Here is the actual spec:
----------------------------- MODULE uniswapV1 -----------------------------
EXTENDS Naturals, Integers
CONSTANTS liquidityBound, coin0Init, coin1Init, upperZero, lowerZero
VARIABLES coin0, coin1, liquidityTokens
max(a,b) == IF a > b THEN a ELSE b
outputPrice(delta_y, coin_x, coin_y) == ((delta_y * coin_x) \div (coin_y - delta_y)) + 1
inputPrice(delta_x, coin_x, coin_y) == (delta_x * coin_y) \div (coin_x + delta_x)
TypeOK == /\ coin0 \in Nat
/\ coin1 \in Nat
/\ (coin0 = 0 <=> coin1 = 0)
/\ coin0 < upperZero
/\ coin0 > lowerZero
tradeOneForZero == \exists delta_1 \in 1..outputPrice(coin0-1, coin1, coin0):
/\ coin1' = coin1 + delta_1
/\ coin0' = coin0 - inputPrice(delta_1, coin1, coin0)
/\ liquidityTokens' = liquidityTokens
tradeZeroForOne == \exists delta_0 \in 1..outputPrice(coin1-1, coin0, coin1):
/\ coin0' = coin0 + delta_0
/\ coin1' = coin1 - inputPrice(delta_0, coin0, coin1)
/\ liquidityTokens' = liquidityTokens
Init == coin0 = coin0Init /\ coin1 = coin1Init /\ liquidityTokens = max(coin0,coin1)
\*Next == tradeZeroForOne \/ tradeOneForZero
Next == tradeOneForZero \/ tradeZeroForOne
Spec == Init /\ [][Next]_<<coin0, coin1, liquidityTokens>>
=============================================================================