Waterfilling & Rounding

When a round clears, e_i must be computed for every participating address such that no address exceeds either its own deposit or the global cap, and the sum of all effective contributions equals V_target exactly.

Two Regimes

Fast Path

If, after applying a single global scaling factor k, no address would be pushed above A_max, the fill is a pure linear scale:

e_i = z_i × k_global ,    k_global =  V_target / Σ_i z_i

Iterative Path

If one or more addresses would be capped under a single global k, those addresses are pinned at e_i = A_max and removed from both the remaining funding pool and the remaining participant set. k is then recomputed over the reduced problem. This repeats until no further address is pinned — that is, until convergence.

Every intermediate and final value obeys the three-way clamp:

e_i = min( z_i × k ,  A_max ,  z_i )

Simultaneously forbids allocating more than an address deposited, allocating more than the per-address cap, and any negative refund — since refund_i = z_i − e_i ≥ 0 follows directly.

Largest-Remainder Rounding

e_i and token_i are computed over finite-precision integers. Direct division introduces truncation error that, summed across potentially thousands of addresses, must not silently violate conservation.

1. Compute every e_i and token_i by flooring.
2. Compute the residual — the difference between the target sum and the sum of floored values — in the USDG and token dimensions independently.
3. Distribute the residual one minimum unit at a time to the addresses with the largest fractional remainder, in descending order of remainder size.
4. Break ties by ascending address order, giving a total order and therefore a unique, reproducible outcome for any given input set.

This guarantees the two settlement identities hold exactly, not approximately:

Σ_i e_i = V_target      Σ_i token_i = tokenPool

Why step 4 matters

Deterministic tie-breaking is what makes settlement reproducible by anyone. Given the frozen deposit set there is exactly one valid output — so a third party can recompute the Merkle root independently and verify the published one matches.