Docs
FORGE takes one input: whether ETH is entering its market or leaving it. Everything below follows from the sign and size of that number.
The one design decision worth stating first
Issuance normally means a live mint, and a live mint is the single thing every token scanner flags and every holder has to trust somebody about. So FORGE does not have one. The whole supply exists at construction and no function can make more. What the protocol calls issuance is release: tokens already minted, held by the engine, entering circulation at a rate the market sets. Burning is the only thing that changes the total, and it only moves down.
That is not a compromise on the mechanism, it is what makes it credible. A supply schedule that adapts to the market does not require the ability to mint. It requires the ability to vary a rate. FORGE varies the rate.
The loop
Market flow
Net ETH through the pool
Monetary state
Rate up a step, or cut
Supply response
Release, or buy and burn
The output feeds the market, which produces the next epoch's input. Nothing else enters the loop: no oracle, no vote, no parameter anyone can turn.
The pool is the instrument
FlowHook sits on the FORGE/ETH pool and watches the ETH leg of every swap. It keeps one signed running total for the epoch in progress: ETH paid in is demand arriving, ETH taken out is capital leaving. That signed number is the engine's entire input. Nobody writes it by hand, no oracle reports it, and there is no view anywhere in the system about what FORGE is worth. The engine cannot form one: its only input is a quantity of ETH.
The hook also takes a 1% toll, and which side it lands on is decided by the swap rather than by us. v4 lets a hook charge the unspecified currency, which is the output on an exact-input swap. So an ordinary buy pays its toll in FORGE and an ordinary sell pays in ETH. Both are useful and neither is aimed at a direction: the FORGE is burned, the ETH becomes reserve.
The measurement never reverts
A hook that throws is a pool nobody can trade, and a monetary input is not worth bricking a market for. Every branch that cannot compute a charge returns zero and lets the swap through.
The engine settles
Once an epoch (4 hours), anyone may close the books. settle() asks the hook for the epoch's reading, which clears it, and then acts on the sign.
+15%
The release rate steps up by that fraction of itself, capped.
to 40%
The rate is cut to that fraction of itself in one move, floored, and part of the reserve is spent buying FORGE and destroying it.
The asymmetry is the design. Demand has to persist across epochs to earn a large rate, because each epoch grants only a step: five unbroken epochs roughly double it. One epoch of capital leaving takes 60% of it away. Growth must be argued for repeatedly; retreat is granted immediately. A flat epoch counts as not-positive on purpose, because an epoch that produced no demand has not earned a step.
Both bounds are compile-time constants, so the worst case in either direction is known before launch rather than discovered during one.
Capacity is bought with supply
Staking normally asks for nothing: deposit, earn, leave with everything you brought. Capacity asks for something. The only way to hold a larger share of what the engine releases is to destroy FORGE that exists today. Not locked. Gone.
That turns it into an economic decision rather than a free option. A participant chooses between liquid supply now and a claim on an issuance stream whose size they do not control and cannot predict, because the market sets it.
Leaving costs too. Claiming accrued FORGE gives up 10% of the capacity that earned it, so a holder taking profit hands part of their future share to everyone who stayed. Without that, the optimal play is to claim every epoch and carry no risk, which is the same as having no mechanism at all.
Reserves
The ETH side of the toll accumulates in the engine. In healthy conditions it simply builds. When flow turns negative it is spent, buying FORGE and burning it. Reserves are not a redemption promise and not a price floor. They are resources the monetary system controls, deployed by rules fixed before launch.
What can go wrong, stated plainly
The market is the input, so the market can be the attack
Flow is measured per epoch and expansion is capped per epoch, so buying pressure cannot be converted into issuance faster than one step at a time. Sustained capital can buy sustained expansion. That is the mechanism working, not failing.
A wash trade earns nothing
Buying and selling the same size nets to roughly zero flow, minus the pool fee and the toll, so it pays to move the price against itself and buys no expansion.
The pot is finite
When the issuance pot runs out, the stream stops. Nothing mints more. That is the trade for having no mint function.
The reserve can be empty
Then a negative epoch cuts the rate and buys nothing, and the epoch still closes. A defence that cannot execute never freezes the clock.
Impermanent loss is real
For liquidity providers, as in any constant-product market.
There is no upside promise
No target price, no APY, no floor. The rate can sit at its minimum indefinitely if the market never gives it a positive epoch.
Liquidity and operations
The position is held by an LP manager whose entry points are all owner-only: addLiquidity, removeLiquidity and claimFees. Everything they pull out goes to the owner in the same transaction, and any leftover from a deposit is refunded rather than left in the manager.
Two orderings that matter
The opening price is derived from the two amounts, never chosen beside them. A full-range position ties the legs together through the price, so a price that disagrees with the amounts deposits whichever side runs out first and silently refunds the rest.
The toll is swept before the liquidity is pulled. A v4 toll lives as an ERC-6909 claim against the pool manager, and the engine spends its ETH back through this very pool. Drain the position first and the claim is stranded against a market that no longer exists.
Tests
Twenty-two tests, every one against Base's real PoolManager on a fork. Nothing is mocked: a mocked v4 would have to reproduce delta accounting, ERC-6909 claims and the exact shape of a hook callback, and a mock wrong about any of those turns the suite decorative.