Share inflation: the perpetual futures pool uses two defenses, and the formula shows why

[mikemaccana]

Follow-up to #162, which has merged. This branch was restarted from current main.

• The Adversary: the inflation-attack section ended with "a program needs one of these four" and listed the perpetual futures pool as one that locks shares. The bullet just above it says recording the pool's size is not enough on its own there. The closing lines now say:
  • a program also has to check that nothing else it allows raises the pool's value the way a donation does;
  • the perpetual futures pool uses both defenses. It ignores donations by pricing shares from its recorded liquidity, and it locks shares because its own traders can raise that figure.
• Perpetual Futures: the inflation failure mode now gives the share formula, deposit × (shares outstanding + 1,000) ÷ AUM, and the test's result. The victim is minted 2,001 shares against the attacker's 1, where dividing by the bare supply of 1 would have minted them a single share. That figure comes from test_inflating_liquidity_through_own_trades_does_not_pay, which is on companion main since Count the first-deposit minimum in every share divisor (token swap, perpetual futures) solana-program-examples#152 merged.

npm run lint, node scripts/check-figure-geometry.mjs and npm run build-pdf all pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HagqhpPNqcywT37qqgnFey

---

Generated by Claude Code