RAVNWe find the route and hand you something to sign. We never hold your funds and we wrote no contracts, which changes what you actually have to check.
Every swap ends one of three ways: you send a transaction, you sign a message, or you send coins to an address. In all three, the money goes to the venue, not us. Deposit routes go to a venue-generated address. Signature and transaction routes are signed or broadcast to the venue that settles the trade. There is no wallet of ours in the middle and no pooled balance.
There is nothing of yours here to take, because we never have it. What we can get wrong is which route we pick. The rest of this page is about that.
We wrote and deployed no smart contracts. Every swap settles through independent venues that existed before us and publish their own audits and disclosures. Using us adds a routing decision to your stack, not a contract to your risk surface.
That is also why we publish no audit of our own router. There is no router contract to audit. The venues carry their own disclosures, and the honest thing for us to publish is which of them are live. That is what the status page does, from a public endpoint anyone can call.
A quote returns an opaque quoteToken holding the venue, the route, the amounts and an expiry. POST /execute only builds a payload that matches it, so a tampered route does not settle.
Quotes expire, and an expired token is refused rather than quietly repriced. A stale quote fails loudly instead of settling at a number the user never saw.
On firm routes the response carries slippage.isFirm and aguaranteedMin. The user gets the quoted amount or the swap does not settle at all.
Every routing product sells the path where everything works. This is the other one. None of these are hypothetical; they are states the API reports.
GET /health reports it, and the router stops racing it. You can also exclude any venue yourself per request with excludeVenues. Because quoting is parallel rather than sequential, one venue failing does not stall the quote. It just does not win.
Execution is refused. Nothing is submitted and nothing moves. You re-quote and the user sees the new number before deciding. We never change the price under a confirmation. Prices are never silently updated underneath a confirmation.
Some venues need a destination and refund address supplied at quote time. Omit them and you get a priced-but-unexecutable preview rather than a failure at signing time. Check executable on the quote before you put it in front of a user.
GET /status reports the terminal state, and settlement webhooks push settle, refund and fail events to your service. Refunds are the venue's mechanism, which is why a refundAddress is bound at quote time on the routes that cannot re-bind it later.
Confirmations take minutes and we report that in estimatedTimeSeconds rather than quoting the happy case. A BTC route showing several minutes is not degraded. It is Bitcoin.
Funds are unaffected. We hold none, and an in-flight swap is already in the venue's hands on its own rails. You lose the ability to get new quotes, not to finish swaps already submitted.
On RFQ routes the user signs an off-chain message and a solver covers the gas. That signature authorises one trade at one price. It is not a blanket approval and it cannot be replayed for a different route or amount.
We never deliver a wrapper. A swap to Bitcoin settles real BTC, a swap to Solana settles real SOL. You never end up with a lock-and-mint copy, so there is no custodian holding the original once the swap is done, and no claim token that depends on them staying solvent. One venue, NEAR Intents, holds your deposit in its own bridge for the minutes its swap takes; every quote names the winning venue, so you can see when that applies.