uint256)", res, inToken, idType, id, self.getType())
+            if allowanceRes.status != EVM.Status.successful {
+                UniswapV3SwapConnectors._callError("approve(address,uint256)", allowanceRes, inToken, idType, id, self.getType())
             }
 
             // Min out on EVM units
@@ -677,8 +677,7 @@ access(all) contract UniswapV3SwapConnectors {
                 erc20Address: outToken
             )
 
-            let coaRef = self.borrowCOA()!
-            let recipient = coaRef.address()
+            let recipient = coa.address()
 
             // optional dev guards
             let _chkIn  = EVMAbiHelpers.abiUInt256(evmAmountIn)
@@ -712,8 +711,21 @@ access(all) contract UniswapV3SwapConnectors {
                     swapRes, self.routerAddress, idType, id, self.getType()
                 )
             }
+            // Reset allowance
+            let resetAllowanceRes = self._call(
+                to: inToken,
+                signature: "approve(address,uint256)",
+                args: [self.routerAddress, 0 as UInt256],
+                gasLimit: 60_000,
+                value: 0
+            )!
+
+            if resetAllowanceRes.status != EVM.Status.successful {
+                UniswapV3SwapConnectors._callError("approve(address,uint256)", resetAllowanceRes, inToken, idType, id, self.getType())
+            }
             let decoded = EVM.decodeABI(types: [Type<UInt256>()], data: swapRes.data)
-            let amountOut: UInt256 = decoded.length > 0 ? decoded[0] as! UInt256 : 0
+            assert(decoded.length == 1, message: "invalid swap return data")
+            let amountOut = decoded[0] as! UInt256
 
             let outVaultType = reverse ? self.inType() : self.outType()
             let outTokenEVMAddress =
@@ -733,28 +745,11 @@ access(all) contract UniswapV3SwapConnectors {
                 message: "UniswapV3SwapConnectors: swap output \(outUFix.toString()) < amountOutMin \(amountOutMin.toString())"
             )
 
-            /// Quoting exact output then swapping exact input can overshoot by up to 0.00000001 (1 UFix64 quantum)
-            /// when the pool's effective exchange rate is near 1:1.
-            ///
-            /// UFix64 has 8 decimals; EVM tokens typically have 18. One UFix64 step = 10^10 wei.
-            ///
-            /// Example (pool price 1 FLOW = 2 USDC, want 10 USDC out):
-            ///   1. Quoter says need 5,000000002000000000 FLOW wei
-            ///   2. Ceil to UFix64:  5,000000010000000000  (overshoot: 8e9 wei)
-            ///   3. exactInput swaps the ceiled amount; extra 8e9 FLOW wei × 2 = 16e9 USDC wei extra
-            ///   4. Actual output:  10,000000016000000000 USDC wei
-            ///   5. Floor to UFix64: 10.00000001 USDC  (quoted 10.00000000)
-            ///
-            /// The overshoot is always non-negative (ceiled input >= what pool needs).
-            /// It surfaces when the extra output crosses a 10^10 wei quantum boundary.
-            /// Cap at amountOutMin so only the expected amount is bridged; dust stays in the COA.
-            let bridgeUFix = outUFix > amountOutMin && amountOutMin > 0.0 ? amountOutMin : outUFix
-            let dust = outUFix > bridgeUFix ? outUFix - bridgeUFix : 0.0
             let safeAmountOut = FlowEVMBridgeUtils.convertCadenceAmountToERC20Amount(
-                bridgeUFix,
+                outUFix,
                 erc20Address: outTokenEVMAddress
             )
-            // Withdraw output back to Flow; sub-quantum remainder and any overshoot stay in COA
+            // Withdraw output back to Flow
             let outVault <- coa.withdrawTokens(type: outVaultType, amount: safeAmountOut, feeProvider: feeVaultRef)
 
             // Handle leftover fee vault
@@ -864,4 +859,4 @@ access(all) contract UniswapV3SwapConnectors {
             "Call to \(target.toString()).\(signature) from Swapper \(swapperType.identifier) with UniqueIdentifier \(uniqueIDType) ID \(id) failed:\n\tStatus value: \(res.status.rawValue.toString())\n\tError code: \(res.errorCode.toString())\n\tErrorMessage: \(res.errorMessage)\n"
         )
     }
-}
+}

cadence/tests/fork/UniswapV3SwapConnectors_coa_dust_test.cdc

@@ -49,13 +49,13 @@ access(all) fun setup() {
     Test.expect(err, Test.beNil())
     Test.commitBlock()
 
-    err = Test.deployContract(
-        name: "DeFiActions",
-        path: "../../contracts/interfaces/DeFiActions.cdc",
-        arguments: []
-    )
-    Test.expect(err, Test.beNil())
-    Test.commitBlock()
+    // err = Test.deployContract(
+    //     name: "DeFiActions",
+    //     path: "../../contracts/interfaces/DeFiActions.cdc",
+    //     arguments: []
+    // )
+    // Test.expect(err, Test.beNil())
+    // Test.commitBlock()
 
     err = Test.deployContract(
         name: "SwapConnectors",
@@ -371,14 +371,27 @@ access(all) fun runSwapTests(
 
 /// Asserts swap dust/overshoot properties for each result row.
 ///
-/// Verifies:
-///   - vaultBalance == quoteOutAmount (caller gets exactly what was quoted)
-///   - coaDustAfter >= coaDustBefore (overshoot/dust accumulates in COA)
+/// The swap transaction uses amountOutMin = desiredOut (NOT quoteIn.outAmount).
+/// This guarantees outUFix ≈ quoteIn.outAmount > desiredOut = amountOutMin for
+/// any amount where the quoter overshoots, forcing the trimming guard to fire.
+///
+/// With the NEW guard (whole-quantum overshoot passes through):
+///   vaultBalance ≈ quoteOutAmount  (whole-quantum overshoot passed to caller)
+///   COA accumulates only sub-quantum EVM wei (< 1 quantum = 0.00000001)
+///
+/// With the OLD guard (cap at amountOutMin = desiredOut):
+///   vaultBalance = desiredOut < quoteOutAmount  → assertion FAILS
+///   COA accumulates the entire quote overshoot (up to 87 quanta)
+///
+/// Example: EVM overshoot = 0.0000001234, desiredOut = amountOutMin
+///   Whole quanta passed through to caller: 0.00000012  (12 × 0.00000001)
+///   Sub-quantum remainder stays in COA:    0.0000000034
 ///
 access(all) fun assertSwapDust(results: [[UFix64]]) {
     var testedCount = 0
     var skippedCount = 0
-    var totalOvershoot = 0.0
+    var totalQuoteOvershoot = 0.0
+    var totalVaultOvershoot = 0.0
     var totalDustInCOA = 0.0
 
     for row in results {
@@ -400,10 +413,16 @@ access(all) fun assertSwapDust(results: [[UFix64]]) {
 
         testedCount = testedCount + 1
 
-        let overshoot = quoteOutAmount >= desiredOut
+        let quoteOvershoot = quoteOutAmount >= desiredOut
             ? quoteOutAmount - desiredOut
             : 0.0
-        totalOvershoot = totalOvershoot + overshoot
+        totalQuoteOvershoot = totalQuoteOvershoot + quoteOvershoot
+
+        // Whole-quantum overshoot received by caller (sub-quantum remainder stays in COA)
+        let vaultOvershoot = vaultBalance > quoteOutAmount
+            ? vaultBalance - quoteOutAmount
+            : 0.0
+        totalVaultOvershoot = totalVaultOvershoot + vaultOvershoot
 
         let dustInCOA = coaDustAfter >= coaDustBefore
             ? coaDustAfter - coaDustBefore
@@ -412,18 +431,23 @@ access(all) fun assertSwapDust(results: [[UFix64]]) {
 
         log("---")
         log("[SWAP] Desired: \(desiredOut.toString()), Quote: \(quoteOutAmount.toString()), Returned: \(vaultBalance.toString())")
-        log("  Overshoot/Dust => quote vs desired: +\(overshoot.toString()), stayed in COA: +\(dustInCOA.toString())")
-        log("  COA balance => \(coaDustBefore.toString()) → \(coaDustAfter.toString())")
+        log("  Quote overshoot vs desired: +\(quoteOvershoot.toString()), whole-quantum overshoot to caller: +\(vaultOvershoot.toString())")
+        log("  COA balance => \(coaDustBefore.toString()) → \(coaDustAfter.toString()) (sub-quantum dust: +\(dustInCOA.toString()))")
 
-        Test.assertEqual(quoteOutAmount, vaultBalance)
+        // Caller must receive at least the quoted amount; whole-quantum overshoot passes through.
+        Test.assert(
+            vaultBalance >= quoteOutAmount,
+            message: "Vault balance \(vaultBalance.toString()) < quoteOutAmount \(quoteOutAmount.toString())"
+        )
 
         Test.assert(coaDustAfter >= coaDustBefore,
-            message: "COA output-token balance decreased — overshoot/dust should accumulate in COA")
+            message: "COA output-token balance decreased — sub-quantum remainder should accumulate in COA")
     }
 
     Test.assert(testedCount > 0, message: "No test amounts could be swapped")
     log("=== PASSED: \(testedCount.toString()) swaps, \(skippedCount.toString()) skipped ===")
-    log("=== Total overshoot/dust that stayed in COA: \(totalDustInCOA.toString()) ===")
+    log("=== Total whole-quantum overshoot passed to callers: \(totalVaultOvershoot.toString()) ===")
+    log("=== Total sub-quantum dust accumulated in COA: \(totalDustInCOA.toString()) ===")
 }
 
 // --- Swap tests ---------------------------------------------------------------
@@ -457,14 +481,20 @@ access(all) fun testSwapDustStaysInCOA() {
 
 /// Demonstrates the trimming guard in action on PYUSD → MOET swaps.
 ///
-/// MOET is an 18-decimal ERC20, so `toCadenceOut` floors actual output to the
-/// nearest 10^10 wei (1 UFix64 quantum).  When the router produces even slightly
-/// more output than the quoter predicted — because ceiled input crosses a
-/// quantum boundary — the trimming guard caps the bridged amount at
-/// `amountOutMin` and the excess stays in the COA.
+/// MOET is an 18-decimal ERC20, so `toCadenceOut` floors the actual EVM output
+/// to the nearest 10^10 wei (1 UFix64 quantum = 0.00000001).  When the router
+/// produces more output than the quoter predicted — because ceiled input crosses
+/// a quantum boundary — the overshoot is handled as follows:
+///
+///   Whole-quantum portion (N × 0.00000001): passed through to caller
+///   Sub-quantum EVM remainder (< 0.00000001): stays in COA
+///
+/// Example: EVM overshoot = 0.0000001234
+///   Caller receives quoteOutAmount + 0.00000012  (12 whole quanta)
+///   COA retains                    0.0000000034  (sub-quantum remainder)
 ///
 /// Many fractional amounts are tested to maximise the chance of hitting
-/// quantum-boundary crossings that produce observable dust.
+/// quantum-boundary crossings that produce observable overshoot.
 ///
 access(all) fun testSwapOvershootStaysInCOA() {
     let signer = Test.getAccount(0x47f544294e3b7656)
@@ -475,22 +505,22 @@ access(all) fun testSwapOvershootStaysInCOA() {
 
     let testAmounts = [
         0.00987654,
-        0.01000000,
+        0.01000000,   // +69 quanta quote overshoot (highest observed in quote test)
         0.03456789,
         0.05432109,
         0.10000000,
-        0.12345678,   // dust hit in first run
+        0.12345678,   // +44 quanta quote overshoot — confirmed COA dust accumulation
         0.20000000,
-        0.23456789,   // dust hit
+        0.23456789,   // +8 quanta quote overshoot — confirmed COA dust accumulation
         0.34567890,
         0.45019707,
         0.56789012,
         0.67890123,
-        0.78901234,   // dust hit
-        1.00000000,   // dust hit (even with 0 quote overshoot)
+        0.78901234,   // confirmed COA dust accumulation
+        1.00000000,   // confirmed COA dust accumulation (swap-level overshoot, 0 quote overshoot)
         1.23456789,
         1.50000000,
-        2.34567890,   // dust hit
+        2.34567890,   // confirmed COA dust accumulation
         3.45678901,
         5.00000000
     ]
@@ -504,5 +534,29 @@ access(all) fun testSwapOvershootStaysInCOA() {
     )
 
     assertSwapDust(results: results)
+
+    // Spot-check: 0.01000000 (+69 quanta quote overshoot) and 0.12345678 (+44 quanta)
+    // are confirmed cases where the quoter overshoots the desired output.
+    // Because the swap uses amountOutMin = desiredOut, the trimming guard fires and
+    // the full quote overshoot (in whole quanta) must reach the caller's vault.
+    // With the OLD guard (cap at amountOutMin = desiredOut):
+    //   vaultBalance = desiredOut < quoteOutAmount  → FAILS
+    // With the NEW guard (whole-quantum overshoot passes through):
+    //   vaultBalance ≈ quoteOutAmount, coaDelta < 1 quantum  → PASSES
+    for row in results {
+        let desiredOut     = row[0]
+        let quoteOutAmount = row[2]
+        let vaultBalance   = row[3]
+        let coaDustBefore  = row[4]
+        let coaDustAfter   = row[5]
+        // With the new guard, whole-quantum overshoot reaches the caller.
+        // vaultBalance must be at least quoteOutAmount (= desiredOut + quote_overshoot).
+        Test.assert(vaultBalance >= quoteOutAmount,
+            message: "[\(desiredOut.toString())] vaultBalance \(vaultBalance.toString()) < quoteOutAmount \(quoteOutAmount.toString()) — old cap-at-minimum guard still in effect")
+        // Sub-quantum EVM remainder must be the only thing left in COA.
+        let coaDelta = coaDustAfter > coaDustBefore ? coaDustAfter - coaDustBefore : 0.0
+        Test.assert(coaDelta <= 0.00000001,
+            message: "[\(desiredOut.toString())] COA accumulated \(coaDelta.toString()) MOET — whole-quantum overshoot should have been passed to caller, not left in COA")
+    }
 }
 

cadence/tests/transactions/uniswap-v3-swap-connectors/uniswap_v3_swap_overshoot_test.cdc

@@ -7,12 +7,18 @@ import "FlowEVMBridgeConfig"
 import "UniswapV3SwapConnectors"
 import "DeFiActions"
 import "EVMAmountUtils"
+import "SwapConnectors"
 
 /// Tests actual V3 swap execution with tokenIn provisioning from holder.
 ///
 /// Since forked emulator doesn't verify signatures, we can transfer tokens
 /// from any address (like a liquidity pool) to provision tokens for testing.
 ///
+/// The swap is executed with amountOutMin = desiredOut (NOT quoteIn.outAmount),
+/// by constructing a SwapConnectors.BasicQuote with outAmount = desiredOut.
+/// This guarantees outUFix ≈ quoteIn.outAmount > desiredOut = amountOutMin,
+/// so the trimming guard is always exercised on amounts where quote overshoot > 0.
+///
 /// Result: [desiredOut, quoteInAmount, quoteOutAmount, vaultBalance, coaDustBefore, coaDustAfter]
 ///
 transaction(
@@ -111,6 +117,18 @@ transaction(
         // --- Run single swap test ---
         let quoteIn = swapper.quoteIn(forDesired: desiredOut, reverse: false)
 
+        // Build a lower-bound quote: same inAmount as the real quote, but outAmount = desiredOut.
+        // This sets amountOutMin = desiredOut inside _swapExactIn, guaranteeing
+        // outUFix ≈ quoteIn.outAmount > desiredOut = amountOutMin on amounts where
+        // the quoter overshoots (quote overshoot > 0).  The trimming guard is
+        // therefore always exercised for such amounts.
+        let lowerBoundQuote = SwapConnectors.BasicQuote(
+            inType:    quoteIn.inType,
+            outType:   quoteIn.outType,
+            inAmount:  quoteIn.inAmount,
+            outAmount: desiredOut
+        )
+
         // COA output-token ERC20 balance before swap
         let outBefore = FlowEVMBridgeUtils.balanceOf(
             owner: coaAddr, evmContractAddress: tokenOut
@@ -128,9 +146,9 @@ transaction(
         var outAfterCadence = outBeforeCadence
 
         if canSwap {
-            // Withdraw exact quoteIn.inAmount and swap
+            // Withdraw exact quoteIn.inAmount and swap using the lower-bound quote.
             let inVault <- tokenInRef.withdraw(amount: quoteIn.inAmount)
-            let outVault <- swapper.swap(quote: quoteIn, inVault: <-inVault)
+            let outVault <- swapper.swap(quote: lowerBoundQuote, inVault: <-inVault)
             vaultBalance = outVault.balance
 
             // COA output-token ERC20 balance after swap