How settlement is constrained
RAH Swap is a self-custody interface. Your wallet holds the tokens. FeeRouter is allowed to pull only the input you approve, and only for the swap you sign.
What the contract checks
A call target must be on the allowlist, and its runtime codehash must still match the hash stored when it was allowed. The top-level selector cannot be a token transfer, an approval, or a permit. Output is measured as the recipient’s balance increase. Unused input is refunded.
- FEE_MANAGER sets the current fee, showFee, and the recipient split.
- ROUTER_MANAGER edits the allowlist and can re-enable a router or unblock a token.
- PAUSER can pause the contract, disable a router, and block a token.
- RESCUER can move tokens already sitting on the contract. It cannot spend a user’s wallet.
- The default admin moves only through a delayed two-step transfer.
- A fee manager can set the fee to any value from 0 to 1000 bps in one transaction. Your minimum received is still checked on the balance change.
What the interface can switch off
The kill switch hides swaps in the app. It does not pause the contract. A pauser still has to pause on-chain. An external audit is still recommended before mainnet use; this page is not an audit report.