User Proxy Overview

The AgentSwap User Proxy is a deterministic, per-user contract for executing market swaps. Each proxy has one owner. The owner can execute a swap directly or grant an agent bounded authority to submit a signed swap for anyone to relay.

This is a separate protocol from AgentSwap Intents. The proxy uses UserProxyFactoryV4 and UserProxyV4, supports Base, Arbitrum One, and Robinhood Chain, and has a different authorization and settlement model. The Intents Protocol uses different contracts and a Permit2 witness flow; do not use its order or chain assumptions for the proxy.

Actors

Actor	Authority	What the contract enforces
Owner	The address initialized into one proxy	Every operational entry point — swaps, agent policy, sweeps — is onlyOwner. The two exceptions are executeAsAgent, which anyone may relay against a valid agent signature, and init, which is not owner-gated but can only ever succeed once.
Agent	An address granted a policy by the owner	The policy limits expiry, action, input tokens, generations, and per-token epoch caps.
Relayer	Any caller of executeAsAgent	Cannot change any of the eight signed AgentOrder fields — but spender and routerData are not signed, so the relayer chooses the pull target and the route, bounded by the agent’s minOut, the SpenderNotAllowed check and the per-epoch cap. See agent delegation.
Router	The address called with swap data	It receives only the input approved for the current call; output is measured and settled to the owner.
Permit2	The canonical Permit2 contract	It is the pull target for executePermit2In and may be selected as the pull target on an agent call.

The factory is an ownerless deployer. Its implementation address is immutable, and the factory has no owner, administrator, pause switch, or upgrade path. The implementation’s constructor sets its own owner to 0xdead, so the shared implementation cannot be initialized or driven directly.

What the proxy does

The proxy exposes two owner-only swap paths:

• execute pulls an ERC-20 input from the owner, or accepts native ETH, then calls a router.
• executePermit2In uses a plain Permit2 PermitTransferFrom to pull the input before calling a router.

The proxy also exposes executeAsAgent. An owner grants an agent a policy with grantAgent; the agent signs an AgentOrder; and any caller may relay it. The order names the router, input, amount, output, minimum output, nonce, and deadline.

Settlement guarantees

Every swap reaches the same settlement path. It enforces the following conditions:

1. minOut must be non-zero and amountIn must be non-zero. There is no unbounded swap path.
2. The router is called with the supplied route data, and the proxy measures the tokenOut balance increase.
3. The measured output must be at least minOut, or the transaction reverts with SlippageExceeded.
4. The output is sent to the proxy owner. There is no recipient argument and no caller-controlled output recipient.
5. For ERC-20 output, the owner’s balance increase is measured again and must still be at least minOut.
6. The pull approval is revoked, and leftover input is sent to the owner.

These are transaction-level guarantees. A weak minOut can still accept poor routing down to that floor. The proxy does not provide an external price reference or an economic quality guarantee. For the corresponding but different Intents settlement rules, see settlement execution and the Intents trust model.

Ownership and recovery

The owner controls direct execution, agent policy, and the three sweep entry points. The proxy has sweepToken, sweepNative(), and sweepNative(address), all owner-only. These sweeps are part of the per-user proxy model: authority over a proxy’s balance is authority over that user’s proxy, not over a shared settlement contract.

Read the factory page for deterministic deployment, swaps for the pull and settlement paths, and security for the trust boundary.

Integration boundary

A client chooses between owner execution and delegated execution explicitly. Direct execution is authorized by the proxy owner at the transaction boundary. Delegated execution is authorized by the agent’s typed order and the proxy’s current owner-granted policy. In both cases, the proxy itself performs the final output measurement and owner settlement.

The proxy’s final settlement does not depend on a relayer’s identity. The owner receives the output whether the swap was submitted directly or through an agent relay.