Overview

AgentSwap Intents is an ownerless same-chain intent settlement protocol. It allows users to sign a single cryptographic message (an intent) authorizing a swap, which is then fulfilled by an open market of solvers.

The entire protocol runs through a single, immutable smart contract per chain: IntentSettlerV1.

Actors

The protocol coordinates three types of participants:

• Users (Owners): The accounts signing an IntentOrder. They fix the exact input to be spent, the minimum output they will accept, and the deadline. amountIn is an exact amount, not a ceiling — the settler requires the Permit2 pull to land exactly amountIn — and there is no partial-fill accounting, so an order settles once, in full, or not at all.
• Relayers: Infrastructure that observes signed intents and broadcasts them to the public feed via the announce function. Relayers pay gas to publish these orders but have no authority over funds.
• Solvers (Fillers): Sophisticated searchers who execute the swaps. They monitor announced intents, find the best execution route, and call the fill function to execute the intent atomically against their own liquidity or external venues.

Core Guarantees

For the tokens V1 supports — balance-stable ERC-20s, described on the token model page — settlement enforces three invariants by construction, and they hold regardless of how a solver behaves. They are properties of that token model, not promises about arbitrary tokens:

1. The owner is never debited more than their signed input. The settler requires that its own balance grew by exactly amountIn, so a pull that delivers anything else reverts the fill. The contract measures its own receipt, never the owner’s debit — which is why a token that charges the sender separately falls outside the model rather than being caught by it.
2. The recipient is never credited less than the required floor. The settlement contract measures the exact delivery of the output token to the recipient; if it falls below the curve’s required minimum at the time of execution, the entire transaction reverts.
3. No stray donation can subsidize a fill. A solver must provide the required output entirely from their own execution. Any funds erroneously donated directly to the settlement contract are trapped and cannot offset a solver’s obligation, because the contract strictly requires its token balances to remain unchanged across the fill.

No Upgrade Path

The IntentSettlerV1 contract is immutable. It has no owner, no administrator, no pause switch, and no upgrade path. This immutability is a fundamental security requirement, not merely a preference: because the authorization layer (Permit2) allows the approved spender to dictate the recipient of funds at execution time, an upgradeable settler could theoretically redirect funds authorized by outstanding signatures to new, malicious bytecode.

New protocol semantics will ship as IntentSettlerV2 at a new address, rather than modifying the existing deployment.