Skip to main content
shield_swap.aleo is the accounting and control core. It is not a wallet, indexer, custody system, or operating policy. The swap, LP, and rebalance routers adapt wrapped assets and funded operations to the core program.

​
Responsibility matrix

​
Visibility matrix

Shield Swap keeps participant ownership out of ordinary public mappings. It does not make market activity anonymous.

​
Program boundary

The program enforces:
  • canonical pool and token ordering
  • concentrated-liquidity and initialized-tick accounting
  • single-hop and multi-hop execution limits
  • LP and protocol fee accounting
  • position creation, replacement, freeze, unfreeze, and burn rules
  • pending swap output and refund accounting
  • confidential-address verification for swaps and claims
  • encrypted investigator records for mint, rebalance, and swap creation
  • admin gates, token eligibility, pause controls, and fee settings

​
Token boundary

The AMM calls the dynamic IARC20 interface. A production integration must verify the exact token program’s transfer behavior, decimals, record shape, authorization rules, issuer controls, upgrade authority, and wrapper redemption path. Included wrappers and test tokens do not prove that every production asset behaves the same way.

​
Client boundary

A production wallet or application must supply:
  • record discovery, reservation, and spent-state tracking
  • change and replacement record storage
  • confidential-address factor creation, retention, and recovery
  • nonce uniqueness
  • transaction construction, proving, submission, and finality monitoring
  • mapping reads and nested Leo parsing
  • quote simulation and conservative transaction limits
  • exact rebalance quotes and replacement record storage
  • claim submission after swap acceptance
  • reconciliation between public mappings and wallet-held records
The test harness demonstrates parts of this work. It does not remove the responsibility from a production client.

​
Routing boundary

The contract executes the route supplied by the caller. It does not compare pools, choose a fee tier, split an order, or estimate price impact across alternatives. The router must construct a valid token chain and a directionally valid price limit for every hop.

​
Compliance boundary

The program creates encrypted investigator records for mint, rebalance, and swap creation. It also exposes administrative controls. It does not decide participant eligibility, disclosure authority, data retention, or jurisdiction. Those decisions require deployment-specific policy, authorization, custody, audit, and reporting systems.

​
History boundary

Most public mappings hold current consensus state, not a durable event archive. Entries can change or disappear after claim, burn, or unfreeze. Accepted swap execution receipts remain after claim. Historical reports still require an independent transaction and mapping-change archive. Continue with Security model for threats and assumptions, or Choose an integration path for implementation ownership.