protocol

architecture

lode keeps the contract surface deliberately small. five contracts split distinct concerns; an off-chain keeper does scheduled bookkeeping. nothing else.

component diagram

text+--------------------------------------------------------------+
  |                         lode protocol                         |
  |                                                               |
  |  lodeToken  <----  lodeHook  ---->  lodeProtocolVault         |
  |  erc-20            (v4 hook)        (fee accumulator)         |
  |  100m cap                                                     |
  |                       |                  |                    |
  |                       v                  v                    |
  |                  lodeSplitter         keeper                  |
  |                  (3-way)              (off-chain)             |
  |                       |                  |                    |
  |              +--------+--------+         v                    |
  |              v        v        v    buyback executor          |
  |          protocol  builder   bene   (cowswap)                 |
  |          vault     (0-30%)   ficiary    |                     |
  |          (20%)               (lp)       v                     |
  |                                    lode -> 0xdead             |
  |                                                               |
  |  lodeStaking  <-----  lodeFactory                             |
  |  (100k stake)         (permissions, validation)               |
  +---------------------------------------------------------------+

contracts at a glance

contract	responsibility	trust assumption
`lodeToken`	erc-20, fixed 100m supply, no mint, eip-2612 permit, burnable	immutable post-deploy
`lodeHook`	v4 beforeswap hook; computes & collects per-block premium	safe-degrade — never reverts the underlying swap
`lodeSplitter`	one per pool; routes premium to protocol/builder/lp	nonReentrant; immutable destinations except beneficiary timelock
`lodeProtocolVault`	accumulates protocol slice across currencies; daily caps	two-multisig topology (owner + guardian)
`lodeStaking`	locks 100k lode per builder pool; 7-day cooldown	slashable by governance
`lodeFactory`	validates & deploys new pools (whitelist or permissionless)	factory enforces all pool-parameter constraints

off-chain

keeper: periodically calls distribute(token) on each splitter and flushToBuyback(token) on the vault. compromise bounded by daily caps. hot wallet, rotatable.
buyback executor: receives token transfers from the vault, constructs cowswap intents to buy lode, sends bought lode to 0x…dead. governance-rotatable address.
indexer: snapshots every block, computes audit metrics. stateless & reproducible from on-chain events.

data flow in one sentence

swap → hook computes premium → splitter routes 20/0–30/residual → vault accumulates protocol slice → keeper flushes daily under cap → cowswap buys lode → burn.

what's intentionally absent

no upgradability proxies. contracts are deployed at fixed addresses. fixes ship via redeploy + governance-driven migration, not in-place upgrade.
no oracle dependency in the hot path. premium is bps of swap notional, not a price-feed-derived value.
no token approvals from users. the hook collects the premium via uniswap's BeforeSwapDelta mechanism, charging the swap input directly.
no cross-contract callbacks under user control. the only external calls in the hot path are to the splitter (lode-controlled).