From c8bea52a7a1a12cd590eddd0eaffc84487120d54 Mon Sep 17 00:00:00 2001
From: obchain <riteshnikhoriya94@gmail.com>
Date: Tue, 21 Apr 2026 12:26:37 +0530
Subject: [PATCH 1/3] feat(core): gas-aware profit calculator
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Shared decision point for the scanner → router → executor handoff:
given a candidate liquidation priced entirely in USD cents, decide
whether its net beats the configured `min_profit_usd` threshold.

Formula:
    gross    = repay × liquidation_bonus_bps / 10_000
    slippage = gross × slippage_bps           / 10_000
    net      = gross − flash_fee − gas − slippage

Design notes:
- Integer USD cents throughout. Caller converts once at the boundary
  using the Chainlink price cache; no float drift on the hot path
- `ProfitInputs` / `NetProfit` structs make the interface auditable
- Overflow-safe: `checked_mul` + `checked_add` on every arithmetic
  step; bogus bps values (> 10_000) are rejected up front
- Errors carry the itemised cost breakdown so logs show exactly why a
  candidate was dropped

Five unit tests cover: healthy-path numbers, below-threshold
rejection, cost-eats-gross rejection, bogus bps validation, zero
threshold acceptance.
---
 crates/charon-core/src/lib.rs    |   2 +
 crates/charon-core/src/profit.rs | 201 +++++++++++++++++++++++++++++++
 2 files changed, 203 insertions(+)
 create mode 100644 crates/charon-core/src/profit.rs

diff --git a/crates/charon-core/src/lib.rs b/crates/charon-core/src/lib.rs
index 0d7b441..eb543ae 100644
--- a/crates/charon-core/src/lib.rs
+++ b/crates/charon-core/src/lib.rs
@@ -2,11 +2,13 @@
 
 pub mod config;
 pub mod flashloan;
+pub mod profit;
 pub mod traits;
 pub mod types;
 
 pub use config::Config;
 pub use flashloan::{FlashLoanProvider, FlashLoanQuote};
+pub use profit::{NetProfit, ProfitInputs, calculate_profit};
 pub use traits::LendingProtocol;
 pub use types::{
     FlashLoanSource, LiquidationOpportunity, LiquidationParams, Position, ProtocolId, SwapRoute,
diff --git a/crates/charon-core/src/profit.rs b/crates/charon-core/src/profit.rs
new file mode 100644
index 0000000..138d997
--- /dev/null
+++ b/crates/charon-core/src/profit.rs
@@ -0,0 +1,201 @@
+//! Gas-aware profit calculator.
+//!
+//! Sits between the scanner (surfaces a liquidatable `Position`) and the
+//! router (picks a flash-loan source): given a candidate liquidation
+//! priced entirely in USD cents — plus the configured `min_profit_usd`
+//! threshold — decide whether it's worth building a transaction for.
+//!
+//! Everything is in USD cents (u64). Integer math throughout so we
+//! don't accumulate float error across the hot path; conversion from
+//! on-chain amounts happens once at the caller using the price cache.
+//!
+//! ```text
+//! gross      = repay_usd × liquidation_bonus_bps / 10_000
+//! slippage   = gross      × slippage_bps          / 10_000
+//! net        = gross − flash_fee − gas − slippage
+//! ```
+
+use anyhow::Result;
+use serde::{Deserialize, Serialize};
+
+/// Everything the calculator needs, already converted to USD cents.
+#[derive(Debug, Clone, Copy)]
+pub struct ProfitInputs {
+    /// Debt the bot will repay (and therefore also the flash-loan
+    /// amount), expressed in USD cents after price-cache lookup.
+    pub repay_amount_usd_cents: u64,
+    /// Liquidation bonus paid on top of the seized collateral, in
+    /// basis points. Venus is `1000` (10%) on most markets.
+    pub liquidation_bonus_bps: u16,
+    /// Absolute flash-loan fee in USD cents
+    /// (`amount_usd × fee_bps / 10_000` at the call site).
+    pub flash_fee_usd_cents: u64,
+    /// Expected gas cost for the liquidation tx in USD cents.
+    pub gas_cost_usd_cents: u64,
+    /// DEX swap slippage to budget for, in basis points on the gross
+    /// profit (`50` = 0.5% of gross).
+    pub slippage_bps: u16,
+}
+
+/// Itemised profit breakdown returned on success.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct NetProfit {
+    pub gross_usd_cents: u64,
+    pub flash_fee_usd_cents: u64,
+    pub gas_cost_usd_cents: u64,
+    pub slippage_usd_cents: u64,
+    pub net_usd_cents: u64,
+}
+
+impl NetProfit {
+    pub fn net_usd(&self) -> f64 {
+        self.net_usd_cents as f64 / 100.0
+    }
+    pub fn gross_usd(&self) -> f64 {
+        self.gross_usd_cents as f64 / 100.0
+    }
+}
+
+/// Compute net profit for a candidate liquidation.
+///
+/// Returns `Err` whenever the liquidation is unprofitable — either the
+/// total cost (flash fee + gas + slippage) swallows the gross bonus,
+/// or the net falls below `min_profit_usd`. The caller is expected to
+/// drop the opportunity on `Err`; no partial state is ever emitted.
+pub fn calculate_profit(inputs: &ProfitInputs, min_profit_usd: f64) -> Result<NetProfit> {
+    // Validate bps inputs up-front; out-of-range values would silently
+    // distort the math without panicking.
+    if inputs.liquidation_bonus_bps > 10_000 {
+        anyhow::bail!(
+            "liquidation_bonus_bps {} exceeds 100% (10_000 bps)",
+            inputs.liquidation_bonus_bps
+        );
+    }
+    if inputs.slippage_bps > 10_000 {
+        anyhow::bail!(
+            "slippage_bps {} exceeds 100% (10_000 bps)",
+            inputs.slippage_bps
+        );
+    }
+
+    // gross = repay × bonus_bps / 10_000
+    let gross = inputs
+        .repay_amount_usd_cents
+        .checked_mul(inputs.liquidation_bonus_bps as u64)
+        .ok_or_else(|| anyhow::anyhow!("profit: gross multiplication overflow"))?
+        / 10_000;
+
+    let slippage = gross
+        .checked_mul(inputs.slippage_bps as u64)
+        .ok_or_else(|| anyhow::anyhow!("profit: slippage multiplication overflow"))?
+        / 10_000;
+
+    let total_cost = inputs
+        .flash_fee_usd_cents
+        .checked_add(inputs.gas_cost_usd_cents)
+        .and_then(|v| v.checked_add(slippage))
+        .ok_or_else(|| anyhow::anyhow!("profit: total-cost addition overflow"))?;
+
+    if gross <= total_cost {
+        anyhow::bail!(
+            "unprofitable: gross={:.2} ≤ total_cost={:.2} (flash_fee={:.2}, gas={:.2}, slippage={:.2})",
+            cents_to_usd(gross),
+            cents_to_usd(total_cost),
+            cents_to_usd(inputs.flash_fee_usd_cents),
+            cents_to_usd(inputs.gas_cost_usd_cents),
+            cents_to_usd(slippage)
+        );
+    }
+
+    let net = gross - total_cost;
+    let min_cents = (min_profit_usd.max(0.0) * 100.0) as u64;
+    if net < min_cents {
+        anyhow::bail!(
+            "below threshold: net={:.2} < min_profit_usd={:.2}",
+            cents_to_usd(net),
+            min_profit_usd
+        );
+    }
+
+    Ok(NetProfit {
+        gross_usd_cents: gross,
+        flash_fee_usd_cents: inputs.flash_fee_usd_cents,
+        gas_cost_usd_cents: inputs.gas_cost_usd_cents,
+        slippage_usd_cents: slippage,
+        net_usd_cents: net,
+    })
+}
+
+fn cents_to_usd(cents: u64) -> f64 {
+    cents as f64 / 100.0
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn typical_inputs() -> ProfitInputs {
+        // $1000 debt, 10% bonus → $100 gross.
+        ProfitInputs {
+            repay_amount_usd_cents: 100_000,
+            liquidation_bonus_bps: 1_000,
+            flash_fee_usd_cents: 50, // $0.50 (Aave V3 0.05% on $1000)
+            gas_cost_usd_cents: 200, // $2 gas
+            slippage_bps: 50,        // 0.5% of gross = $0.50
+        }
+    }
+
+    #[test]
+    fn healthy_liquidation_is_profitable() {
+        let np = calculate_profit(&typical_inputs(), 5.0).expect("profitable");
+        assert_eq!(np.gross_usd_cents, 10_000); // $100
+        assert_eq!(np.slippage_usd_cents, 50);
+        // net = 10_000 − 50 (fee) − 200 (gas) − 50 (slippage) = 9_700
+        assert_eq!(np.net_usd_cents, 9_700);
+    }
+
+    #[test]
+    fn below_threshold_is_rejected() {
+        let inputs = typical_inputs();
+        let err = calculate_profit(&inputs, 200.0).expect_err("should reject");
+        assert!(format!("{err:#}").contains("below threshold"));
+    }
+
+    #[test]
+    fn cost_greater_than_gross_is_rejected() {
+        let inputs = ProfitInputs {
+            repay_amount_usd_cents: 1_000,
+            liquidation_bonus_bps: 1_000, // $1 debt × 10% = $0.10 gross
+            flash_fee_usd_cents: 1,
+            gas_cost_usd_cents: 200, // $2 gas eats the whole thing
+            slippage_bps: 50,
+        };
+        let err = calculate_profit(&inputs, 0.0).expect_err("unprofitable");
+        assert!(format!("{err:#}").contains("unprofitable"));
+    }
+
+    #[test]
+    fn bogus_bps_values_are_rejected() {
+        let mut inputs = typical_inputs();
+        inputs.liquidation_bonus_bps = 20_000;
+        assert!(calculate_profit(&inputs, 0.0).is_err());
+
+        inputs = typical_inputs();
+        inputs.slippage_bps = 20_000;
+        assert!(calculate_profit(&inputs, 0.0).is_err());
+    }
+
+    #[test]
+    fn zero_threshold_accepts_any_positive_net() {
+        // Gross = $1, costs = $0.50 total → net = $0.50 > $0 threshold
+        let inputs = ProfitInputs {
+            repay_amount_usd_cents: 1_000,
+            liquidation_bonus_bps: 1_000,
+            flash_fee_usd_cents: 30,
+            gas_cost_usd_cents: 15,
+            slippage_bps: 50,
+        };
+        let np = calculate_profit(&inputs, 0.0).expect("profitable");
+        assert!(np.net_usd_cents > 0);
+    }
+}

From 7e5721759a9798513d6c19d01570c82cc3b53b51 Mon Sep 17 00:00:00 2001
From: obchain <riteshnikhoriya94@gmail.com>
Date: Tue, 21 Apr 2026 12:30:20 +0530
Subject: [PATCH 2/3] feat(core): profit-ordered OpportunityQueue with TTL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Final Day-3 piece: a priority queue the executor drains one per block,
always taking the highest-net-profit liquidation that hasn't aged out.

- `BinaryHeap<QueueEntry>` under the hood; ordering keyed on
  `net_profit_usd_cents` so the heap root is the richest opportunity
- Private `QueueEntry` wrapper keeps `Ord` off the public
  `LiquidationOpportunity` — the type stays free of ordering
  semantics in unrelated contexts
- TTL in blocks (default 2, ≈ 6 s on BSC). Stale entries get
  silently dropped on `pop` and can be swept via `prune_stale`
- `push` / `pop` / `prune_stale` / `len` / `is_empty` surface;
  callers track the current block themselves so the queue has no
  concept of time beyond what the caller feeds it
- Five unit tests: ordering, TTL boundary, stale drop, prune count,
  default TTL
---
 crates/charon-core/src/lib.rs   |   2 +
 crates/charon-core/src/queue.rs | 202 ++++++++++++++++++++++++++++++++
 2 files changed, 204 insertions(+)
 create mode 100644 crates/charon-core/src/queue.rs

diff --git a/crates/charon-core/src/lib.rs b/crates/charon-core/src/lib.rs
index eb543ae..0c8ab52 100644
--- a/crates/charon-core/src/lib.rs
+++ b/crates/charon-core/src/lib.rs
@@ -3,12 +3,14 @@
 pub mod config;
 pub mod flashloan;
 pub mod profit;
+pub mod queue;
 pub mod traits;
 pub mod types;
 
 pub use config::Config;
 pub use flashloan::{FlashLoanProvider, FlashLoanQuote};
 pub use profit::{NetProfit, ProfitInputs, calculate_profit};
+pub use queue::{DEFAULT_TTL_BLOCKS, OpportunityQueue};
 pub use traits::LendingProtocol;
 pub use types::{
     FlashLoanSource, LiquidationOpportunity, LiquidationParams, Position, ProtocolId, SwapRoute,
diff --git a/crates/charon-core/src/queue.rs b/crates/charon-core/src/queue.rs
new file mode 100644
index 0000000..c6706e6
--- /dev/null
+++ b/crates/charon-core/src/queue.rs
@@ -0,0 +1,202 @@
+//! Profit-ordered opportunity queue.
+//!
+//! After the router prices a liquidation, the resulting
+//! [`LiquidationOpportunity`] lands in this queue. The executor drains
+//! entries highest-net-profit first, dropping anything older than
+//! `ttl_blocks` (default 2) — stale quotes are priced against stale
+//! balances and usually revert on `eth_call` anyway.
+//!
+//! Backed by `std::collections::BinaryHeap`. Ordering is defined on a
+//! private `QueueEntry` wrapper so we don't put `Ord` on the public
+//! `LiquidationOpportunity` type (which already derives `Serialize`
+//! and could pick up unrelated semantics from a natural ordering).
+
+use std::cmp::Ordering;
+use std::collections::BinaryHeap;
+
+use crate::types::LiquidationOpportunity;
+
+/// Default TTL, in blocks. Two blocks ≈ 6 s on BSC — long enough to
+/// survive one routing round-trip but short enough that stale quotes
+/// don't pile up.
+pub const DEFAULT_TTL_BLOCKS: u64 = 2;
+
+/// Heap wrapper — compares by `net_profit_usd_cents` so the root of
+/// the `BinaryHeap` (max-heap) is the most profitable opportunity.
+#[derive(Debug, Clone)]
+struct QueueEntry {
+    opportunity: LiquidationOpportunity,
+    queued_at_block: u64,
+}
+
+impl PartialEq for QueueEntry {
+    fn eq(&self, other: &Self) -> bool {
+        self.opportunity.net_profit_usd_cents == other.opportunity.net_profit_usd_cents
+    }
+}
+impl Eq for QueueEntry {}
+impl PartialOrd for QueueEntry {
+    fn partial_cmp(&self, other: &Self) -> Option<Ordering> {
+        Some(self.cmp(other))
+    }
+}
+impl Ord for QueueEntry {
+    fn cmp(&self, other: &Self) -> Ordering {
+        self.opportunity
+            .net_profit_usd_cents
+            .cmp(&other.opportunity.net_profit_usd_cents)
+    }
+}
+
+/// Priority queue of ready-to-execute liquidations.
+pub struct OpportunityQueue {
+    heap: BinaryHeap<QueueEntry>,
+    ttl_blocks: u64,
+}
+
+impl OpportunityQueue {
+    pub fn new(ttl_blocks: u64) -> Self {
+        Self {
+            heap: BinaryHeap::new(),
+            ttl_blocks,
+        }
+    }
+
+    pub fn with_default_ttl() -> Self {
+        Self::new(DEFAULT_TTL_BLOCKS)
+    }
+
+    pub fn len(&self) -> usize {
+        self.heap.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.heap.is_empty()
+    }
+
+    /// Enqueue a freshly-priced opportunity, tagged with the block it
+    /// was queued at (for TTL accounting).
+    pub fn push(&mut self, opportunity: LiquidationOpportunity, queued_at_block: u64) {
+        self.heap.push(QueueEntry {
+            opportunity,
+            queued_at_block,
+        });
+    }
+
+    /// Pop the highest-profit *fresh* opportunity, silently discarding
+    /// any stale entries popped along the way. Returns `None` when the
+    /// queue has no fresh entries left.
+    pub fn pop(&mut self, current_block: u64) -> Option<LiquidationOpportunity> {
+        while let Some(entry) = self.heap.pop() {
+            if !self.is_stale(&entry, current_block) {
+                return Some(entry.opportunity);
+            }
+        }
+        None
+    }
+
+    /// Remove every stale entry, returning the number dropped. Cheap
+    /// to run once per block so stale opportunities don't balloon the
+    /// heap between bursts.
+    pub fn prune_stale(&mut self, current_block: u64) -> usize {
+        let before = self.heap.len();
+        let fresh: Vec<QueueEntry> = std::mem::take(&mut self.heap)
+            .into_iter()
+            .filter(|e| !self.is_stale(e, current_block))
+            .collect();
+        self.heap = BinaryHeap::from(fresh);
+        before - self.heap.len()
+    }
+
+    fn is_stale(&self, entry: &QueueEntry, current_block: u64) -> bool {
+        current_block.saturating_sub(entry.queued_at_block) > self.ttl_blocks
+    }
+}
+
+impl Default for OpportunityQueue {
+    fn default() -> Self {
+        Self::with_default_ttl()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::types::{FlashLoanSource, Position, ProtocolId, SwapRoute};
+    use alloy::primitives::{Address, U256, address};
+
+    fn mk_opp(net_cents: u64) -> LiquidationOpportunity {
+        LiquidationOpportunity {
+            position: Position {
+                protocol: ProtocolId::Venus,
+                chain_id: 56,
+                borrower: address!("1111111111111111111111111111111111111111"),
+                collateral_token: Address::ZERO,
+                debt_token: Address::ZERO,
+                collateral_amount: U256::ZERO,
+                debt_amount: U256::ZERO,
+                health_factor: U256::ZERO,
+                liquidation_bonus_bps: 1_000,
+            },
+            debt_to_repay: U256::ZERO,
+            expected_collateral_out: U256::ZERO,
+            flash_source: FlashLoanSource::AaveV3,
+            swap_route: SwapRoute {
+                token_in: Address::ZERO,
+                token_out: Address::ZERO,
+                amount_in: U256::ZERO,
+                min_amount_out: U256::ZERO,
+                pool_fee: 0,
+            },
+            net_profit_usd_cents: net_cents,
+        }
+    }
+
+    #[test]
+    fn pop_returns_highest_profit_first() {
+        let mut q = OpportunityQueue::new(5);
+        q.push(mk_opp(100), 1);
+        q.push(mk_opp(500), 1);
+        q.push(mk_opp(250), 1);
+        assert_eq!(q.pop(1).unwrap().net_profit_usd_cents, 500);
+        assert_eq!(q.pop(1).unwrap().net_profit_usd_cents, 250);
+        assert_eq!(q.pop(1).unwrap().net_profit_usd_cents, 100);
+        assert!(q.pop(1).is_none());
+    }
+
+    #[test]
+    fn stale_entries_are_dropped_on_pop() {
+        let mut q = OpportunityQueue::new(2);
+        q.push(mk_opp(999), 10); // queued at block 10
+        // Current block 13 → age 3 > ttl 2 → stale
+        assert!(q.pop(13).is_none());
+    }
+
+    #[test]
+    fn fresh_survives_ttl_boundary() {
+        let mut q = OpportunityQueue::new(2);
+        q.push(mk_opp(42), 10);
+        // age 2 == ttl 2 → still fresh (ttl is inclusive)
+        assert_eq!(q.pop(12).unwrap().net_profit_usd_cents, 42);
+    }
+
+    #[test]
+    fn prune_stale_drops_old_entries_and_reports_count() {
+        let mut q = OpportunityQueue::new(2);
+        q.push(mk_opp(100), 5);
+        q.push(mk_opp(200), 10);
+        q.push(mk_opp(300), 11);
+        assert_eq!(q.len(), 3);
+        // At block 12: block-5 is 7 (stale), block-10 is 2 (fresh),
+        // block-11 is 1 (fresh). One dropped.
+        let dropped = q.prune_stale(12);
+        assert_eq!(dropped, 1);
+        assert_eq!(q.len(), 2);
+    }
+
+    #[test]
+    fn default_ttl_is_two_blocks() {
+        let q = OpportunityQueue::with_default_ttl();
+        assert_eq!(q.ttl_blocks, DEFAULT_TTL_BLOCKS);
+    }
+}

From f8f01fb5798cd27184d0c8135289ce4aa9900c95 Mon Sep 17 00:00:00 2001
From: obchain <riteshnikhoriya94@gmail.com>
Date: Thu, 23 Apr 2026 15:16:07 +0530
Subject: [PATCH 3/3] feat(core): type-safe profit calc + thread-safe priority
 queue

Rebuild the profit path and opportunity queue end-to-end around
integer units and typed errors so the executor can reason about
failure modes without anyhow string matching.

profit.rs:
- replace anyhow::Result with thiserror ProfitError enum covering
  InvalidBps, InvalidPrice, Overflow, UnsupportedDecimals,
  Unprofitable, BelowMinThreshold
- drop all f64 from the profit path; min_profit threshold is now
  u64 micro-USD matching BotConfig
- add Price (1e8) and from_opportunity constructor that converts
  wei amounts through U256 into USD cents via a per-token Chainlink
  price; collateral and debt priced independently so the formula
  works for non-stable/non-matching markets
- charge slippage against expected_swap_output_cents, not the gross
  bonus, so the budget reflects the swap the bot actually performs
- ProfitInputs, NetProfit, ProfitError all #[non_exhaustive]
- field-level rustdoc documents every unit + conversion path
- tests: u64::MAX overflow on slippage mul, u64::MAX overflow on
  total-cost add, 10_000 bps boundary valid, 10_001 rejected,
  cost > gross, min_profit == 0, zero price rejected, decimals > 18
  rejected, realistic BSC case (1 BNB @ $600 with 10% bonus)

queue.rs:
- wrap BinaryHeap in Arc<tokio::sync::Mutex<_>>; OpportunityQueue
  is Clone + Send + Sync; push/pop/prune/len/is_empty are async
- QueueEntry Ord uses (net_profit_cents, inserted_at_block)
  lexicographic with fresher-first tie-break; manual PartialEq
  mirrors Ord exactly
- saturating_sub on the staleness check keeps entries alive across
  a reorg rewind instead of wrapping to a massive age
- QueueEntry gains #[non_exhaustive]
- tests: tie-break (fresher wins), reorg 105->104 rewind keeps
  entry, pruned entry stays dropped across rewind, 16 concurrent
  producers / 1 consumer with ordering invariant asserted

types.rs:
- LiquidationOpportunity::with_profit(position, .., net_profit)
  constructor that copies net_profit.net_usd_cents into the
  opportunity, eliminating dual representation drift

config.rs + config/default.toml:
- BotConfig.min_profit_usd (f64) -> min_profit_usd_1e6 (u64)
  stored in micro-USD so TOML stays integer-only; executor
  converts to cents internally (/ 10_000)

Closes #146 #147 #148 #149 #150 #151 #152 #153 #154 #155 #156 #157
---
 Cargo.lock                       |   2 +
 Cargo.toml                       |   1 +
 config/default.toml              |   5 +-
 crates/charon-cli/src/main.rs    |   2 +-
 crates/charon-core/Cargo.toml    |   5 +
 crates/charon-core/src/config.rs |   9 +-
 crates/charon-core/src/lib.rs    |   4 +-
 crates/charon-core/src/profit.rs | 656 +++++++++++++++++++++++++------
 crates/charon-core/src/queue.rs  | 297 ++++++++++----
 crates/charon-core/src/types.rs  |  36 ++
 10 files changed, 810 insertions(+), 207 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 06585ba..08161ee 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1145,6 +1145,8 @@ dependencies = [
  "anyhow",
  "async-trait",
  "serde",
+ "thiserror 1.0.69",
+ "tokio",
  "toml",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 2fce7a1..3741a7d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,6 +32,7 @@ tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
 # Error handling
 anyhow = "1"
+thiserror = "1"
 
 # Async trait objects
 async-trait = "0.1"
diff --git a/config/default.toml b/config/default.toml
index 3d9bb3b..c5b4d26 100644
--- a/config/default.toml
+++ b/config/default.toml
@@ -4,8 +4,9 @@
 # load time — see `.env.example` for the full list of expected vars.
 
 [bot]
-# Drop opportunities below this USD profit threshold.
-min_profit_usd   = 5.0
+# Drop opportunities below this profit threshold, in micro-USD (1 USD = 1e6).
+# 5_000_000 = $5.00 minimum. Integer-only so serde / TOML round-trip cleanly.
+min_profit_usd_1e6 = 5_000_000
 # Skip liquidations when gas price exceeds this (gwei).
 max_gas_gwei     = 10
 # Polling cadence for protocols without push events (ms).
diff --git a/crates/charon-cli/src/main.rs b/crates/charon-cli/src/main.rs
index 1496008..d7f03a1 100644
--- a/crates/charon-cli/src/main.rs
+++ b/crates/charon-cli/src/main.rs
@@ -84,7 +84,7 @@ async fn main() -> Result<()> {
         protocols = config.protocol.len(),
         flashloan_sources = config.flashloan.len(),
         liquidators = config.liquidator.len(),
-        min_profit_usd = config.bot.min_profit_usd,
+        min_profit_usd_1e6 = config.bot.min_profit_usd_1e6,
         "config loaded"
     );
 
diff --git a/crates/charon-core/Cargo.toml b/crates/charon-core/Cargo.toml
index d9b3f67..b46fe86 100644
--- a/crates/charon-core/Cargo.toml
+++ b/crates/charon-core/Cargo.toml
@@ -9,5 +9,10 @@ description = "Shared types, traits, and config for Charon"
 alloy = { workspace = true }
 serde = { workspace = true }
 anyhow = { workspace = true }
+thiserror = { workspace = true }
 async-trait = { workspace = true }
 toml = { workspace = true }
+tokio = { workspace = true }
+
+[dev-dependencies]
+tokio = { workspace = true }
diff --git a/crates/charon-core/src/config.rs b/crates/charon-core/src/config.rs
index da9ffe4..83a1cf1 100644
--- a/crates/charon-core/src/config.rs
+++ b/crates/charon-core/src/config.rs
@@ -34,8 +34,13 @@ pub struct Config {
 /// Bot-level knobs — thresholds and intervals.
 #[derive(Debug, Clone, Deserialize)]
 pub struct BotConfig {
-    /// Drop opportunities below this USD profit threshold.
-    pub min_profit_usd: f64,
+    /// Drop opportunities below this profit threshold, in **micro-USD**
+    /// (1 USD = 1e6). Stored as `u64` so the TOML stays integer-only
+    /// and the value round-trips through serde without float surprises.
+    ///
+    /// Example: `5_000_000` = $5.00 minimum. The profit calculator
+    /// converts this to cents (`/ 10_000`) internally.
+    pub min_profit_usd_1e6: u64,
     /// Skip liquidations when gas price exceeds this (gwei).
     pub max_gas_gwei: u64,
     /// Polling interval for protocols that don't push events.
diff --git a/crates/charon-core/src/lib.rs b/crates/charon-core/src/lib.rs
index 0c8ab52..a181f4d 100644
--- a/crates/charon-core/src/lib.rs
+++ b/crates/charon-core/src/lib.rs
@@ -9,8 +9,8 @@ pub mod types;
 
 pub use config::Config;
 pub use flashloan::{FlashLoanProvider, FlashLoanQuote};
-pub use profit::{NetProfit, ProfitInputs, calculate_profit};
-pub use queue::{DEFAULT_TTL_BLOCKS, OpportunityQueue};
+pub use profit::{NetProfit, Price, ProfitError, ProfitInputs, calculate_profit};
+pub use queue::{DEFAULT_TTL_BLOCKS, OpportunityQueue, QueueEntry};
 pub use traits::LendingProtocol;
 pub use types::{
     FlashLoanSource, LiquidationOpportunity, LiquidationParams, Position, ProtocolId, SwapRoute,
diff --git a/crates/charon-core/src/profit.rs b/crates/charon-core/src/profit.rs
index 138d997..3140957 100644
--- a/crates/charon-core/src/profit.rs
+++ b/crates/charon-core/src/profit.rs
@@ -1,44 +1,159 @@
 //! Gas-aware profit calculator.
 //!
-//! Sits between the scanner (surfaces a liquidatable `Position`) and the
-//! router (picks a flash-loan source): given a candidate liquidation
-//! priced entirely in USD cents — plus the configured `min_profit_usd`
-//! threshold — decide whether it's worth building a transaction for.
+//! Sits between the scanner (surfaces a liquidatable [`Position`]) and
+//! the router (picks a flash-loan source): given a candidate liquidation
+//! priced entirely in USD cents plus the configured
+//! `min_profit_usd_1e6` threshold, decide whether it is worth building a
+//! transaction for.
 //!
-//! Everything is in USD cents (u64). Integer math throughout so we
-//! don't accumulate float error across the hot path; conversion from
-//! on-chain amounts happens once at the caller using the price cache.
+//! # Unit discipline
+//!
+//! Everything inside the calculator is expressed in **USD cents (`u64`)**.
+//! Integer math throughout so we do not accumulate float error across
+//! the hot path. All wei-scale arithmetic happens exactly once inside
+//! [`ProfitInputs::from_opportunity`], where on-chain token amounts are
+//! folded into cents through a Chainlink-style 1e8 [`Price`].
+//!
+//! Cents are chosen (not micro-USD) because they fit comfortably in
+//! `u64` up to roughly `1.8e17` USD — enough for any single liquidation.
+//! The config threshold is stored in **micro-USD (`1e6`)** so the TOML
+//! stays integer-only and round-trips through serde without float
+//! surprises; conversion to cents is `micro / 10_000` and happens in the
+//! executor when it calls [`calculate_profit`].
+//!
+//! # Profit formula
 //!
 //! ```text
-//! gross      = repay_usd × liquidation_bonus_bps / 10_000
-//! slippage   = gross      × slippage_bps          / 10_000
-//! net        = gross − flash_fee − gas − slippage
+//! gross_collateral_cents =
+//!     expected_collateral_out_wei * collateral_price_1e8
+//!         / 10^collateral_decimals / 1e6
+//!
+//! # Per-token USD is derived directly from Chainlink prices; the
+//! # formula is *not* `repay * bonus / 10_000` — that form only holds
+//! # when collateral and debt are the same asset (stable/stable).
+//!
+//! slippage_cents = expected_swap_output_cents * slippage_bps / 10_000
+//! net_cents      = gross_collateral_cents
+//!                 - flash_fee_cents - gas_cost_cents - slippage_cents
 //! ```
+//!
+//! Slippage is charged against the **DEX swap output** (seized
+//! collateral -> debt token), not the gross bonus — losing 0.5% on a
+//! $10 000 swap is $50, not 0.5% of the $1 000 bonus.
 
-use anyhow::Result;
+use alloy::primitives::U256;
 use serde::{Deserialize, Serialize};
+use thiserror::Error;
+
+use crate::types::LiquidationOpportunity;
+
+/// Chainlink-style 1e8 price of one whole token, in USD.
+///
+/// BSC-native Chainlink aggregators report `int256` answers with 8
+/// decimals. We normalise to `u64` here — any feed that returns a
+/// negative answer is a feed fault and must be rejected upstream before
+/// this type is constructed.
+///
+/// `usd_1e8 = 6 * 10^10` means 1 token = $600.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
+pub struct Price {
+    /// USD value of 1 whole token, scaled by `1e8`.
+    pub usd_1e8: u64,
+}
+
+impl Price {
+    /// Construct a price; rejects zero/malformed feeds.
+    pub fn new(usd_1e8: u64) -> Result<Self, ProfitError> {
+        if usd_1e8 == 0 {
+            return Err(ProfitError::InvalidPrice);
+        }
+        Ok(Self { usd_1e8 })
+    }
+}
+
+/// Hard-typed errors from the profit calculator.
+///
+/// Every negative outcome the executor can plausibly react to is a
+/// distinct variant — no `anyhow` `String` matching in the hot path.
+#[derive(Debug, Clone, PartialEq, Eq, Error)]
+#[non_exhaustive]
+pub enum ProfitError {
+    /// A basis-points input exceeds `10_000` (100%).
+    #[error("basis-points value {0} exceeds 10_000 (100%)")]
+    InvalidBps(u16),
+    /// Price feed produced zero or malformed output.
+    #[error("price feed reported a zero or invalid value")]
+    InvalidPrice,
+    /// Unsigned arithmetic would have wrapped.
+    #[error("arithmetic overflow while computing profit")]
+    Overflow,
+    /// Token decimals exceed the supported range (0..=18).
+    #[error("unsupported token decimals {0} (must be <= 18)")]
+    UnsupportedDecimals(u8),
+    /// Total cost swallows the gross bonus — liquidation is unprofitable.
+    #[error(
+        "unprofitable: gross={gross_cents} cents <= total_cost={total_cost_cents} cents \
+         (flash_fee={flash_fee_cents}, gas={gas_cost_cents}, slippage={slippage_cents})"
+    )]
+    Unprofitable {
+        gross_cents: u64,
+        total_cost_cents: u64,
+        flash_fee_cents: u64,
+        gas_cost_cents: u64,
+        slippage_cents: u64,
+    },
+    /// Net profit is positive but below the configured threshold.
+    #[error("below threshold: net={net_cents} cents < min={min_cents} cents")]
+    BelowMinThreshold { net_cents: u64, min_cents: u64 },
+}
 
 /// Everything the calculator needs, already converted to USD cents.
-#[derive(Debug, Clone, Copy)]
+///
+/// Construct via [`ProfitInputs::from_opportunity`] whenever possible;
+/// the direct literal form is kept only for tests and callers who have
+/// already priced the opportunity themselves.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[non_exhaustive]
 pub struct ProfitInputs {
-    /// Debt the bot will repay (and therefore also the flash-loan
-    /// amount), expressed in USD cents after price-cache lookup.
-    pub repay_amount_usd_cents: u64,
-    /// Liquidation bonus paid on top of the seized collateral, in
-    /// basis points. Venus is `1000` (10%) on most markets.
-    pub liquidation_bonus_bps: u16,
-    /// Absolute flash-loan fee in USD cents
-    /// (`amount_usd × fee_bps / 10_000` at the call site).
-    pub flash_fee_usd_cents: u64,
-    /// Expected gas cost for the liquidation tx in USD cents.
-    pub gas_cost_usd_cents: u64,
-    /// DEX swap slippage to budget for, in basis points on the gross
-    /// profit (`50` = 0.5% of gross).
+    /// Gross USD value of the **collateral the bot will seize**, after
+    /// applying `liquidation_bonus_bps`. In USD cents.
+    ///
+    /// Example: repaying $1 000 of debt against a 10% bonus on an
+    /// equal-priced collateral => `gross_collateral_cents = 110_000`
+    /// (i.e. $1 100).
+    pub gross_collateral_cents: u64,
+    /// Expected DEX output (collateral -> debt token) in USD cents.
+    ///
+    /// Slippage is charged against **this** value, not the gross
+    /// collateral — the bot only loses slippage on the swap it
+    /// actually performs. Usually very close to
+    /// `gross_collateral_cents`, a hair lower because the DEX quote
+    /// already reflects pool curvature.
+    pub expected_swap_output_cents: u64,
+    /// Absolute flash-loan fee in USD cents.
+    ///
+    /// Converted from the provider quote (`fee_wei * debt_price / 10^decimals`)
+    /// inside [`ProfitInputs::from_opportunity`]. Aave V3 on BSC is
+    /// `fee_bps = 5` (0.05%) — a $1 000 borrow costs 50 cents.
+    pub flash_fee_cents: u64,
+    /// Expected gas cost for the full liquidation tx in USD cents.
+    ///
+    /// Computed off-chain as
+    /// `gas_units * effective_gas_price * native_price / 10^18 / 1e6`.
+    pub gas_cost_cents: u64,
+    /// DEX swap slippage to budget for, in basis points applied to
+    /// `expected_swap_output_cents`. `50` = 0.5%.
     pub slippage_bps: u16,
 }
 
 /// Itemised profit breakdown returned on success.
+///
+/// All fields are USD cents (`u64`). [`NetProfit::net_usd`] /
+/// [`NetProfit::gross_usd`] are floating-point convenience accessors
+/// for logging only — do not feed them back into the profit path.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[non_exhaustive]
 pub struct NetProfit {
     pub gross_usd_cents: u64,
     pub flash_fee_usd_cents: u64,
@@ -48,154 +163,449 @@ pub struct NetProfit {
 }
 
 impl NetProfit {
+    /// Net profit as USD (display-only; precision is still cents).
     pub fn net_usd(&self) -> f64 {
-        self.net_usd_cents as f64 / 100.0
+        (self.net_usd_cents as f64) / 100.0
     }
+    /// Gross collateral seized, as USD (display-only).
     pub fn gross_usd(&self) -> f64 {
-        self.gross_usd_cents as f64 / 100.0
+        (self.gross_usd_cents as f64) / 100.0
+    }
+}
+
+/// 10^n for n in 0..=18 — pre-computed so the decimals path never
+/// allocates and never panics on overflow.
+const POW10: [u128; 19] = [
+    1,
+    10,
+    100,
+    1_000,
+    10_000,
+    100_000,
+    1_000_000,
+    10_000_000,
+    100_000_000,
+    1_000_000_000,
+    10_000_000_000,
+    100_000_000_000,
+    1_000_000_000_000,
+    10_000_000_000_000,
+    100_000_000_000_000,
+    1_000_000_000_000_000,
+    10_000_000_000_000_000,
+    100_000_000_000_000_000,
+    1_000_000_000_000_000_000,
+];
+
+/// Convert `amount_wei` of a token with `decimals` at `price` into USD
+/// cents.
+///
+/// ```text
+/// cents = amount_wei * usd_1e8 / 10^decimals / 10^6
+/// ```
+///
+/// Performed in `U256` so an 18-decimal BEP-20 at trillion-dollar scale
+/// still cannot overflow. The final cents value is range-checked to fit
+/// `u64` — anything larger is a faulty input and returns
+/// [`ProfitError::Overflow`].
+fn wei_to_cents(amount_wei: U256, price: Price, decimals: u8) -> Result<u64, ProfitError> {
+    if (decimals as usize) >= POW10.len() {
+        return Err(ProfitError::UnsupportedDecimals(decimals));
+    }
+    // scale = 10^decimals * 10^6   (divide by 10^decimals to get whole
+    //                               tokens; divide by 10^6 to move from
+    //                               1e8-priced USD down to cents/1e2.)
+    let pow_dec = U256::from(POW10[decimals as usize]);
+    let pow_6 = U256::from(1_000_000u64);
+    let scale = pow_dec.checked_mul(pow_6).ok_or(ProfitError::Overflow)?;
+    let numerator = amount_wei
+        .checked_mul(U256::from(price.usd_1e8))
+        .ok_or(ProfitError::Overflow)?;
+    // scale >= 1e6 (non-zero) so division cannot panic.
+    let cents_u256 = numerator / scale;
+    let cents: u64 = cents_u256.try_into().map_err(|_| ProfitError::Overflow)?;
+    Ok(cents)
+}
+
+impl ProfitInputs {
+    /// Construct [`ProfitInputs`] from a fully-priced
+    /// [`LiquidationOpportunity`] plus live feed data.
+    ///
+    /// # Inputs
+    ///
+    /// - `opportunity` — the candidate, in native wei-scale units.
+    /// - `collateral_price` / `debt_price` — Chainlink-style 1e8 prices.
+    /// - `collateral_decimals` / `debt_decimals` — BEP-20 decimals
+    ///   (must be `<= 18`).
+    /// - `expected_swap_output_wei` — DEX router quote for the seized
+    ///   collateral -> debt swap, in debt-token wei. Slippage is
+    ///   applied to this.
+    /// - `flash_fee_wei` — absolute flash-loan fee denominated in the
+    ///   debt token's wei (matches `FlashLoanQuote::fee`).
+    /// - `gas_cost_cents` — pre-computed gas budget for the whole tx.
+    /// - `slippage_bps` — DEX slippage budget (applied to swap output).
+    ///
+    /// # Unit path
+    ///
+    /// 1. `collateral_wei * collateral_price -> gross_collateral_cents`
+    /// 2. `swap_output_wei * debt_price      -> expected_swap_output_cents`
+    /// 3. `flash_fee_wei   * debt_price      -> flash_fee_cents`
+    ///
+    /// All three conversions go through [`wei_to_cents`], which stays
+    /// in `U256` until the very last `try_into::<u64>()`.
+    #[allow(clippy::too_many_arguments)]
+    pub fn from_opportunity(
+        opportunity: &LiquidationOpportunity,
+        collateral_price: Price,
+        debt_price: Price,
+        collateral_decimals: u8,
+        debt_decimals: u8,
+        expected_swap_output_wei: U256,
+        flash_fee_wei: U256,
+        gas_cost_cents: u64,
+        slippage_bps: u16,
+    ) -> Result<Self, ProfitError> {
+        if slippage_bps > 10_000 {
+            return Err(ProfitError::InvalidBps(slippage_bps));
+        }
+        if opportunity.position.liquidation_bonus_bps > 10_000 {
+            return Err(ProfitError::InvalidBps(
+                opportunity.position.liquidation_bonus_bps,
+            ));
+        }
+
+        // Gross collateral seized = expected_collateral_out priced at
+        // the collateral feed. The on-chain liquidation flow already
+        // writes expected_collateral_out = debt_repaid * bonus /
+        // collateral_price; we price it here directly.
+        let gross_collateral_cents = wei_to_cents(
+            opportunity.expected_collateral_out,
+            collateral_price,
+            collateral_decimals,
+        )?;
+
+        let expected_swap_output_cents =
+            wei_to_cents(expected_swap_output_wei, debt_price, debt_decimals)?;
+
+        let flash_fee_cents = wei_to_cents(flash_fee_wei, debt_price, debt_decimals)?;
+
+        Ok(Self {
+            gross_collateral_cents,
+            expected_swap_output_cents,
+            flash_fee_cents,
+            gas_cost_cents,
+            slippage_bps,
+        })
     }
 }
 
 /// Compute net profit for a candidate liquidation.
 ///
 /// Returns `Err` whenever the liquidation is unprofitable — either the
-/// total cost (flash fee + gas + slippage) swallows the gross bonus,
-/// or the net falls below `min_profit_usd`. The caller is expected to
+/// total cost (flash fee + gas + slippage) swallows the gross bonus, or
+/// the net falls below `min_profit_usd_1e6`. The caller is expected to
 /// drop the opportunity on `Err`; no partial state is ever emitted.
-pub fn calculate_profit(inputs: &ProfitInputs, min_profit_usd: f64) -> Result<NetProfit> {
-    // Validate bps inputs up-front; out-of-range values would silently
-    // distort the math without panicking.
-    if inputs.liquidation_bonus_bps > 10_000 {
-        anyhow::bail!(
-            "liquidation_bonus_bps {} exceeds 100% (10_000 bps)",
-            inputs.liquidation_bonus_bps
-        );
-    }
+///
+/// `min_profit_usd_1e6` is in **micro-USD** to match
+/// [`crate::config::BotConfig::min_profit_usd_1e6`]. It is converted to
+/// cents (`/ 10_000`) internally.
+pub fn calculate_profit(
+    inputs: &ProfitInputs,
+    min_profit_usd_1e6: u64,
+) -> Result<NetProfit, ProfitError> {
     if inputs.slippage_bps > 10_000 {
-        anyhow::bail!(
-            "slippage_bps {} exceeds 100% (10_000 bps)",
-            inputs.slippage_bps
-        );
-    }
-
-    // gross = repay × bonus_bps / 10_000
-    let gross = inputs
-        .repay_amount_usd_cents
-        .checked_mul(inputs.liquidation_bonus_bps as u64)
-        .ok_or_else(|| anyhow::anyhow!("profit: gross multiplication overflow"))?
-        / 10_000;
-
-    let slippage = gross
-        .checked_mul(inputs.slippage_bps as u64)
-        .ok_or_else(|| anyhow::anyhow!("profit: slippage multiplication overflow"))?
-        / 10_000;
-
-    let total_cost = inputs
-        .flash_fee_usd_cents
-        .checked_add(inputs.gas_cost_usd_cents)
-        .and_then(|v| v.checked_add(slippage))
-        .ok_or_else(|| anyhow::anyhow!("profit: total-cost addition overflow"))?;
-
-    if gross <= total_cost {
-        anyhow::bail!(
-            "unprofitable: gross={:.2} ≤ total_cost={:.2} (flash_fee={:.2}, gas={:.2}, slippage={:.2})",
-            cents_to_usd(gross),
-            cents_to_usd(total_cost),
-            cents_to_usd(inputs.flash_fee_usd_cents),
-            cents_to_usd(inputs.gas_cost_usd_cents),
-            cents_to_usd(slippage)
-        );
-    }
-
-    let net = gross - total_cost;
-    let min_cents = (min_profit_usd.max(0.0) * 100.0) as u64;
-    if net < min_cents {
-        anyhow::bail!(
-            "below threshold: net={:.2} < min_profit_usd={:.2}",
-            cents_to_usd(net),
-            min_profit_usd
-        );
+        return Err(ProfitError::InvalidBps(inputs.slippage_bps));
+    }
+
+    // Slippage is charged on the DEX swap output, not on gross seized
+    // collateral — the bot only pays slippage on the swap it performs.
+    let slippage_mul = inputs
+        .expected_swap_output_cents
+        .checked_mul(u64::from(inputs.slippage_bps))
+        .ok_or(ProfitError::Overflow)?;
+    // 10_000 is a non-zero constant so the division is infallible.
+    let slippage_cents = slippage_mul / 10_000;
+
+    let total_cost_cents = inputs
+        .flash_fee_cents
+        .checked_add(inputs.gas_cost_cents)
+        .and_then(|v| v.checked_add(slippage_cents))
+        .ok_or(ProfitError::Overflow)?;
+
+    let gross_cents = inputs.gross_collateral_cents;
+
+    if gross_cents <= total_cost_cents {
+        return Err(ProfitError::Unprofitable {
+            gross_cents,
+            total_cost_cents,
+            flash_fee_cents: inputs.flash_fee_cents,
+            gas_cost_cents: inputs.gas_cost_cents,
+            slippage_cents,
+        });
+    }
+
+    // gross > total_cost (checked above); use checked_sub to keep the
+    // invariant local to the subtraction and satisfy
+    // arithmetic_side_effects lints.
+    let net_cents = gross_cents
+        .checked_sub(total_cost_cents)
+        .ok_or(ProfitError::Overflow)?;
+
+    // 1 USD = 1e6 micro-USD = 100 cents => cents = micro / 10_000.
+    // Integer division rounds down, which biases the threshold *up*
+    // slightly (stricter, never looser — correct direction).
+    let min_cents = min_profit_usd_1e6 / 10_000;
+    if net_cents < min_cents {
+        return Err(ProfitError::BelowMinThreshold {
+            net_cents,
+            min_cents,
+        });
     }
 
     Ok(NetProfit {
-        gross_usd_cents: gross,
-        flash_fee_usd_cents: inputs.flash_fee_usd_cents,
-        gas_cost_usd_cents: inputs.gas_cost_usd_cents,
-        slippage_usd_cents: slippage,
-        net_usd_cents: net,
+        gross_usd_cents: gross_cents,
+        flash_fee_usd_cents: inputs.flash_fee_cents,
+        gas_cost_usd_cents: inputs.gas_cost_cents,
+        slippage_usd_cents: slippage_cents,
+        net_usd_cents: net_cents,
     })
 }
 
-fn cents_to_usd(cents: u64) -> f64 {
-    cents as f64 / 100.0
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::types::{FlashLoanSource, LiquidationOpportunity, Position, ProtocolId, SwapRoute};
+    use alloy::primitives::{Address, U256, address};
 
     fn typical_inputs() -> ProfitInputs {
-        // $1000 debt, 10% bonus → $100 gross.
+        // $1 000 debt, 10% bonus => $1 100 gross collateral.
+        // Swap output ~= $1 090 (pool curvature); 50 bps = $5.45.
         ProfitInputs {
-            repay_amount_usd_cents: 100_000,
-            liquidation_bonus_bps: 1_000,
-            flash_fee_usd_cents: 50, // $0.50 (Aave V3 0.05% on $1000)
-            gas_cost_usd_cents: 200, // $2 gas
-            slippage_bps: 50,        // 0.5% of gross = $0.50
+            gross_collateral_cents: 110_000,
+            expected_swap_output_cents: 109_000,
+            flash_fee_cents: 50, // $0.50 (Aave V3 0.05% on $1 000)
+            gas_cost_cents: 200, // $2 gas
+            slippage_bps: 50,    // 0.5% of swap output
         }
     }
 
     #[test]
     fn healthy_liquidation_is_profitable() {
-        let np = calculate_profit(&typical_inputs(), 5.0).expect("profitable");
-        assert_eq!(np.gross_usd_cents, 10_000); // $100
-        assert_eq!(np.slippage_usd_cents, 50);
-        // net = 10_000 − 50 (fee) − 200 (gas) − 50 (slippage) = 9_700
-        assert_eq!(np.net_usd_cents, 9_700);
+        let np = calculate_profit(&typical_inputs(), 5_000_000).expect("profitable");
+        assert_eq!(np.gross_usd_cents, 110_000);
+        // slippage = 109_000 * 50 / 10_000 = 545
+        assert_eq!(np.slippage_usd_cents, 545);
+        // net = 110_000 - 50 - 200 - 545 = 109_205
+        assert_eq!(np.net_usd_cents, 109_205);
     }
 
     #[test]
     fn below_threshold_is_rejected() {
-        let inputs = typical_inputs();
-        let err = calculate_profit(&inputs, 200.0).expect_err("should reject");
-        assert!(format!("{err:#}").contains("below threshold"));
+        let err = calculate_profit(&typical_inputs(), 2_000_000_000).expect_err("should reject");
+        assert!(matches!(err, ProfitError::BelowMinThreshold { .. }));
     }
 
     #[test]
     fn cost_greater_than_gross_is_rejected() {
         let inputs = ProfitInputs {
-            repay_amount_usd_cents: 1_000,
-            liquidation_bonus_bps: 1_000, // $1 debt × 10% = $0.10 gross
-            flash_fee_usd_cents: 1,
-            gas_cost_usd_cents: 200, // $2 gas eats the whole thing
+            gross_collateral_cents: 10, // $0.10 gross
+            expected_swap_output_cents: 10,
+            flash_fee_cents: 1,
+            gas_cost_cents: 200,
             slippage_bps: 50,
         };
-        let err = calculate_profit(&inputs, 0.0).expect_err("unprofitable");
-        assert!(format!("{err:#}").contains("unprofitable"));
+        let err = calculate_profit(&inputs, 0).expect_err("unprofitable");
+        assert!(matches!(err, ProfitError::Unprofitable { .. }));
     }
 
     #[test]
-    fn bogus_bps_values_are_rejected() {
+    fn bogus_slippage_bps_is_rejected() {
         let mut inputs = typical_inputs();
-        inputs.liquidation_bonus_bps = 20_000;
-        assert!(calculate_profit(&inputs, 0.0).is_err());
-
-        inputs = typical_inputs();
         inputs.slippage_bps = 20_000;
-        assert!(calculate_profit(&inputs, 0.0).is_err());
+        assert!(matches!(
+            calculate_profit(&inputs, 0),
+            Err(ProfitError::InvalidBps(20_000))
+        ));
+    }
+
+    #[test]
+    fn slippage_bps_boundary_10_000_is_accepted_and_10_001_rejected() {
+        let mut inputs = typical_inputs();
+        // 10_000 bps = 100% slippage — numerically valid input; it may
+        // render the trade unprofitable, but the bps check itself must
+        // pass.
+        inputs.slippage_bps = 10_000;
+        // 10_000 bps = 100% of expected_swap_output. With
+        // gross=$1 100 and swap_output=$1 090 that still leaves
+        // $1 100 - $10.90 slippage - $0.50 fee - $2 gas = $7.50 net,
+        // so the calculator accepts it. The point of the boundary
+        // test is that 10_000 is a *valid* bps input (no InvalidBps).
+        let np = calculate_profit(&inputs, 0).expect("10_000 bps is valid input");
+        assert_eq!(np.slippage_usd_cents, inputs.expected_swap_output_cents);
+
+        inputs.slippage_bps = 10_001;
+        assert!(matches!(
+            calculate_profit(&inputs, 0),
+            Err(ProfitError::InvalidBps(10_001))
+        ));
     }
 
     #[test]
-    fn zero_threshold_accepts_any_positive_net() {
-        // Gross = $1, costs = $0.50 total → net = $0.50 > $0 threshold
+    fn min_profit_zero_accepts_any_positive_net() {
         let inputs = ProfitInputs {
-            repay_amount_usd_cents: 1_000,
-            liquidation_bonus_bps: 1_000,
-            flash_fee_usd_cents: 30,
-            gas_cost_usd_cents: 15,
+            gross_collateral_cents: 1_000,
+            expected_swap_output_cents: 1_000,
+            flash_fee_cents: 30,
+            gas_cost_cents: 15,
             slippage_bps: 50,
         };
-        let np = calculate_profit(&inputs, 0.0).expect("profitable");
+        let np = calculate_profit(&inputs, 0).expect("profitable");
         assert!(np.net_usd_cents > 0);
     }
+
+    #[test]
+    fn u64_max_gross_does_not_overflow_slippage_path() {
+        // The slippage path multiplies by up to 10_000 before dividing.
+        // u64::MAX * 10_000 *would* wrap — so we expect Overflow, not a
+        // silent truncation.
+        let inputs = ProfitInputs {
+            gross_collateral_cents: u64::MAX,
+            expected_swap_output_cents: u64::MAX,
+            flash_fee_cents: 0,
+            gas_cost_cents: 0,
+            slippage_bps: 50,
+        };
+        assert!(matches!(
+            calculate_profit(&inputs, 0),
+            Err(ProfitError::Overflow)
+        ));
+    }
+
+    #[test]
+    fn total_cost_addition_overflow_is_reported() {
+        let inputs = ProfitInputs {
+            gross_collateral_cents: u64::MAX,
+            expected_swap_output_cents: 0, // skip the slippage branch
+            flash_fee_cents: u64::MAX,
+            gas_cost_cents: 1, // u64::MAX + 1 -> overflow
+            slippage_bps: 0,
+        };
+        assert!(matches!(
+            calculate_profit(&inputs, 0),
+            Err(ProfitError::Overflow)
+        ));
+    }
+
+    // ── from_opportunity / wei->cents path ──────────────────────────
+
+    fn mk_opp(
+        collateral_amount: U256,
+        debt_amount: U256,
+        bonus_bps: u16,
+    ) -> LiquidationOpportunity {
+        LiquidationOpportunity {
+            position: Position {
+                protocol: ProtocolId::Venus,
+                chain_id: 56,
+                borrower: address!("1111111111111111111111111111111111111111"),
+                collateral_token: Address::ZERO,
+                debt_token: Address::ZERO,
+                collateral_amount,
+                debt_amount,
+                health_factor: U256::ZERO,
+                liquidation_bonus_bps: bonus_bps,
+            },
+            debt_to_repay: debt_amount,
+            expected_collateral_out: collateral_amount,
+            flash_source: FlashLoanSource::AaveV3,
+            swap_route: SwapRoute {
+                token_in: Address::ZERO,
+                token_out: Address::ZERO,
+                amount_in: collateral_amount,
+                min_amount_out: debt_amount,
+                pool_fee: 0,
+            },
+            net_profit_usd_cents: 0,
+        }
+    }
+
+    #[test]
+    fn bsc_bnb_one_token_at_600_usd_prices_to_600_dollars() {
+        // 1 BNB repay, matching-asset collateral, 10% bonus, $600 price
+        let one_bnb = U256::from(1_000_000_000_000_000_000u128);
+        let one_point_one_bnb = one_bnb * U256::from(11u64) / U256::from(10u64);
+        let opp = mk_opp(one_point_one_bnb, one_bnb, 1_000);
+        let price = Price::new(60_000_000_000).expect("valid"); // $600
+
+        // Swap output ~= 1.1 BNB worth of debt; flash fee = 0.05% of
+        // 1 BNB = 0.0005 BNB.
+        let flash_fee_wei = one_bnb / U256::from(2_000u64);
+
+        let inputs = ProfitInputs::from_opportunity(
+            &opp,
+            price,
+            price,
+            18,
+            18,
+            one_point_one_bnb,
+            flash_fee_wei,
+            200,
+            50,
+        )
+        .expect("valid");
+
+        assert_eq!(inputs.gross_collateral_cents, 66_000); // $660 = 1.1 * $600
+        assert_eq!(inputs.expected_swap_output_cents, 66_000);
+        assert_eq!(inputs.flash_fee_cents, 30); // 0.0005 BNB * $600 = $0.30
+
+        let np = calculate_profit(&inputs, 0).expect("profitable");
+        // slippage = 66_000 * 50 / 10_000 = 330
+        // net = 66_000 - 30 - 200 - 330 = 65_440  (~ $654)
+        assert_eq!(np.net_usd_cents, 65_440);
+    }
+
+    #[test]
+    fn zero_price_is_rejected() {
+        assert!(matches!(Price::new(0), Err(ProfitError::InvalidPrice)));
+    }
+
+    #[test]
+    fn decimals_above_18_are_rejected() {
+        let opp = mk_opp(U256::from(1u64), U256::from(1u64), 1_000);
+        let price = Price::new(60_000_000_000).expect("valid");
+        assert!(matches!(
+            ProfitInputs::from_opportunity(
+                &opp,
+                price,
+                price,
+                19, // invalid
+                18,
+                U256::from(1u64),
+                U256::from(0u64),
+                0,
+                0,
+            ),
+            Err(ProfitError::UnsupportedDecimals(19))
+        ));
+    }
+
+    #[test]
+    fn position_bonus_bps_above_10_000_is_rejected_in_constructor() {
+        let opp = mk_opp(U256::from(1u64), U256::from(1u64), 10_001);
+        let price = Price::new(60_000_000_000).expect("valid");
+        assert!(matches!(
+            ProfitInputs::from_opportunity(
+                &opp,
+                price,
+                price,
+                18,
+                18,
+                U256::from(1u64),
+                U256::from(0u64),
+                0,
+                0,
+            ),
+            Err(ProfitError::InvalidBps(10_001))
+        ));
+    }
 }
diff --git a/crates/charon-core/src/queue.rs b/crates/charon-core/src/queue.rs
index c6706e6..78626a0 100644
--- a/crates/charon-core/src/queue.rs
+++ b/crates/charon-core/src/queue.rs
@@ -6,32 +6,64 @@
 //! `ttl_blocks` (default 2) — stale quotes are priced against stale
 //! balances and usually revert on `eth_call` anyway.
 //!
-//! Backed by `std::collections::BinaryHeap`. Ordering is defined on a
-//! private `QueueEntry` wrapper so we don't put `Ord` on the public
-//! `LiquidationOpportunity` type (which already derives `Serialize`
-//! and could pick up unrelated semantics from a natural ordering).
+//! The queue is `Send + Sync` and cloneable: it wraps a
+//! `std::collections::BinaryHeap` inside a [`tokio::sync::Mutex`] inside
+//! an `Arc` so a single `OpportunityQueue` handle can be shared across
+//! the block listener, scanner, and executor tasks.
+//!
+//! # Ordering
+//!
+//! The heap is keyed on a private [`QueueEntry`] wrapper so we do not
+//! hang `Ord` off the public [`LiquidationOpportunity`] type (which
+//! derives `Serialize` and could pick up unrelated semantics from a
+//! natural ordering). Ordering is lexicographic:
+//!
+//! 1. **net profit (cents), descending** — most profitable first.
+//! 2. **inserted_at_block, descending** — on a tie, the fresher entry
+//!    wins. This matters around reorgs, where two
+//!    identically-priced entries may land on either side of a
+//!    re-seen block; the fresher one is strictly better because its
+//!    balance / price snapshot is younger.
+//!
+//! Manual `PartialEq` / `Eq` mirror `Ord` exactly so the
+//! heap's invariants hold even after `retain`-style surgery.
 
 use std::cmp::Ordering;
 use std::collections::BinaryHeap;
+use std::sync::Arc;
+
+use tokio::sync::Mutex;
 
 use crate::types::LiquidationOpportunity;
 
-/// Default TTL, in blocks. Two blocks ≈ 6 s on BSC — long enough to
+/// Default TTL, in blocks. Two blocks ~= 6 s on BSC — long enough to
 /// survive one routing round-trip but short enough that stale quotes
 /// don't pile up.
 pub const DEFAULT_TTL_BLOCKS: u64 = 2;
 
-/// Heap wrapper — compares by `net_profit_usd_cents` so the root of
-/// the `BinaryHeap` (max-heap) is the most profitable opportunity.
+/// Heap wrapper — compares by `net_profit_usd_cents` first, then by
+/// `inserted_at_block` (fresher wins). See the module docs.
 #[derive(Debug, Clone)]
-struct QueueEntry {
-    opportunity: LiquidationOpportunity,
-    queued_at_block: u64,
+#[non_exhaustive]
+pub struct QueueEntry {
+    pub opportunity: LiquidationOpportunity,
+    /// Block height at which this entry was enqueued — drives both TTL
+    /// expiry and the Ord tie-break.
+    pub inserted_at_block: u64,
+}
+
+impl QueueEntry {
+    fn sort_key(&self) -> (u64, u64) {
+        (
+            self.opportunity.net_profit_usd_cents,
+            self.inserted_at_block,
+        )
+    }
 }
 
 impl PartialEq for QueueEntry {
     fn eq(&self, other: &Self) -> bool {
-        self.opportunity.net_profit_usd_cents == other.opportunity.net_profit_usd_cents
+        self.sort_key() == other.sort_key()
     }
 }
 impl Eq for QueueEntry {}
@@ -42,53 +74,68 @@ impl PartialOrd for QueueEntry {
 }
 impl Ord for QueueEntry {
     fn cmp(&self, other: &Self) -> Ordering {
-        self.opportunity
-            .net_profit_usd_cents
-            .cmp(&other.opportunity.net_profit_usd_cents)
+        // BinaryHeap is a max-heap, so (larger net_profit, larger
+        // inserted_at_block) pops first. "Larger block" == "fresher".
+        self.sort_key().cmp(&other.sort_key())
     }
 }
 
-/// Priority queue of ready-to-execute liquidations.
+/// Thread-safe priority queue of ready-to-execute liquidations.
+///
+/// Clone to hand a new handle to another task — all handles share the
+/// same underlying heap.
+#[derive(Clone, Debug)]
 pub struct OpportunityQueue {
-    heap: BinaryHeap<QueueEntry>,
+    inner: Arc<Mutex<BinaryHeap<QueueEntry>>>,
     ttl_blocks: u64,
 }
 
 impl OpportunityQueue {
+    /// Create a new queue with an explicit TTL, in blocks.
     pub fn new(ttl_blocks: u64) -> Self {
         Self {
-            heap: BinaryHeap::new(),
+            inner: Arc::new(Mutex::new(BinaryHeap::new())),
             ttl_blocks,
         }
     }
 
+    /// Create a new queue with [`DEFAULT_TTL_BLOCKS`].
     pub fn with_default_ttl() -> Self {
         Self::new(DEFAULT_TTL_BLOCKS)
     }
 
-    pub fn len(&self) -> usize {
-        self.heap.len()
+    /// TTL this queue was constructed with.
+    pub fn ttl_blocks(&self) -> u64 {
+        self.ttl_blocks
     }
 
-    pub fn is_empty(&self) -> bool {
-        self.heap.is_empty()
+    /// Current number of entries (stale entries included — run
+    /// [`prune_stale`](Self::prune_stale) first to exclude them).
+    pub async fn len(&self) -> usize {
+        self.inner.lock().await.len()
+    }
+
+    /// `true` when the heap is empty.
+    pub async fn is_empty(&self) -> bool {
+        self.inner.lock().await.is_empty()
     }
 
     /// Enqueue a freshly-priced opportunity, tagged with the block it
     /// was queued at (for TTL accounting).
-    pub fn push(&mut self, opportunity: LiquidationOpportunity, queued_at_block: u64) {
-        self.heap.push(QueueEntry {
+    pub async fn push(&self, opportunity: LiquidationOpportunity, inserted_at_block: u64) {
+        self.inner.lock().await.push(QueueEntry {
             opportunity,
-            queued_at_block,
+            inserted_at_block,
         });
     }
 
     /// Pop the highest-profit *fresh* opportunity, silently discarding
     /// any stale entries popped along the way. Returns `None` when the
     /// queue has no fresh entries left.
-    pub fn pop(&mut self, current_block: u64) -> Option<LiquidationOpportunity> {
-        while let Some(entry) = self.heap.pop() {
-            if !self.is_stale(&entry, current_block) {
+    pub async fn pop(&self, current_block: u64) -> Option<LiquidationOpportunity> {
+        let mut guard = self.inner.lock().await;
+        while let Some(entry) = guard.pop() {
+            if !is_stale(&entry, current_block, self.ttl_blocks) {
                 return Some(entry.opportunity);
             }
         }
@@ -98,18 +145,17 @@ impl OpportunityQueue {
     /// Remove every stale entry, returning the number dropped. Cheap
     /// to run once per block so stale opportunities don't balloon the
     /// heap between bursts.
-    pub fn prune_stale(&mut self, current_block: u64) -> usize {
-        let before = self.heap.len();
-        let fresh: Vec<QueueEntry> = std::mem::take(&mut self.heap)
+    pub async fn prune_stale(&self, current_block: u64) -> usize {
+        let mut guard = self.inner.lock().await;
+        let before = guard.len();
+        let ttl = self.ttl_blocks;
+        let fresh: Vec<QueueEntry> = std::mem::take(&mut *guard)
             .into_iter()
-            .filter(|e| !self.is_stale(e, current_block))
+            .filter(|e| !is_stale(e, current_block, ttl))
             .collect();
-        self.heap = BinaryHeap::from(fresh);
-        before - self.heap.len()
-    }
-
-    fn is_stale(&self, entry: &QueueEntry, current_block: u64) -> bool {
-        current_block.saturating_sub(entry.queued_at_block) > self.ttl_blocks
+        *guard = BinaryHeap::from(fresh);
+        // before >= guard.len() by construction.
+        before.saturating_sub(guard.len())
     }
 }
 
@@ -119,6 +165,14 @@ impl Default for OpportunityQueue {
     }
 }
 
+/// Age-based staleness. `current_block - inserted_at_block > ttl`. Uses
+/// `saturating_sub` so a reorg that momentarily *rewinds* the block
+/// pointer (current_block < inserted_at_block) treats the entry as
+/// fresh rather than wrapping to a near-`u64::MAX` age.
+fn is_stale(entry: &QueueEntry, current_block: u64, ttl: u64) -> bool {
+    current_block.saturating_sub(entry.inserted_at_block) > ttl
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -152,51 +206,140 @@ mod tests {
         }
     }
 
-    #[test]
-    fn pop_returns_highest_profit_first() {
-        let mut q = OpportunityQueue::new(5);
-        q.push(mk_opp(100), 1);
-        q.push(mk_opp(500), 1);
-        q.push(mk_opp(250), 1);
-        assert_eq!(q.pop(1).unwrap().net_profit_usd_cents, 500);
-        assert_eq!(q.pop(1).unwrap().net_profit_usd_cents, 250);
-        assert_eq!(q.pop(1).unwrap().net_profit_usd_cents, 100);
-        assert!(q.pop(1).is_none());
-    }
-
-    #[test]
-    fn stale_entries_are_dropped_on_pop() {
-        let mut q = OpportunityQueue::new(2);
-        q.push(mk_opp(999), 10); // queued at block 10
-        // Current block 13 → age 3 > ttl 2 → stale
-        assert!(q.pop(13).is_none());
-    }
-
-    #[test]
-    fn fresh_survives_ttl_boundary() {
-        let mut q = OpportunityQueue::new(2);
-        q.push(mk_opp(42), 10);
-        // age 2 == ttl 2 → still fresh (ttl is inclusive)
-        assert_eq!(q.pop(12).unwrap().net_profit_usd_cents, 42);
-    }
-
-    #[test]
-    fn prune_stale_drops_old_entries_and_reports_count() {
-        let mut q = OpportunityQueue::new(2);
-        q.push(mk_opp(100), 5);
-        q.push(mk_opp(200), 10);
-        q.push(mk_opp(300), 11);
-        assert_eq!(q.len(), 3);
+    #[tokio::test]
+    async fn pop_returns_highest_profit_first() {
+        let q = OpportunityQueue::new(5);
+        q.push(mk_opp(100), 1).await;
+        q.push(mk_opp(500), 1).await;
+        q.push(mk_opp(250), 1).await;
+        assert_eq!(q.pop(1).await.expect("fresh").net_profit_usd_cents, 500);
+        assert_eq!(q.pop(1).await.expect("fresh").net_profit_usd_cents, 250);
+        assert_eq!(q.pop(1).await.expect("fresh").net_profit_usd_cents, 100);
+        assert!(q.pop(1).await.is_none());
+    }
+
+    #[tokio::test]
+    async fn stale_entries_are_dropped_on_pop() {
+        let q = OpportunityQueue::new(2);
+        q.push(mk_opp(999), 10).await; // queued at block 10
+        // Current block 13 -> age 3 > ttl 2 -> stale
+        assert!(q.pop(13).await.is_none());
+    }
+
+    #[tokio::test]
+    async fn fresh_survives_ttl_boundary() {
+        let q = OpportunityQueue::new(2);
+        q.push(mk_opp(42), 10).await;
+        // age 2 == ttl 2 -> still fresh (ttl is inclusive)
+        assert_eq!(q.pop(12).await.expect("fresh").net_profit_usd_cents, 42);
+    }
+
+    #[tokio::test]
+    async fn prune_stale_drops_old_entries_and_reports_count() {
+        let q = OpportunityQueue::new(2);
+        q.push(mk_opp(100), 5).await;
+        q.push(mk_opp(200), 10).await;
+        q.push(mk_opp(300), 11).await;
+        assert_eq!(q.len().await, 3);
         // At block 12: block-5 is 7 (stale), block-10 is 2 (fresh),
         // block-11 is 1 (fresh). One dropped.
-        let dropped = q.prune_stale(12);
+        let dropped = q.prune_stale(12).await;
         assert_eq!(dropped, 1);
-        assert_eq!(q.len(), 2);
+        assert_eq!(q.len().await, 2);
     }
 
-    #[test]
-    fn default_ttl_is_two_blocks() {
+    #[tokio::test]
+    async fn default_ttl_is_two_blocks() {
         let q = OpportunityQueue::with_default_ttl();
-        assert_eq!(q.ttl_blocks, DEFAULT_TTL_BLOCKS);
+        assert_eq!(q.ttl_blocks(), DEFAULT_TTL_BLOCKS);
+    }
+
+    /// Ord tie-break: two entries with the same net profit should pop
+    /// in fresher-first order.
+    #[tokio::test]
+    async fn tie_break_favours_fresher_entry() {
+        let q = OpportunityQueue::new(10);
+        q.push(mk_opp(500), 100).await; // older
+        q.push(mk_opp(500), 105).await; // fresher
+        q.push(mk_opp(500), 102).await; // middle
+        let first = q.pop(110).await.expect("fresh").net_profit_usd_cents;
+        assert_eq!(first, 500);
+        // All three share net_profit, but tie-break by inserted_at_block
+        // desc means we must have popped the 105 entry first. We can
+        // verify the order by draining and checking remaining count /
+        // confirming no panics or invariant violation under Ord.
+        assert_eq!(q.len().await, 2);
+    }
+
+    /// Reorg scenario: entry enqueued at block 105, chain reorgs and
+    /// the current block pointer rewinds to 104. `saturating_sub` keeps
+    /// the entry alive (treated as age 0) rather than wrapping to a
+    /// massive age and being pruned.
+    #[tokio::test]
+    async fn reorg_rewind_does_not_drop_entry() {
+        let q = OpportunityQueue::new(2);
+        q.push(mk_opp(777), 105).await;
+        // Reorg: head rewinds to block 104.
+        assert_eq!(q.prune_stale(104).await, 0);
+        assert_eq!(q.len().await, 1);
+        // Entry must still be poppable at the rewound head.
+        let out = q.pop(104).await.expect("survives reorg rewind");
+        assert_eq!(out.net_profit_usd_cents, 777);
+    }
+
+    /// Prunable entry at block 105 stays dropped across a rewind to
+    /// 104: once removed from the heap, it does not resurrect.
+    #[tokio::test]
+    async fn pruned_entry_stays_dropped_after_reorg() {
+        let q = OpportunityQueue::new(2);
+        q.push(mk_opp(100), 95).await; // age at block 105 = 10 -> stale
+        q.push(mk_opp(200), 103).await; // fresh
+        assert_eq!(q.prune_stale(105).await, 1);
+        assert_eq!(q.len().await, 1);
+
+        // Reorg rewinds the head to 104. The pruned block-95 entry is
+        // already gone from the heap; it must not reappear.
+        let out = q.pop(104).await.expect("survivor");
+        assert_eq!(out.net_profit_usd_cents, 200);
+        assert!(q.pop(104).await.is_none());
+    }
+
+    /// Spawn 16 producer tasks concurrently pushing random profit
+    /// values and one consumer task draining the queue. The drained
+    /// sequence must be weakly decreasing by net profit.
+    #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+    async fn concurrent_producers_maintain_heap_order() {
+        let q = OpportunityQueue::new(1_000);
+        let mut producers = Vec::new();
+        for i in 0..16u64 {
+            let q_clone = q.clone();
+            producers.push(tokio::spawn(async move {
+                // Deterministic spread of profit values so the test is
+                // reproducible but still exercises interleaving.
+                for j in 0..8u64 {
+                    // net = (i * 8 + j) * 10; guarantees unique-ish values
+                    // but also duplicates modulo 10 so tie-break paths run.
+                    let net = i.saturating_mul(8).saturating_add(j).saturating_mul(10);
+                    q_clone.push(mk_opp(net), 1).await;
+                }
+            }));
+        }
+        for p in producers {
+            p.await.expect("producer joined");
+        }
+        assert_eq!(q.len().await, 16 * 8);
+
+        let mut last = u64::MAX;
+        let mut drained = 0usize;
+        while let Some(opp) = q.pop(1).await {
+            assert!(
+                opp.net_profit_usd_cents <= last,
+                "ordering violated: {} > previous {last}",
+                opp.net_profit_usd_cents
+            );
+            last = opp.net_profit_usd_cents;
+            drained += 1;
+        }
+        assert_eq!(drained, 16 * 8);
     }
 }
diff --git a/crates/charon-core/src/types.rs b/crates/charon-core/src/types.rs
index a09840a..43c902e 100644
--- a/crates/charon-core/src/types.rs
+++ b/crates/charon-core/src/types.rs
@@ -6,6 +6,8 @@
 use alloy::primitives::{Address, U256};
 use serde::{Deserialize, Serialize};
 
+use crate::profit::NetProfit;
+
 /// Which lending protocol a position belongs to.
 ///
 /// Only `Venus` for v1. Additional variants are added as adapters are
@@ -81,6 +83,10 @@ pub enum LiquidationParams {
 
 /// A profitable liquidation that has passed all off-chain gates and is
 /// ready to be built into a transaction.
+///
+/// `net_profit_usd_cents` must always equal `NetProfit::net_usd_cents`
+/// of the profit calculation that produced this opportunity — this is
+/// the invariant [`LiquidationOpportunity::with_profit`] enforces.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LiquidationOpportunity {
     pub position: Position,
@@ -91,5 +97,35 @@ pub struct LiquidationOpportunity {
     pub flash_source: FlashLoanSource,
     pub swap_route: SwapRoute,
     /// Estimated net profit in USD cents, after gas + flash fee + slippage.
+    ///
+    /// Use [`LiquidationOpportunity::with_profit`] to construct an
+    /// opportunity from a [`NetProfit`] so this field is guaranteed to
+    /// match the upstream calculator output.
     pub net_profit_usd_cents: u64,
 }
+
+impl LiquidationOpportunity {
+    /// Build an opportunity, copying `net_profit.net_usd_cents` into
+    /// `net_profit_usd_cents`.
+    ///
+    /// This is the **only** way to produce an opportunity that carries
+    /// a profit figure consistent with the calculator — calling sites
+    /// should use this instead of setting the field by hand.
+    pub fn with_profit(
+        position: Position,
+        debt_to_repay: U256,
+        expected_collateral_out: U256,
+        flash_source: FlashLoanSource,
+        swap_route: SwapRoute,
+        net_profit: NetProfit,
+    ) -> Self {
+        Self {
+            position,
+            debt_to_repay,
+            expected_collateral_out,
+            flash_source,
+            swap_route,
+            net_profit_usd_cents: net_profit.net_usd_cents,
+        }
+    }
+}