Skip to main content
In short: the fee payer sends your transactions and pays their gas. It cannot spend your money. Before it sends one, we run that exact transaction on a copy of the network’s latest state and refuse it if it would do more than the plan allows. On Ethereum, Base and Arbitrum this check always runs. On HyperEVM it does not. Transactions go out through ordinary network providers, so a price floor and a short expiry are what protect a swap. They limit the damage and do not remove it.

​
The fee payer sends, the agent approves

The agent signs the form of each step. The fee payer wraps it in a transaction, pays gas and sends it. It authorises nothing, and the account checks the agent’s signature on the network itself. How a run works shows the stages.

​
The check before every send

Before a transaction goes out, a separate service runs the exact bytes on a copy of the network at its latest state. The send goes ahead only if the result passes two rules.
  • The fee payer spends gas and nothing else. No transaction may move its tokens.
  • Your account ends the way the plan said. For a transaction that carries a plan, what arrives is at least the price floor, and nothing leaves beyond what the plan spends.
The check fails closed. If the service cannot run it, the transaction does not go out. A timeout costs a retry, not your money.
HyperEVM is not checked. We chose to send there without this check. Transactions on HyperEVM go out with only the rules the network enforces on your account: the agent’s signature, the deadline and the destination checks. Venue locks written on MegaETH are not checked either. The check does run on Ethereum, Base and Arbitrum.

​
What protects a swap from being reordered

A person who sees your swap before it settles can trade around it so you get a worse price. This is called a sandwich. We do not hide transactions from them. Transactions go out through ordinary network providers, and we do not claim protection from a provider. What limits the loss:
  • A price floor you can see. Every swap carries a minimum output. The network enforces it, and a swap that would fill below it fails. Slippage and price impact explains how to set it.
  • A check on the floor itself. A card or order may set its floor at most 1.5% below the market, and a wider one is refused before it runs. Before the agent signs, the enclave compares the floor with an independent price source and refuses one more than 3% below that price, because a floor that low is what a sandwich needs. A token that source does not price gets no such check from the enclave.
  • A short expiry. A signed step is valid for about ten minutes. A late transaction fails.
  • The check before the send, above, which fails a swap that would deliver less than its floor on the latest state.
A floor is a limit and not a shield. Inside your slippage setting, a reordering can still cost you up to that amount. A tighter slippage lowers the worst case and raises the chance that your swap fails in a busy block.

​
Under the hood

For people evaluating the design.

​
Fees

Every send pays the going rate for gas. The tip is the network’s own suggestion, and the maximum is twice the base fee plus the tip, up to a cap. A send is not priced to win a race.

​
A stuck transaction is replaced, not duplicated

A transaction that does not go through in time is replaced at a higher fee, in the same slot, up to a limit. Then it waits for a person. How a run works explains why the slot is reused.

​
Reading the networks

Our services read each network through a gateway that caches reads and shares them between services. The signer and the fee payer read and send directly, not through the gateway.