Skip to content
AgentSwap Docs
docs/security/trust-model

Trust Model

AgentSwap Intents is designed to minimize centralized trust. The V6 IntentSettlerV3 and each owner’s UserProxyV6 enforce the signed order through structure rather than authority. The SystemFillerGate and FeeVault are explicit owner-controlled operational boundaries for the exclusive system filler and fee destination.

The settler has no owner, administrator, pause capability, upgrade path, or external oracle. The system filler gate has an operator and solver allowlist, and the fee vault owner can sweep protocol fees. No party holds user funds across transactions: within a single fill the settler and then the solver hold the input, and both positions vanish with the transaction if it does not deliver.

Safety is structural: a transaction either delivers at least the signed floor to the order’s recipient — which the owner chose and need not be the owner — and sends the 3 bps fee to FeeVault, or it reverts entirely. The fee is paid by the filler on top and never from the owner’s proceeds.

Where authority exists in the protocol: nowhere in the settler or the proxy, bounded in the gate and the vault, and nowhere at all for solvers, relayers and indexers. no authority exists bounded authority trusted with nothing IntentSettlerV3 no owner · no administrator no pause · no upgrade path UserProxyV6 owner-only authority pulls only to the settler the factory names SystemFillerGate an operator, and a solver allowlist it enforces FeeVault its owner controls withdrawal of the fees solvers · fillers · routers relayers · frontends · indexers no custody over user assets nothing they do survives a reverted transaction no party holds funds across transactions inside one fill the settler holds the input, then the solver; both positions vanish if it reverts trusted, and outside the protocol's reach balance-stable ERC-20 behavior · EVM atomicity and EIP-1153 transient storage the owner's own choice of token, deadline and curve
The middle column is the whole of the protocol's discretionary authority — who may fill at the floor before startTime, and who withdraws the fees. Everything in the right column can fail or act against the owner without violating the invariants.

Immutability as a Requirement

Section titled “Immutability as a Requirement”

The settler contract is intentionally non-upgradeable.

This immutability is a strict security requirement. The owner’s proxy verifies the flat order signature and accepts only the settler named by the V6 factory as the pull destination. Immutable deployment fixes that authorization boundary for already-signed orders.

By being immutable, the user can trust that the logic they authorize will be the exact logic executed.

External Trust Anchors

Section titled “External Trust Anchors”

Because the protocol minimizes its own authority, the remaining trust is deferred to the foundational infrastructure of the EVM:

  • User Proxy: The owner’s UserProxyV6 is trusted to verify the flat order signature, consume owner nonces, and pull only to the V3 settler.
  • Fee destination: FeeVault is trusted to hold protocol fees; its owner controls withdrawals.
  • System filler gate: SystemFillerGate is trusted to enforce its operator and solver allowlists while forwarding floor fills.
  • ERC-20 Standards: Tokens are trusted to behave according to the standard balance-stable ERC-20 model.
  • EVM Atomicity: The chain is trusted to execute transactions atomically and to support EIP-1153 transient storage, which the settler’s reentrancy guard uses.
  • The User: The user is ultimately responsible for choosing safe tokens, setting reasonable deadlines, and signing an economically sound curve.

Solvers, fillers, routers, relayers, frontends, and indexers are trusted with nothing that survives a reverted transaction. They have no custody over user assets, and their failure or malice cannot violate the signed invariants.