SwaptoX Security Model & Threat Analysis

1. System Overview

SwaptoX is a non-custodial, permissionless execution-based swap aggregator. It does not validate token implementations and relies on atomic execution guarantees.

Core features:

Executor-based architecture (swapAddress)
Permit-based token approval
Fee system with ladder discounts
Referral reward system
Support for ERC20 and native tokens

2. Security Assumptions

The protocol does not trust any ERC20 token implementation
Users are responsible for interacting with trusted tokens
Executor contract is configurable by admin
All swaps rely on EVM atomicity (revert guarantees safety)
Permit data is fully user-provided and not validated by protocol

3. Critical Security Invariants

Invariant 1:
The contract cannot transfer tokens from any address other than msg.sender.

Invariant 2:
No swap can succeed unless amountOut ≥ amountMinOut.

Invariant 3:
All token transfers into the contract originate from explicit user action.

Invariant 4:
The executor cannot retain user funds due to transaction atomicity.

Invariant 5:
No external contract can re-enter and extract funds due to nonReentrant.

4. Risk Analysis

R1: Admin Compromise / Malicious Admin

Description:

Admin can change executor address
Admin can modify fee parameters
Admin can disable swap functionality

Impact:

No direct fund theft
Denial of service (DoS)
Increased gas cost for users

Mitigation:

No on-chain mitigation
Trust minimized via optional ownership renouncement

R2: Malicious Executor

Description:

Executor may execute arbitrary logic or consume excessive gas.

Impact:

Cannot steal funds
Cannot bypass amountMinOut
Can increase gas consumption
Can produce unrelated on-chain activity (event pollution)

Mitigation:

Executor separation design
Optional auditing of executor

R3: Arbitrary Permit Execution

Description:

Users can provide arbitrary permit parameters (within allowed selectors).

Impact:

Only affects caller's token allowance
No impact on contract funds
No impact on other users

Conclusion:

This is a user-controlled execution surface, not a protocol vulnerability.

R4: transferFrom Abuse

Description:

Potential unauthorized token transfers.

Analysis:

transferFrom is only used in safetyTransferIn
source address is always msg.sender

Conclusion:

Unauthorized fund extraction is impossible.

R5: Reentrancy

Description:

External calls via ETH transfer or executor.

Mitigation:

All critical functions protected by nonReentrant

Conclusion:

No reentrancy attack path exists.

R6: Malicious Token Behavior

Description:

Tokens may behave unexpectedly (fake balances, transfer anomalies).

Impact:

Swap may succeed with worthless tokens
Only affects user who initiated swap

Conclusion:

Protocol does not enforce token validity.

R7: Referral System Abuse

Description:

Users can farm referral tiers via multiple addresses.

Impact:

Reduced protocol fee revenue
No direct fund loss

Conclusion:

Accepted business tradeoff.

R8: Minimum Fee Threshold

Description:

Rewards are skipped for fee amounts < 100 units.

Impact:

Minor precision loss
Gas optimization benefit

5. Non-Guarantees

Token contract safety is NOT guaranteed
Gas cost stability is NOT guaranteed
System availability depends on admin
User actions are NOT validated beyond basic checks

6. Final Security Conclusion

SwaptoX guarantees:

✔ No protocol-level fund theft
✔ Atomic swap execution
✔ Strict minimum output enforcement

SwaptoX does NOT guarantee:

✖ Token legitimacy
✖ User correctness
✖ Protection against economic inefficiencies

Overall Classification:
Permissionless Execution Aggregator