How clim works

On every swap:

fee_pips = clamp( ceil(sigmaE9 × etaE4 × sqrtHalfDtE6 × kE4 / 1e17), feeMinPips, feeMaxPips )

• sigmaE9: the risk desk's latest ETH volatility, per square-root second, times 10^9 (an annual volatility divided by √31,536,000). The desk measures it as the 15-minute realized volatility of the median one-minute price of four exchanges.
• etaE4: η × 10^4, with η = 1/P* − 0.824. Under the arbitrage model of Milionis, Moallemi and Roughgarden (2023), corrected for fixed block times by Nezlobin and Tassy (2025), a block is arbitraged with probability 1/(η + 0.824). Choosing η therefore chooses P*, the share of blocks the LP lets arbitrageurs take.
• sqrtHalfDtE6: √(blockTime/2) × 10^6. Sepolia has 12 s blocks, so 2,449,490.
• kE4: a model-risk multiplier from the desk, between 1 and 2 (10,000 to 20,000). It can only make the fee more prudent.
• feeMinPips is the pair's market fee tier (500 pips = 5 bp for ETH/USDC), feeMaxPips a hard cap. 1 bp = 100 pips; Uniswap caps LP fees at 1,000,000 pips.

Two safety rules sit on top:

• Blind: if the desk never reported, or its last report is older than tauKillSec, the fee is at least feeSafePips.
• Degraded: if the venues disagree by more than 25 bp, the fee is at least feeSafePips.

The README shows the deployed values and the fee at several volatility levels.

Nobody, and no transaction does. The fee is recomputed inside each swap:

1. A trader calls PoolManager.swap on the clim pool.
2. Because the pool's PoolKey names ClimHook as its hook and the hook has the beforeSwap permission, the PoolManager calls ClimHook.beforeSwap.
3. The hook reads RiskDesk.state() (one external view call), computes the fee as above and returns it with OVERRIDE_FEE_FLAG (0x400000). This is OpenZeppelin's BaseOverrideFee pattern.
4. The PoolManager uses that fee for this swap only. In v4-core Pool.swap: lpFee = params.lpFeeOverride.isOverride() ? params.lpFeeOverride.removeOverrideFlagAndValidate() : slot0Start.lpFee(). The fee stored in the pool's slot0 is not written.
5. The Swap event's fee field records the fee that swap paid (LP fee plus protocol fee; the protocol fee is zero on our Sepolia pools).

What moves the fee over time is the desk: every 30 s the Chainlink CRE workflow writes a new report to RiskDesk, and the next swap reads it. On a DON that report is signed by the DON; in this build it comes from the one-node CRE simulator, sent by the operator key through MockKeystoneForwarder (see "Is the CRE consensus real in your demo?").

It depends on how the pool was created.

0. A Uniswap v3 pool: no. UniswapV3Pool.fee is immutable; the factory owner can only enable new fee tiers or set the protocol's share of fees, never change what an existing pool charges.
1. A static-fee Uniswap v4 pool: no. A pool is identified by PoolId = keccak256(abi.encode(PoolKey)), and the PoolKey contains the fee and the hook address. A pool whose key has a fixed fee (for example 500) can never take a per-swap fee: the PoolManager only honours a hook's fee override when key.fee == DYNAMIC_FEE_FLAG (0x800000). It cannot gain a hook either, and a pool cannot be initialized twice (PoolAlreadyInitialized). The path is a new pool with fee = 0x800000 and hooks = ClimHook, and LPs move their liquidity to it (remove from the old pool, add to the new one). Uniswap v2 and v3 pools have no hooks at all.
2. A dynamic-fee v4 pool with its own hook: it depends on that hook. Uniswap v4 gives a dynamic-fee pool's hook two ways to set the fee: per swap (beforeSwap returning the fee with OVERRIDE_FEE_FLAG, what clim does) or stored (PoolManager.updateDynamicLPFee(key, fee), which reverts unless msg.sender is the pool's hook). If the existing hook can read an external source or exposes a keeper path to updateDynamicLPFee, it can follow clim's risk desk without migrating. If its logic is fixed, a new hook means a new pool.
3. A DEX with its own AMM and a keeper-set fee (for example on an L2): its keeper reads RiskDesk.state(), or the same CRE workflow writes the report to its chain, and the DEX applies its own fee rule. The lightest first step is "shadow mode": publish the recommended fee next to the live one before switching. Example: Fables (Robinhood Chain) already has a keeper post temporary fee overrides between a floor and a cap on top of a flat fee (our pre-hackathon reading of public on-chain data, 2026-09-30); that keeper could read RiskDesk.state() with no contract change.
4. clim's own pools: the parameters are immutable. P*, the floor, the cap, the safe fee and the kill delay are constructor arguments of ClimHook. Changing them means deploying a new hook (a new address mined for its permission bits) and a new pool. That is deliberate: an LP knows the risk profile it joined, and no owner can change the rule.

What can change on a live clim pool without any migration: the volatility (every report), the multiplier k (sent by the desk, bounded to [1, 2]), the forwarder address and expected workflow id on RiskDesk (owner, to move from the simulation forwarder to the production KeystoneForwarder), and disableSim(), which permanently stops accepting simulated reports.

The protocol fee is a separate dial: it is taken on top of the LP fee and goes to the protocol, not to LPs.

It would capture most of the gain: in our lab, a volatility computed from the pool's own prices gets most of the improvement (the exact share is in the README's Results section). We still use a desk because the number must be hard to manipulate and easy to share:

• a pool-internal estimate can be pushed by trading against the pool itself; four exchanges that must agree cannot;
• the pool only sees itself, and an untraded pool shows no volatility at all;
• one figure (signed by the DON once deployed on one) can serve many pools and chains;
• the model check (predicted against observed arbitrage) runs off-chain, next to the data.

• Data Feeds. The ETH/USD price feed on Ethereum mainnet updates on a 0.5 % deviation or a one-hour heartbeat: a price, not a volatility, and too coarse to build a 15-minute estimate from. Chainlink also lists ETH realized-volatility feeds, but their shortest window is 24 hours with a one-hour heartbeat, they are not listed on Ethereum mainnet, and the Sepolia ETH-USD 24hr feed (0x31D04174D0e1643963b38d87f26b0675Bb7dC96e) last updated on 2024-08-30. A storm that starts and ends within the hour barely moves a 24-hour number.
• Data Streams. Pull-based: the user fetches a signed report off-chain and submits it for verification. For a fee, that would let the swapper choose which fresh report to bring. Its report schemas cover prices and other market data, not a 15-minute multi-venue realized volatility.
• CRE runs our own computation where the data lives (USD normalization, freshness, quorum, RV15, dispersion), lets every node fetch independently, and delivers one report on-chain every 30 s that any pool, keeper or chain can read. On a DON that report is the nodes' median, signed; in this build the one-node CRE simulator writes it through MockKeystoneForwarder (next question).

Not in simulation, and we say so. cre workflow simulate runs a single node, and on Sepolia the --broadcast path goes through MockKeystoneForwarder, which does not verify signatures. We compensate in two ways: RiskDesk accepts simulated reports only when tx.origin is our operator key (the demo shows a forged report being rejected; that key is also the desk's owner, so in simulation it is the one trusted sender, see "Can the owner change the fee?"), and the workflow is written with the CRE consensus API (median of each field) for a DON, but it has not run on one: DON deploy access was requested on 6 October 2026 (22:56 SGT) and not granted during the hackathon (still "Not enabled" on 7 October), so the DON deployment was cut. On a DON, reports would arrive through the production KeystoneForwarder; the owner would point RiskDesk at it and pin the expected workflow ID (ReceiverTemplate's identity checks), and only then call disableSim() and renounce ownership. From then on no single key can write the desk.

For LPs, modestly and unevenly: it is insurance. The README's Results section gives the lab numbers at the deployed parameters (both comparisons, and the backtest gain per year of capital). As a business, not as a cut of hook fees: the credible path is a risk desk offered as a service to DEXs.

We need Uniswap v4 hooks and Chainlink CRE on the same chain. Sepolia has both, and its 12 s blocks make the fee formula produce readable fees. Solana has no Uniswap v4 hooks (we would have to write our own AMM program), and Meteora already ships volatility-based fees there. CRE can write to Solana, so the same desk can publish its report there later: one desk, many chains.

A venue whose last closed one-minute candle is older than 120 s is dropped. With fewer than 3 venues there is no report, and if the desk stays silent past the kill delay the hook quotes the safe fee. If the venues disagree by more than 25 bp, the desk flags itself as degraded and the hook quotes at least the safe fee. Volatility can move at most ×2 up and ×0.8 down between two reports, so one bad report cannot swing the fee arbitrarily.

Not through any setter, but in this build the owner key does send the reports. ClimHook has no owner and no setter, and RiskDesk has no function that sets volatility or the fee. RiskDesk's owner (OpenZeppelin Ownable, through Chainlink's ReceiverTemplate) can choose which forwarder and which workflow to trust (setForwarderAddress, setExpectedWorkflowId, setExpectedAuthor, setExpectedWorkflowName), call disableSim(), and transfer or renounce ownership.

In this hackathon deployment the live desk's owner key is also its simOperator, the operator key that sends every simulated report. While simMode is on, RiskDesk accepts a report through MockKeystoneForwarder only when tx.origin is that key, and the report itself declares the volatility, k, the number of venues and their dispersion. So today that one key can post any volatility it likes, inside the bounds below. (The replay desk has the same owner but its own simOperator key.) A malicious owner could also point the desk at a forwarder it controls, or at address 0, which removes the sender check, and then feed its own volatility. disableSim() does not prevent that, so the owner key can post reports until ownership is renounced.

Every report, whoever sends it, stays bounded:

• volatility moves at most ×2 up and ×0.8 down per report, and always stays between 10% and 1000% a year;
• reports must be at least 20 s apart (by observation time), at most 30 s in the future, and declare at least 3 venues;
• k is clamped to [1, 2];
• the fee stays between the 5 bp floor and the 150 bp cap.

That still leaves room: from a calm 12% a year, 7 reports, a few minutes in all, reach the 1000% ceiling (about 109 bp at k = 1, the 150 bp cap at k = 2), and a report that declares more than 25 bp of dispersion flags the desk as degraded, which lifts the fee to at least the 30 bp safe fee.

On a DON, once the expected workflow ID is pinned, simulation disabled and ownership renounced, no single key can write the desk: RiskDesk then accepts only the DON's signed reports. The owner switches to the KeystoneForwarder and pins the expected workflow ID (ReceiverTemplate's identity checks) before it calls disableSim() (irreversible) and renounces ownership (or hands it to a timelocked multisig). The hackathon deployment keeps an owner because it must switch forwarders; DON deploy access was not granted during the hackathon, so that switch has not happened.