The record

What has been checked,and what has not.

Everything below can be reproduced from the repository with the command named beside it. The second half of this page is the list of things nobody has verified, and it includes the one that matters most.

Measured

144 / 144

npm run verify

Concentrated liquidity maths against the chain

Six Uniswap v3 pools, twenty four amounts each, quoted by this engine and by Uniswap’s own QuoterV2 at the same pinned block. A quote counts only when the two agree on every digit.

120 of the 144 crossed at least one initialised tick, and the deepest crossed six. Ticks are where the arithmetic gets hard, so a suite that never crosses one has proved almost nothing.

12 / 12

npm run verifyv4

Uniswap v4 swaps replayed out of their own logs

Twelve real swaps that already happened, replayed against the pool state at the block before each one, and compared against the amounts the chain recorded.

Every sample is counted, including the ones the quoter refuses to answer. An earlier version silently dropped those and reported nine of ten with nothing accounting for the tenth.

7 / 7

npm run testroutes

The router contract executing against live state

Each case is quoted, encoded into calldata, and executed against real pool state at the block it was quoted for. It passes only when the contract delivers exactly what the quote promised.

No deployment and no private key. The contract’s runtime bytecode is recovered by running its creation code inside an eth_call, then injected at an address with a state override.

What the tests found

The first time the contract executed a route it came up 5.5 parts per million short of the quote. Uniswap v4 charges its protocol fee on top of the liquidity provider fee rather than out of it, and the engine had been reading only lpFee.

Undercharging the fee means overquoting the trader, which is the direction that makes a real swap revert on its own minimum and charge gas for nothing. Five parts per million is far too small to notice by eye. It is the reason the standard here is exact agreement rather than close agreement.

The contract, and what it deliberately lacks

No arbitrary call surface. A router that forwards a target and calldata is a machine for draining every allowance ever granted to it.
No owner, no pause, no upgrade path and no rescue function.
Every amount is measured from balances rather than taken from what a pool reports, so a token that charges a fee on transfer is priced by what actually arrived.
Slippage is checked once, against the total delivered, not leg by leg.

On the chain

Two things a reader can check without trusting this site, both of them on an explorer this project does not run.

Address: 0xb002adff1c66e19265ef9c7aee630e3211ccc0e9
Source: Published and confirmed an exact match. The explorer compiled the source itself and reproduced the bytecode at that address, and it recovered the two constructor arguments from the deployment rather than being told them.
Keeper: 0x82262b054763c08afe2c816af54fcfe40624cb9eThe contract that holds a scheduled swap until its window opens and lets anyone run it through the router for a bounty. It has no owner, no pause and no upgrade path, and the only contract it calls on its own is the router above. Its source is published on the explorer and confirmed an exact match, with the router recovered as its one constructor argument. Before it was deployed it was run end to end inside a single call against live pools: an order placed, a lowered minimum refused, an unopened window refused, the real route executed, a second run refused, a cancel refunded in full. The engine checks its bytecode on every start the same way it checks the router.
Proof of fair: 0x6ff488ee713c5ea47dab6dcee16f8c302a10f0bbThe pool a dev hands tokens to at a moment they name, with no way back. At that moment it buys a tenth into $GALX for the $GALX dev wallet, buys the dev’s burn share into the token they chose for the dead address, and the publisher pushes the rest to the largest holders. It has no owner, no pause, no upgrade path and no withdraw, and the only contract it calls on its own is the router above. Four things are fixed in it forever, the router, $GALX, the fee wallet and the publisher, and the engine rebuilds its bytecode from those four on every start and refuses anything that does not match. Before it was deployed it was run end to end inside a single call against live pools: a native round committed, a burn without a route refused inside the day of grace, the real fee and burn routes executed to the treasury and the dead address, a second execution refused, a batch over the pot refused, two batches paid and the remainder burned. Fourteen checks, fourteen passes, reproducible with npm run fairtest. The one thing it trusts is the publisher’s list of holders, whose hash it writes with the last batch and which npm run fair-list recomputes from the chain.
Checked here: The engine reads the code at that address every time it starts and compares it byte for byte with what this repository compiles, immutables included. It refuses to build a swap against anything that does not match, so a swapped address stops the terminal rather than being served quietly.

Not measured

It is on the chain, and nobody outside this project has read it

The router is deployed at 0xb002adff1c66e19265ef9c7aee630e3211ccc0e9 and the explorer confirms its published source is an exact match for the bytecode there. That establishes what the code is. It does not establish that the code is right. It takes custody of a trader’s tokens for the length of a swap, which makes it the most dangerous code in the project, and the only people who have read it are the people who wrote it. The keeper, which holds a scheduled swap for as long as its placer chooses, and proof of fair, which holds a dev’s commitment until the moment they named, were written by the same people and have been read by nobody else either.

A pass is a measurement, not a guarantee

These suites run against the liquidity that exists on the day they run. A route shape nothing currently prices will not appear in a run, and the suite reports which of the five hop kinds it actually reached rather than assuming it covered them all.

Two tokens here are not what their names suggest

WETH on this chain is not the canonical immutable WETH9. It is an upgradeable proxy, and so is USDG. Both answer the EIP-1967 implementation slot with a live address. Treating the wrapper as one for one and unbounded is true of the code deployed today and is a statement about whoever controls that proxy.

A comparison at one moment measures nothing

The advantage over a single pool ran from zero to about fifteen basis points in the runs recorded here. Hours earlier the same ladder showed four times that. Nothing in the router changed between them, liquidity moved. Any figure quoted from this project carries the block it came from.

Exact output overshoots, on purpose

Asking for an exact amount out is answered by searching for the smallest input that clears it, so the result usually delivers a few parts per million more than asked. That is the safe direction to miss in, and it is reported rather than trimmed away.

The copilot

The assistant beside the ticket reads the engine through tools and cannot state a figure it did not fetch, and it cannot sign: every swap it stages ends at the wallet prompt. What has not been measured is how often it misreads a request. There is no eval set for it yet, and until there is, treat what it says as a reading of the panel, not a substitute for it.

There is no audit badge on this site because there has been no audit. There are no partner logos because there are no partners, and no listing claims because nothing is listed. Every name that appears here is either a contract this project reads or a piece of software it runs.