Swap execution model

01State transitions

Invalid input has no executable route. A valid request can produce a current quote. Preparation checks RPC chain, quote deadline, input and ETH balances, allowance, target code, router bindings, exact-call simulation and gas. Any failure removes readiness.

If allowance is insufficient, the next possible transaction is a separately reviewed bounded approval. Approval confirmation does not execute a swap. Balances and quotes refresh, preparation repeats and a new swap review is required. Changed account, chain, pair, amount or quote invalidates the previous preparation.

02Locally constructed calls

Market calls use SwapRouter02 multicall(uint256,bytes[]) with the chain-derived deadline. Inner exactInputSingle binds normalized tokens, fee, recipient, amount and minimum output, with sqrtPriceLimitX96 = 0. The amount minimum supplies the output bound.

Native input sends exactly amountIn as value and appends refundETH. Native output first routes to the router, then appends unwrapWETH9(minimumOut, actual recipient). Other market calls send zero native value. ETH/WETH wrapping directly calls canonical WETH deposit() or withdraw(amount) at 1:1 before gas.

Final recipients zero, 1 and 2 are rejected. The quote response cannot directly inject arbitrary calldata or a different spender.

03Allowance and consent

ERC-20 allowance is read for the configured SwapRouter02 spender. If insufficient, approve(spender, exact amountIn) is balance-bounded and simulated; a false return value fails preparation. This path does not create an unlimited approval.

An existing sufficient allowance is reused and not automatically reduced. Disconnecting does not revoke it. Non-custodial operation does not eliminate contract or allowance risk.

04Revalidation before sending

The wallet must report chain 4663 and include the reviewed account. RPC independently reports chain 4663. Latest block number/timestamp must not precede the quote reference. The deadline must be later than the head timestamp and at most sixty seconds ahead.

Preparation repeats before broadcast. Swap eth_call must succeed for the exact account, destination, calldata and value. Gas estimation and ETH sufficiency follow. An approval stage estimates approval gas only; swap gas is checked after approval.

The source-level release policy rejects the final send even if financial checks pass. Reopening requires a reviewed change after warning classification and a verified warning-free wallet flow.

05Submission is not confirmation

The engine waits up to sixty seconds for a receipt. Timeout remains pending. A successful receipt is Confirmed; a reverted receipt is Failed. Connected activity polling repeats every twelve seconds and merges persisted entries without erasing newer submissions or regressing terminal statuses.

Dropped/replaced transaction reconciliation, reorg handling and cross-device history are not implemented. A simulated call is not a broadcast or receipt. No real-wallet signature or live swap is claimed.