Differential Privacy in Constant Function Market Makers

Abstract

Constant function market makers (CFMMs) are the most popular mechanism for facilitating decentralized trading. While these mechanisms have facilitated hundreds of billions of dollars of trades, they provide users with little to no privacy. Recent work illustrates that privacy cannot be achieved in CFMMs without forcing worse pricing and/or latency on end users. This paper quantifies the trade-off between pricing and privacy in CFMMs. We analyze a simple privacy-enhancing mechanism called Uniform Random Execution and prove that it provides $(\epsilon , \delta )$-differential privacy. The privacy parameter $\epsilon$ depends on the curvature of the CFMM trading function and the number of trades executed. This mechanism can be implemented in any blockchain system that allows smart contracts to access a verifiable random function. Our results provide an optimistic outlook on providing partial privacy in CFMMs.

Appendices

A Differential Privacy Results

We implicitly use a number of differential privacy results on composition and provide them here for convenience. First we note the serial composition theorem:

Theorem 2

(Composition Theorem 3.16 [DR+14]). Let $\mathcal {A}_1, \ldots \mathcal {A}_n$ be a sequence of $(\epsilon _i, \delta _i)$ algorithms such that $\mathop {\textbf{Range}}\mathcal {A}_i \subseteq \mathop {\textbf{Dom}}\mathcal {A}_{i+1}$. Then the composition $\mathcal {A}_n \circ \cdots \circ \mathcal {A}_1$ is $(\sum _{i=1}^n \epsilon _i, \sum _{i=1}^n \delta _i)$-differentially private

Secondly, we note the parallel composition theorem

Theorem 3

Let $\mathcal {A}_1, \ldots , \mathcal {A}_n$ be algorithms whose domains (databases) are independent and each algorithm is $(\epsilon _i, \delta _i)$-differentially private. Then $(\mathcal {A}_1, \ldots , \mathcal {A}_n)$ is $\max _i \epsilon _i$ differentially private

Finally, we note that the serial composition rule can be improved from $(\sum _i \epsilon _i, \sum _i \delta _i)$ to $(n\epsilon ^2 + \epsilon \sqrt{n\log (1/\tilde{\delta })}, n\delta +\tilde{\delta })$ where $\tilde{\delta } = O(n\delta )$ if $\epsilon _i = \epsilon , \delta _i = \delta$ for all i [KOV15]. We will not need to use this result, only the generic composition rules. However, it is possible that one can improve our constants using results such as this.

B Price Tree Height Is Close to Trade Tree Height

Suppose that we have an admissible trade vector $\mathbf {\Delta } = (\varDelta _1, \ldots , \varDelta _n) \in \mathcal {A}_{\varphi }$. Given $\pi \in S_n$, we can write a sequence of prices in terms of the price impact function:

$$ p_j(\pi ) = g\left( \sum _{i=1}^j \varDelta _{\pi (i)}\right) $$

We generate a random binary tree from the price vector by uniformly sampling $j \sim [n]$ and making $p_j(\pi )$ the root before inserting the remaining prices sequentially as per $\pi$. Under this framework, we have

$$\begin{aligned} \mathop {\mathbf {E{}}}_{\pi \sim S_n}\left[ \max _j p_j(\pi )\right]&\le \mathop {\mathbf {E{}}}_{j \sim [n]}[p_j(\pi )] + \max _i|p_i(\pi )-p_{i-1}(\pi )|\mathop {\mathbf {E{}}}_{\pi \sim S_n}[\textsf{height}(T(p_j(\pi )))] \\&\le \mathop {\mathbf {E{}}}_{j \sim [n]}[p_j(\pi )] + \mu (\max _{i} \varDelta _i) \mathop {\mathbf {E{}}}_{\pi \sim S_n}[\textsf{height}(T(p_j(\pi )))] \end{aligned}$$

We can later remove this constraint by adding a small amount of noise to each entry, which will make the entries unique a.s. Note that the height of the tree generated by $P_j$ represents the number of trades in the longest sequential deviation from the mean price. Let’s consider when the trade tree and price tree differ in branching. On average, this occurs when the jth price $p_{\pi (j)}$ is a left branch whereas the $j+1$st price $p_{\pi (j+1)}$ is a right branch, but both trades $\varDelta _{\pi (j)}, \varDelta _{\pi (j+1)}$ are left branches. When this happens, the price tree has an average height that is 1 less than the trade tree.

We will first illustrate this when the first two elements of the permutation after the pivot (which is random) differ from the expected pivot value. Explicitly, suppose that we have

$$\begin{aligned} p_{\pi (2)} - \frac{1}{n} \sum _{i=1}^n p_{\pi (i)} < 0&\quad&p_{\pi (3)} - \frac{1}{n} \sum _{i=1}^n p_{\pi (i)} > 0 \end{aligned}$$

Using curvature bounds, the first equation gives

$$ 0 \ge p_{\pi (2)} - \frac{1}{n} \sum _{i=1}^n p_{\pi (i)} \ge \kappa \varDelta _{\pi (2)} - \frac{\mu }{n} \sum _{i=1}^n \varDelta _i $$

Similarly, the second equation gives

$$ 0 \le p_{\pi (3)} - \frac{1}{n} \sum _{i=1}^n p_{\pi (i)} \le \mu \varDelta _{\pi (3)} - \frac{\kappa }{n} \sum _{i=1}^n \varDelta _i $$

which when combined gives

$$\begin{aligned} \varDelta _{\pi (2)}&\le \frac{\mu }{\kappa } \left( \frac{1}{n} \sum _{i=1}^n \varDelta _i \right) = \eta _+ \end{aligned}$$

(9)

$$\begin{aligned} \varDelta _{\pi (3)}&\ge \frac{\kappa }{\mu } \left( \frac{1}{n} \sum _{i=1}^n \varDelta _i \right) = \eta _- \end{aligned}$$

(10)

Let $\rho _i$ be as in (2) and let $\overline{\varDelta } = \frac{1}{n} \sum _{i=1}^n \varDelta _i$. On the other hand, suppose that $\rho _2(\pi )-\overline{\varDelta }(\pi ), \rho _{3}(\pi )-\overline{\varDelta }(\pi )$ are both greater than zero (e.g., they are both left nodes of their parent). This implies that $\varDelta _{\pi (2))} + \varDelta _{\pi (3)} \ge \frac{1}{n}\sum _{i=1}^n \varDelta _i$. This means that we can only end up in a state where $\textsf{height}(T(\rho _j(\pi ))) > \textsf{height}(T(p_j(\pi )))$ if the trades are within the interval $[\eta _-, \eta _+]$. For instance, when the drift $\frac{1}{n}\sum _{i=1}^n \varDelta _i = 0$, then interval has size zero (its a mean-reverting set of trades) and we never enter this error condition. This matches intuition: if there’s a lot of drift in the trades, then we shouldn’t expect our price and trade vectors to ‘sort’ the same way. In particular, the higher the curvature of the CFMM, the less drift we can tolerate because large trades cause more noticeable price impact. The length of the interval $[\eta _-, \eta _+]$ is

$$ \left( \frac{\mu }{\kappa } - \frac{\kappa }{\mu }\right) \left( \frac{1}{n} \sum _{i=1}^n \varDelta _i \right) $$

Note that we can recurse the above argument as we go down the tree and get a set of intervals $I_1 = [\eta _-(1), \eta _+(1)], I_2 = [\eta _-(2), \eta _+(2)], \ldots , I_n = [\eta _-(n), \eta _+(n)]$. Performing the same calculation as above yields

$$\begin{aligned} \eta _-(i) = \frac{\kappa }{\mu } \left( \frac{1}{n-i}\sum _{i=i}^{n} \varDelta _{\pi (i)}\right)&\qquad \quad \eta _+(i) = \frac{\mu }{\kappa } \left( \frac{1}{n-i}\sum _{i=i}^n \varDelta _{\pi (i)}\right) \end{aligned}$$

Given that the maximum interval size is $\mu M$ is the max trade size for which curvature is valid), we can use this to bound the probability $p_j$ that vertex j has a height difference between the trade and price trees. This probability is upper bounded by ratio of the length of $I_j$ and the interval length $\mu M$, e.g., $p_j \le \frac{|I_j|}{\mu M}$. We can upper bound the interval length by the maximum mean-drift subsequence:

$$ |I_j| \le \left( \frac{\mu }{\kappa } - \frac{\kappa }{\mu }\right) \left( \max _{J \subset [n]} \frac{1}{|J|} \sum _{j\in J} \varDelta _j\right) $$

Define $R^*(\mathbf {\Delta }) = \max _{J \subset [n]} \frac{1}{|J|} \sum _{j\in J} \varDelta _j$. Finally, performing a union bound gives an upper bound on the probability $p_{\text {diff}}$ of the heights of the trade tree and price tree different

$$\begin{aligned} p_{\text {diff}} \le \sum _{j=1}^n p_j = n \left( \frac{1}{M\kappa } - \frac{\kappa }{\mu ^2 M}\right) R^*(\mathbf {\Delta }) \end{aligned}$$

(11)

If this quantity is sufficiently small (e.g., we have tight curvature bounds), then bounds on the trade tree transfer to the price tree with high probability. For the rest of the paper, we will assume that (11) is sufficiently small. We note that fee adjustments and curvature adjustments are intricately related [AEC20, §3] and in practice, this can be enforced by dynamic updates to a CFMM curve.

C Proof of Claim 1

Suppose that $\xi _i \sim _{iid} \textsf{Lap}(a,b)$. We need to analyze the distribution of $\xi _i - \frac{\mu }{\kappa } \xi _j$. Recall that if $X \sim \textsf{Lap}(a,b)$ then $kX \sim \textsf{Lap}(ka, |k|b)$. Therefore we are trying to bound the distribution of $Z(a,b) = X + Y$ where $X \sim \textsf{Lap}(a, b)$, $Y \sim \textsf{Lap}\left( -\frac{\mu }{\kappa }a, \frac{\mu }{\kappa }b\right)$. In particular, given $\delta < 0$ we want to choose a, b such that

$$ F_{Z}(k) \le \mathop {\textbf{Prob}}[X+Y \le k] \le \delta $$

where $k = c_{\min } + \left| \min _{i,j}\varDelta _i - \frac{\kappa }{\mu } \varDelta _j\right|$. Nadarajah [Nad07, Theorem 1] explicitly computes the CDF $F_{Z(a,b)}(k)$ and shows that it is monotone, continuous, and differentiable in a, b except at one value of k for all a, b. Moreover, it is supported on the entire real line. Therefore, $\exists a^*$ such that $F_{Z(a^*, |a^*|)}(k) = \delta$.

D Proof of Claim 2

Our proof works by differentially privately sampling a probability distribution $\pi \sim \textsf{Dir}(\textbf{1})$ multiple times using the mechanism of [GWH+21]. The Dirichlet mechanism on k nodes $\mathcal {M}^{(k)}_D(\pi )$ samples a Dirichlet distribution centered at $\pi$, where $\pi \in P_k = \{x \in \textbf{R}^k : \sum _i x_i = 1, x_i \ge 0\}$. One can think of it as sampling a increment $d\pi$, adding it to $\pi$ and renormalizing. First, we reproduce a theorem on differentially private Dirichlet sampling.

Theorem 4

([GWH+21], Theorem 1, Corollary 1). The Dirichlet mechanism $\mathcal {M}^{(k)}_D(\pi )$ achieves $(\epsilon , \delta )$-differential privacy where $\epsilon = O(k(1+\log (o(k)))$ and $\delta = 1 - \min _{\pi } \mathop {\textbf{Prob}}[\mathcal {M}^k_D(\pi ) - \pi > \varOmega (\epsilon )]$

Define the vector $\eta (\mathbf {\Delta })$ as follows:

$$ \eta (\mathbf {\Delta }) = \left( \left\lceil \frac{\varDelta _1}{\varDelta _{\min }} \right\rceil , \ldots , \left\lceil \frac{\varDelta _n}{\varDelta _{\min }} \right\rceil \right) $$

Each coordinate represents rounding each trade to an integer lattice with width $\varDelta _{\min }$. Define $S_k = \{i : \eta (\mathbf {\Delta }) > k\}$ and $S^c_k = [n] - S_k$. For each $j \in S_k$, privately sample $\pi \sim \textsf{Dir}(\textbf{1})$ where $\textbf{1} = (1, \ldots , 1) \in \textbf{R}^{\eta (\mathbf {\Delta })_j}$. Let $\hat{\varDelta }_{j,k} = \varDelta _j \pi _k$ with $\sum _k \hat{\varDelta }_{j,k} = \varDelta _j$. We can view each Dirichlet sample $\pi$ as providing a mechanism for splitting the trade $\varDelta _j$. Our goal is to find $k \in \textbf{N}$ such that the following two conditions hold

• 1. $\textsf{height}(T(\varDelta _{S^c_k})) = \varTheta (\log n)$

• 2. $\textsf{height}(T(\hat{\varDelta }_{j,k})) = \varTheta (\log \eta _j)$ with high probability

We can show that the latter condition holds with high probability when the distribution sampled is Dirichlet centered at the centroid $(\frac{1}{n}, \ldots , \frac{1}{n})$. Constructing a partial sum tree from a Dirichlet sample is the same as drawing a sample from a Poisson-Dirichlet branching random walk [ABF13]. These walks satisfy $\mathop {\textbf{Prob}}[ |\textsf{height}(T(\hat{\varDelta }_{j,k})) - c \log \eta (\mathbf {\Delta })_j | \ge k] = O(e^{-k})$ for a universal constant c [ABF13, Corollary 1.3]. Therefore, the probability that all of the Dirichlet constructed trees $T(\hat{\varDelta }_{j,k})$ have height greater than $c \log \eta (\mathbf {\Delta })_j$ is

$$ \mathop {\textbf{Prob}}\left[ \exists j \in S_k |\textsf{height}(T(\hat{\varDelta }_{j,k})) - c \log \eta _j| \ge c'\log \eta _j \right] \le \left( \frac{|S_k|}{\eta _j^{c'}}\right) $$

which directly follows from the independent sampling from the private Dirichlet distribution and inclusion-exclusion. Therefore, with probability $p^* = 1 - \frac{|S_k|}{\delta _j^{c'}}$, we have the maximum height of a tree constructed from all $|S_k|$ vectors $\hat{\varDelta }_{j,k}$ is

$$ \sum _{j \in S_k} \log \eta _j \le |S_k| \max _j \log \eta _j $$

which under our assumptions is $O(\log n)$. Our claim about differential privacy then follows immediately from Theorem 4.

E Proof of Claim 3

We will prove differential privacy by using the smooth sensitivity framework of [NRS07]. First, we will recall definitions and introduce preliminaries on this framework before specializing it to SURE. Smooth sensitivity places an upper bound on the local sensitivity of a function f, which is defined as

$$ LS_f(x) = \max _{d(x, y) \le 1} |f(x) - f(y)| $$

Note that unlike the global sensitivity, which is used in the generic Laplace mechanism [DR+14], the local sensitivity depends on the particular input x. Often times, it is too difficult to get uniform bounds on local sensitivity and instead it is easier to use a smooth proxy. A $\beta$-smooth upper bound $S : \mathop {\textbf{Dom}}f \rightarrow \textbf{R}$ for $LS_f(x)$ satisfies $S(x) \ge LS_f(x)$ for all $x \in \mathop {\textbf{Dom}}f$ and $S(x) \le e^{\beta } S(y)$ for all $x, y \in \mathop {\textbf{Dom}}f$ with $d(x, y) = 1$. We are now in a position to recall two results of Nissim, et al.:

Theorem 5

([NRS07], Lemma 2.6). Let h be an $(\alpha , \beta )$-admissible noise probability density function and let $Z \sim h$. For a function $f : D^n \rightarrow \textbf{R}^d$, let S be a $\beta$-smooth upper bound in the local sensitivity of f, then $\mathcal {A}(x) = f(x) + \frac{S(x)}{\alpha } Z$ is $(\epsilon , \delta )$-differentially private.

Theorem 6

([NRS07], Lemma 2.9). For $\epsilon , \delta \in (0, 1)$, the d-dimensional Laplace distribution, $h(z) = 2^{-d} e^{-\Vert z \Vert _1}$ is $(\alpha , \beta )$-admissible with $\alpha = \frac{\epsilon }{2}$, $\beta = \frac{\epsilon }{2\rho _{\delta /2}(\Vert Z\Vert _1)}$ where $\rho _{\delta }(Y)$ is the $1-\delta$ quantile of Y.

Combined, these results illustrate that if we can construct a $\beta$-smooth upper bound, we can immediately construct a Laplace mechanism that achieves $(\epsilon , \delta )$-differential privacy. Section 3 of [NRS07] provides a mechanism for computing a $\beta$-smooth upper bound by first defining the sensitivity at distance k,

$$ LS^k_f(x) = \max _{\begin{array}{c} y \in \mathop {\textbf{Dom}}f\\ d(x,y) \le k \end{array}} LS_f(x) $$

A $\beta$-smooth upper bound on local sensitivity is defined as,

$$ S_{f,\beta }(x) = \max _{k \in \{0, 1, \ldots , n\}} e^{-k\beta }LS^k_f(x) $$

Therefore, we need to construct a function f that represents price impact and compute an analogue of local sensitivity.

For a differentially private CFMM, we want to minimize the worst case price impact in a neighborhood of a trade $\mathbf {\Delta }$. We define $f(\mathbf {\Delta })$ as

$$ f(\mathbf {\Delta }) = \max _{j \in [n]} p_j(\varDelta ) $$

Now we need to modify the definition of local sensitivity to account for trade admissibility and discretization. Normally, local sensitivity is defined for discrete spaces where the distance d is taken to be the Hamming metric. We can discretize our trade space in terms of $\varDelta _{\min }$. Recall that we ensure that $\varDelta _{\min } > 0$ by adding Laplace noise to all trades (whose parameter will be tuned in accordance with the above theorem). Note that moving to such a discretization simply changes our choice of $\beta$. Using this definition, we can define the local trade sensitivity as

$$ TS^k_f(\mathbf {\Delta }) = \sup _{\begin{array}{c} \mathbf {\Delta }' \in \mathop {\textbf{Dom}}f \cap \mathcal {A}(R) \\ d(\mathbf {\Delta }, \mathbf {\Delta }') \le k \varDelta _{\min } \end{array}} |f(\mathbf {\Delta }) - f(\mathbf {\Delta }')| $$

where $\mathcal {A}(R)$ is the set of admissible trades. From the results of Sect. 3.2, we know that $TS^k_f(\mathbf {\Delta }) = O(k \mu (\max _i \mathbf {\Delta }) \log n)$ since the depth of the tree quantifies the largest price impact. In particular, each element $\varDelta '_i$ such that $|\varDelta _i - \varDelta '_i| > \varDelta _{\min }$ can cause price impact of at most $\mu (\max _i \mathbf {\Delta }) \log n$ and we can add these independently over the at most k coordinates that have prices changed by more than $\varDelta _{\min }$. We can define an analogous smooth sensitivity bound,

$$ \tilde{S}_{f, \beta } (x) = \max _{\ell } e^{-\ell \beta } TS^{\ell }_f(\mathbf {\Delta }) = \max _{\ell } e^{-\ell \beta } \ell \mu (\max _i \varDelta ) \log n $$

This is minimized when $\ell = \frac{1}{\beta }$, giving

$$ \tilde{S}_{f, \beta }(x) = \frac{\mu }{e\beta } (\max _i \varDelta ) \log n $$

Therefore, provided that a) the partial sum tree has height $O(\log n)$ b) the noise added ensures that $\varDelta _{\min } > 0$, and c) the noise is rescaled by $\frac{2\tilde{S}_{f, \beta }(x)}{\epsilon }$, we achieve differential privacy.

Note that in particular, our bound depends on $\max _i \varDelta$ and the curvature upper bound. By splitting trades using Claim 2, we reduce $\max _i \varDelta$ and can ensure that the noise added is reasonable. Moreover, as we saw, without splitting trades, we run into issues with trades of the form $(T, 1, \ldots , 1)$. Note that algorithms that try to learn where the trade T occurs (after applying a permutation $\pi$) is equivalent to privately learning threshold functions [BNSV15, ALMM19].

F Convex Trade Splitting

When we are considering CFMM arbitrage, it can be shown that a necessary condition for stability is path-deficiency. Path deficiency ensures that no rational trader (e.g., profit optimizing) is incentivized to split a desired trade size $\varDelta$ into two trades $\varDelta _1 + \varDelta _2 = \varDelta$. However, if a trader also desires privacy, splitting up trades can become necessary. To see why, consider a trader who makes a trade of size T and a sequence of trades $\varDelta = (T, 1, \ldots , 1) \in \textbf{R}^{T+1}$. Using curvature, we know that the price impact is at least $\kappa T$ after a trade of size T and of size $\kappa$ after each trade of size 1. This means that an adversary can easily discern where my trade is, even if $\varDelta$ is randomly permuted due to the T times larger price impact. Therefore, splitting up the trade of size T into trades close to size 1 will make it hard for an adversary to reconstruct the total trade size.

Our goal is to split up trades such that the probability of an adversary detecting the position of a single trade is small relative to the curvature. Suppose that a trade $\varDelta _1$ is split into trades $\varDelta '_1, \ldots , \varDelta '_j$ and let $\mathbf {\tilde{\Delta }} = (\varDelta '_1, \ldots , \varDelta '_j, \varDelta _2, \ldots , \varDelta _n)$ A splitting adversary is a binary classifier $\ell (\varDelta , \mathbf {\Delta })$ that returns 1 if $\varDelta \in \{\varDelta '_1, \ldots , \varDelta '_j\}$ and 0 otherwise. We say that a splitting mechanism is $(\delta , \epsilon )$ indistinguishable if

$$ \mathop {\textbf{Prob}}\left[ \left| \frac{1}{n}\sum _{i=1}^{n} \ell (\tilde{\varDelta }_i, \mathbf {\tilde{\Delta }}^{\pi }) - \frac{j}{n}\right|< \epsilon \right] < \delta $$

over some suitable set of splitting classifiers. The inequalities in Appendix G can directly be used to prove that this holds for the $L^2$ norm.

However, path-deficiency implies that splitting trades will cost a user an extra fee. This trade-off between best execution price and privacy can be explored via a simple, convex objective function that trades off price impact vs. improved privacy via splitting. Recall that the $L^2$ norm strictly decreases under splitting, e.g.,

$$\begin{aligned} \Vert (\varDelta _1, \ldots , \varDelta _n) \Vert _2^2&= \sum _{i=1}^n \varDelta _i^2 = \varDelta _1^2 + \sum _{i=2}^n \varDelta _i^2 \\&= a\varDelta _1^2 + (1-a) \varDelta _1^2 \sum _{i=2}^n \varDelta _i^2 > a^2\varDelta _1^2 + (1-a)^2 \varDelta _1 + \sum _{i=2}^n \varDelta _i^2 \\&= \Vert (a\varDelta _1, (1-a) \varDelta _1, \ldots , \varDelta _n) \Vert _2^2 \end{aligned}$$

where $a \in (0,1)$ represents the splitting fraction.

This property allows us to quantify the privacy benefit to splitting trades, as the more minimal the $L^2$ norm, the less noise that is needed to ensure that the random binary tree has height $\varTheta (\log n)$ and $\varOmega (n)$ leaves. In particular, the Cauchy and Gaussian mechanisms for differential privacy utilize distributions whose variances are proportional to the $L^2$ norm.

Given that we want to minimize price impact while maximizing the amount of trade splitting necessary for indistinguishable, we construct a convex optimization problem. Define the function f as:

$$ f(\varDelta _1, \ldots , \varDelta _n) = \sum _{i=1}^n \gamma g\left( \gamma \sum _{j=1}^i \varDelta _i\right) + \eta \sum _{i=1}^n \varDelta _i^2 $$

The first term in f represents an upper bound on the price impact and the second term represents the $L^2$ splitting term. Our goal is to minimize f over sequences of trades $(\varDelta _1, \ldots , \varDelta _k) \in \sqcup _{i=1}^{\infty } \textbf{R}^i$ such that $\sum _{i=1}^k \varDelta _i = \varDelta ^*$, e.g.,

$$\begin{aligned} \begin{array}{ll} \text {minimize} &{}\;\; f(\varDelta _1, \ldots , \varDelta _n) \\ \text {subject to} &{}\;\; \varDelta _1 + \cdots + \varDelta _n = \varDelta ^* \end{array} \end{aligned}$$

(12)

Using curvature bounds, we can construct a simple descent algorithm to solve this. Firstly, note that the definition of curvature yields

$$ \kappa \gamma ^2 \sum _{i=1}^n \sum _{j=1}^i \varDelta _i \le f(\varDelta _1, \ldots , \varDelta _n) - \eta \sum _{i=1}^n \varDelta _i^2 \le \mu \gamma ^2 \sum _{i=1}^n \sum _{j=1}^i \varDelta _i $$

Furthermore, note that we can rewrite the double sum as

$$ \sum _{i=1}^n \sum _{j=1}^i \varDelta _i = \sum _{i=1}^n (n-i+1) \varDelta _i $$

Next, note that we can upper bound the split function, $f(a \varDelta _1, (1-a)\varDelta _1, \ldots , \varDelta _n)$ as

$$\begin{aligned} f(a\varDelta _1, (1-a)\varDelta _1, \ldots , \varDelta _n)&\le \mu \gamma ^2 \left( (n+1)a \varDelta _1 + n(1-a)\varDelta _1 + \sum _{i=2}^n (n-i+2) \varDelta _i\right) \\&+\, \eta \left( a^2 \varDelta _1^2 + (1-a)^2 \varDelta _1^2 + \sum _{i=2}^n \varDelta _i^2 \right) \\&=\, \mu \gamma ^2 \left( (n+a)\varDelta _1 + \sum _{i=2}^n (n-i+1) \varDelta _i + \varDelta ^*\right) \\&+\, \eta \left( a^2 \varDelta _1^2 + (1-a)^2 \varDelta _1^2 + \sum _{i=2}^n \varDelta _i^2 \right) \end{aligned}$$

Combining these gives the following

$$\begin{aligned} f(\varDelta _1, \ldots , \varDelta _n) - f(a\varDelta _1, (1-a)\varDelta _1, \ldots , \varDelta _n)&\ge \gamma ^2(\kappa - \mu )\sum _{i=2}^n (n-i+1) \varDelta _i - \varDelta ^* \nonumber \\&-\, \mu \gamma ^2 (n+a)\varDelta _1 + \eta \varDelta _1^2 (1 - a^2 - (1-a)^2) \end{aligned}$$

(13)

Maximize the right-hand side in a provide a mechanism for deciding whether to split trade $\varDelta _1$. Optimizing over a yields

$$ a^* = \max \left( \frac{1}{2} - \frac{\mu \gamma ^2}{4\eta \varDelta _1}, 0\right) $$

If we substitute $a^*$ into (1) and the right-hand side is position, we split the trade $\varDelta _1$ into two trades of size $a^*\varDelta _1$ and $(1-a^*)\varDelta _1$.

G Splitting Trades: Concentration

Chatterjee proved a concentration bound using Stein’s method that provides intuition as to why splitting trades improves the effectiveness of SURE. Theorem 7 shows that the variance of concentration around the mean for a randomly permuted sum is linear in the expected value.

Theorem 7

([Cha07], Proposition 1.1). Let $\{a_{i,j}\}_{1\le i, j \le n}$ be a collection of numbers from [0, 1]. Let $X = \sum _{i=1}^n a_{i,\pi (i)}$ where $\pi \sim S_n$ uniformly. Then

$$\begin{aligned} \mathop {\textbf{Prob}}[|X-\mathop {\mathbf {E{}}}[X]|\ge t] \le 2 \exp \left( -\frac{t^2}{4\mathop {\mathbf {E{}}}[X]+2t}\right) \end{aligned}$$

(14)

Note that unlike Bernstein-like inequalities there is no direct dependence on n. Moreover, unlike Talagrand-like inequalities [Tal21], we do not have terms dependent on $\epsilon$-nets. If we let $t = k \mathop {\mathbf {E{}}}[X]$, we have

$$ \exp \left( -\frac{t^2}{4\mathop {\mathbf {E{}}}[X]+2t}\right) = \exp \left( -\frac{k^2 \mathop {\mathbf {E{}}}[X]}{2k+4}\right) \le \exp (-k\mathop {\mathbf {E{}}}[X]) $$

For positive trade sizes, this implies that if we can split big trades into smaller trades (which reduces in turn reduces $\mathop {\mathbf {E{}}}[X]$) we can achieve the sufficient condition. More specifically, suppose that $a_{i,j} = \varDelta _j - \frac{\kappa }{\mu }\varDelta _i$. Then $X = \sum _{i=1}^n a_{i, \pi (i)}$ is the upper bound from (6) and the theorem claims that reducing the maximum will reduce the variance of SURE’s utility.

We also note that better asymptotic results exist for non-negative sums:

Theorem 8

([Alb19], Corollary 2.2). Let $a_{ij}$ be a connection of any real numbers and $\pi \sim S_n$ as uniform random permutation. Let $Z_n = \sum _{i=1}^n a_{i, \pi (i)}$. Then for all $x > 0$

$$ \mathop {\textbf{Prob}}(|Z_n - \mathop {\mathbf {E{}}}[Z_n]| \ge t) \le 16 e^{1/16} \exp \left( \frac{-t^2}{256(\mathop {\mathbf {Var{}}}[Z_n] + \max _{i,j} |a_{ij}| t)} \right) $$

This bound explicitly includes a maximum term, directly justifying the improvement to SURE provided by splitting trades.

H Path Dependency and Generic Chaining

Suppose that we want to try to find the worst case price deviation given that we have fees, $\gamma < 1$. If we define $X_j = p^{\pi }(i) - p(i)$, then we want to study the extremal behavior of this process, albeit without being able to directly bound price impact using methods from Sect. 3.2. We will be most interested in the behavior of the random variable $X^* = \max _j X_j$, which quantifies the worse execution price received by a user under this mechanism. To do this, we will utilize the theory of empirical processes. Roughly speaking, one can show that for a metric space (T, d), $\mathop {\mathbf {E{}}}\sup _{t\in T} X_t = \varTheta (\textsf{Diam}(T) \sqrt{\log \textsf{card} T})$ by looking at simple bounds for empirical processes [Tal14, Tal21]. Our goal is to define a metric space $T_{\gamma }$ that depends on fees and such that $S_n$ acts faithfully on $T_{\gamma }$. We want the action to be faithful because that will be equivalent to the condition of unique elements of the form $\left| \varDelta _i - \frac{\mu }{\kappa }\varDelta _j\right|$ We can then attempt to bound, using chaining arguments, the worst case price deviation.

Chaining bounds rely on tail bounds on increments, e.g., showing that for some metric d on our space $T_{\gamma }$, we have the following two conditions:

$$\begin{aligned} \forall u > 0,\;\mathop {\textbf{Prob}}[|X_s - X_t| \ge u]&\le 2 \exp \left( -\frac{u^2}{2d(s,t)^2}\right) \end{aligned}$$

(15)

$$\begin{aligned} \exists u > 0,\; \sum _{s \in T} \mathop {\textbf{Prob}}[X_s \ge u]&\ge 1 \end{aligned}$$

(16)

In our case, we need to construct a metric space that takes advantage of our trading function curvature and the randomness induced by the choice of permutation.

Our goal is to construct a metric on $S_n$ that depends on both $\varphi$. We need to construct metric $d_{\varphi , \rho _0, \mathbf {\Delta }} : S_n \times S_n \rightarrow \textbf{R}_+$ that we can use to find a formula like Eq. (15). A natural metric to construct is the raw price differences:

$$ d_{\varphi , \rho _0, \mathbf {\Delta }}(\pi _1, \pi _2) = \sum _{i=1}^n | p^t_{\pi _1(i)} - p^t_{\pi _2(i)}| $$

Note that if we took an infimum over one of the two permutations, we arrive at the Wasserstein distance. Suppose we have $d_{\varphi , \rho _0, \mathbf {\Delta }}(\pi _1, \pi _2) \le f(\varphi , \rho _0, \mathbf {\Delta }) d(\pi _1, \pi _2)$ for some natural metric on the symmetric group (e.g., Mallows metric [Dia88]). Moreover, suppose there exists $\kappa > 0$ such that $\mathop {\textbf{Prob}}[X_s \ge \sqrt{\log n} \left( \kappa + \sum _i \varDelta _i\right) ] \ge 1$. Then we have the lower bound [Tal21, Eq. 2.15]

$$ C\left( \kappa + \sum _i \varDelta _i\right) \sqrt{\log n} \le \mathop {\mathbf {E{}}}\sup _{t\in T} X_t \le C' \left( \kappa + \sum _i \varDelta _i\right) \textsf{Diam}_d(T) \sqrt{\log n} $$

One simple idea for a metric upper bound is:

$$ d^{ub}(\pi _1, \pi _2) = \mu \sum _{i=1}^n |\varDelta _{\pi _1(i)} - \varDelta _{\pi _2(i)}| $$

Under this metric, we need to show that

$$ \mathop {\textbf{Prob}}[|X_{\pi } - X_{\pi '}| \ge u] \le 2 \exp \left( -\frac{u^2}{2d(\pi ,\pi ')^2}\right) $$

This is effectively direct from Azuma’s inequality since $\varDelta _i$ is in a bounded ball (in order for us to use curvature). Next, we need to show $\mathop {\textbf{Prob}}[X_s \ge \sqrt{\log n} \left( \kappa + \sum _i \varDelta _i\right) ] \ge 1$. For each permutation $\pi \in S_n$, we can construct a binary tree $T_{\pi }$ from the partial sums $S_i \sum _i \varDelta _{\pi (i)}$, where $S_i < S_j$ implies $S_i$ is in the left subtree of $S_j$ (and vice versa). Assume, first, that each $S_i$ is unique. Then, it can be shown that the expected height and the tail bounds for the height of this subtree satisfies [ABC20, Ree03]

$$ \mathop {\textbf{Prob}}[h(T_{\pi }) \ge \sqrt{\log n}] \ge \frac{c}{n} $$

Our conjecture is that $\kappa h(T_{\pi }) \le X_s \le \mu h(T_{\pi })$ which would immediately imply $\sum _{\pi \in S_n} \mathop {\textbf{Prob}}[X_{\pi } \ge u] \ge 1$. Unfortunately to find bounds of this form with fees, one needs to find universal bounds on $g(\varDelta ) - \gamma g(\gamma \varDelta )$. We illustrate such bounds for Uniswap in Appendix I.

I Path Dependency in Uniswap

Getting bounds such as (15) relies on bounding how far away the path-dependent case strays from the path independent case. For a fixed $\mathbf {\Delta }$, $p^{pi}_n$ only depends on $\sum _i \varDelta _i$ for path-independent, whereas $p^{pd}_n(\pi )$ does depend on the path $\varDelta _{\pi (1)}, \ldots , \varDelta _{\pi (n)}$. However, if we can uniformly bound $\max _{\pi \in S_n}|p^{pd}_n(\pi ) - p^{pi}_n|$ as a function of fees and curvature.

For Uniswap, we have $g_{uni}(\varDelta ) = \frac{k}{(R-\varDelta )^2}$. This gives a difference between the impact of a single path independent trade and a single path dependent trade as (see [AEC20] for the formulae):

$$\begin{aligned} g(\varDelta ) - \gamma g(\gamma \varDelta )&= k \left( \frac{1}{(R-\varDelta )^2} - \frac{\gamma }{(R-\gamma \varDelta )^2} \right) = \frac{k}{(R-\varDelta )^2}\left( 1 - \frac{\gamma (R-\varDelta )^2}{(R-\gamma \varDelta )^2}\right) \\&= g(\varDelta )\left( 1 - \frac{\gamma (R-\varDelta )^2}{R^2} \frac{1}{(1-\frac{\gamma \varDelta }{R})^2}\right) \\&\le g(\varDelta ) \left( 1 - \frac{\gamma (R-\varDelta )^2}{R^2}\left( 1 - \frac{c\gamma \varDelta }{R}\right) \right) \\&= g(\varDelta ) \left( 1- \frac{\gamma (R-\varDelta )^2}{R^2} - \frac{c\gamma \varDelta (R-\varDelta )}{R^3} \right) \\&= g(\varDelta )\left( 1 - \gamma \left( \frac{R-\varDelta }{R}\right) ^2(R-\left( 1+\frac{c}{R}\right) \varDelta )\right) \end{aligned}$$

where we assume that $\frac{\gamma \varDelta }{R} < 1$ and use the geometric series (so $c < 1$). When $R \gg 1$ and $R-\varDelta \le kR$ for some $k < 1$, this gives us the bound

$$ \frac{g(\varDelta )-\gamma g(\gamma \varDelta )}{g(\varDelta )} \le 1 - \gamma \frac{(R-\varDelta )^3}{R^2} \le 1 - \gamma k^3 R $$