A sandwich attack needs to know almost exactly where your trade will land, so it can front-run and back-run it for profit. Protected-lane swaps break that assumption: the settlement boundary is chosen by Chainlink VRF after the swap is committed, not before.
beforeSwap → impact > 0.5%? └─ yes → revert, must commitSwap() commitSwap → requestRandomness() └─ VRF fulfills off-chain settleSwap → candidate = VRF % 5 └─ swap bounded by candidate price └─ 0.1% premium donated to LPs
Sandwich attacks only make sense when there's enough price movement to profit from. A hook that protects every trade equally would just slow everyone down for no reason — so only swaps that cross the risk threshold get routed through commit/settle.
It's real Chainlink VRF v2.5 — a verifiable randomness oracle, not a pseudo-random on-chain trick like block.prevrandao. The value doesn't exist anywhere until after your swap is already committed.
No — the randomness picks a boundary, not a price. Your swap still executes against the real pool; the boundary just moves within a tight ±0.20% band so an attacker can't calculate the exact setup in advance.
A small premium (0.10% of the settled amount) is added on protected-lane swaps and routed directly to liquidity providers — not the protocol.