Security at SwapRoute

SwapRoute is a routing interface. It does not custody funds, manage private keys, or create accounts for users. You connect your own wallet and sign transactions directly from that wallet.

Before signing, review the source token, destination token, destination chain, recipient address, estimated output, minimum received, and any approval spender shown by your wallet.

Aggregator requests run through SwapRoute API routes so provider keys, fee configuration, and upstream routing details are not exposed in browser code.

Quote responses are normalized before they reach the app, and executable calldata is only returned when a connected taker address is supplied.

The token picker combines a curated registry with live token lookup and on-chain metadata. Long-tail tokens can still be spoofed, so users should verify contract addresses against official project sources before signing.

Cross-chain transfers can be difficult or impossible to reverse. Always double-check recipient addresses, especially when sending to a different wallet.

If you find a vulnerability or unsafe route behavior, report it privately to the SwapRoute team before public disclosure. Include the chain, token addresses, transaction hash if available, wallet used, and exact reproduction steps.