FLO-19 Update Price Deviation to Use DEX Price as Base

[holyfuchs]

Closes: #228

What Changed
Updated the deviation denominator from min(dexPrice, oraclePrice) to a fixed dexPrice.

Why
Since we are swapping at the DEX price, it represents our actual execution value. We use it as the "ground truth" so that the deviation check is always relative to the price we are actually paying or receiving.

The Math
By using the execution price as the base, the 1000 bps (10%) threshold creates a consistent safety buffer:

$$\text{Deviation} = \frac{|dexPrice - oraclePrice|}{dexPrice}$$

Example (1000 bps / 10% Threshold):

• If DEX Price is 100:
• |100 - 90| / 100 = 0.10 (1000 bps) -> Pass
• |100 - 110| / 100 = 0.10 (1000 bps) -> Pass
• Result: Symmetric +/- 10 range (90–110).

[jordanschalm]

The Quantstamp audit mentions this as well (FLO-19), but suggests the opposite resolution (use the oracle price as the denominator in all cases).

My 2c is that there is no unambiguously "right" answer to this problem. I still have a slight preference for the way it is now, because it is the most conservative way to compute the deviation (you will reject more pairs of oraclePrice, dexPrice values), but don't have a super strong opinion.

[holyfuchs]

Should we even care if the DEX gives a better price than the oracle?

Thinking about it again, the oracle is an aggregate that already includes DEX data and also checks deviation between the 2 prices. It makes more sense to use it as the "ground truth" and only allow a specific deviation from that value.

If the Oracle is $1,000 and we allow 1% slippage: DEX is allowed to return 990$

[zhangchiqing]

I like the new implementation, because it's simple, easier to remember (does what the function name says) and reason about since it removes an if-check.

If we need the behavior of existing implementation, which has a slight bias, then I would change the function to take two DeviationBps, (instead of one) one for the case when dexPrice < oraclePrice, the other for the opposite case. But I'm not sure if that complexity is always better. I'm still prefer simplicity.