Threat Model

This document outlines the threat landscape for V6 IntentSettlerV3, detailing the adversaries the protocol anticipates, the structural controls mitigating them, and the residual risks accepted by the design.

Security Boundary

IntentSettlerV3 operates as one immutable, ownerless contract per chain, paired with each owner’s UserProxyV6. The owner signs a flat Order detailing an exact intent. Any actor can announce or fill this order, and any solver can receive the flash-transferred input during the callback. Delivering the applicable floor plus the 3 bps fee is necessary for execution, not sufficient: valid proxy authorization, an unspent order and proxy nonce, the time window, the caller’s exclusive terms, exact input receipt, exact fee and recipient delivery, and end-of-fill balance conservation must all hold too, or the whole transaction reverts.

The contract maintains no administrative controls and keeps no funds across transactions. It is not fundless mid-fill — it holds the input between the proxy pull and the flash transfer, and the solver holds it during the callback — but every such position is transient and atomic. Tokens sent to the settler outside a fill are the one lasting balance, and they are trapped.

Adversaries and Controls

Malicious Filler, Solver, or Router

The fill entry point and the solver callback are permissionless. While the solver receives the amountIn during the flash callback, the entire transaction strictly reverts unless the settler receives the gross requirement, delivers the applicable floor to the recipient, and sends the fee to FeeVault. At or before startTime, only SystemFillerGate can use the floor; outsiders must pay the 25 bps override. A transient reentrancy guard (Reentrancy) blocks nested fills.

Forged or Replayed Authorization

The owner’s proxy verifies the flat Order signature on the settler’s AgentSwap IntentSettler version 3 domain. The signed order binds the owner, both tokens, the input amount, the curve parameters, the time window, and the nonce. The proxy consumes the owner nonce during the pull, and V6 records filled[id], so replay attacks are structurally blocked.

Malicious Relayer or Announcer

Order announcement and gasless cancellation are permissionless broadcasts. A relayer cannot alter a signed order, nor can they redirect its funds. The most a relayer can do is censor or delay their own broadcast. To mitigate this, users retain direct, permissionless paths to self-announce, execute standard on-chain cancel calls, or directly invalidate owner nonces on their own proxy.

Token Accounting Attacks

The protocol expects balance-stable ERC-20 tokens. Exact input receipt rejects transfer-taxed inputs, and the recipient must be credited exactly what the settler sent. End-of-fill conservation strictness prevents an external token donation from artificially subsidizing a sender’s short pull.

Tokens taxing legs that the settler cannot physically observe (such as the solver’s transfer to the settler) will settle successfully. This places the burden entirely on the solver to measure and account for exotic routing, preventing the settler from wasting gas to protect sophisticated execution agents.

Cancellation Races and MEV

On-chain cancellation transactions do not front-run fill transactions already present in the mempool. The EVM dictates that whichever valid transaction lands first wins the race. The primary protection against adverse execution and MEV is the signed Dutch curve and deadline; the contract does not consult an external oracle.

Accepted Residuals

The protocol accepts the following residual outcomes by design:

• A valid order may simply remain unfilled because solver participation and market execution are not guaranteed.
• Announcement logs may carry signatures that later become invalid or nonces that are eventually spent elsewhere.
• Any tokens erroneously donated directly to the settler are permanently trapped.
• Unsupported token mechanics may make an order practically unfillable.
• A user might sign an economically poor curve or floor; the protocol enforces the cryptographic intent, not external market quality.
• Calling invalidateOwnerNonces on the owner’s proxy is the durable backstop, at nonce granularity — it kills every owner-signed order sharing those nonces, while cancel and cancelSigned are the per-order settler paths.