Skip to main content
Both swap paths write the same public SwapOutput. Both settle through claim_swap_output.

​
Outcome

Settlement is complete when the claim is accepted, swap_outputs[swap_id] is removed, and the wallet has stored the output and optional refund records.

​
Pending output shape

All amounts use native token base units. For a multi-hop swap, token_in and amount_remaining refer to the original route input. The current contract does not expose one refund pair per intermediate hop.

​
Claim sequence

1

Wait for swap acceptance

Resolve transaction finality before reading the mapping or retrying the swap.
2

Read the pending output

Load swap_outputs[swap_id]. Copy its token IDs and amounts exactly.
3

Obtain current freezelist proofs

Build the two MerkleProof values required to prove non-inclusion for the claiming signer.
4

Submit claim_swap_output

Use the original private factor and public confidential address. Pass the mapping values and proofs.
5

Reconcile records and mapping removal

Confirm acceptance, mapping removal, and wallet discovery of both dynamic record outputs.

​
Identity and compliance checks

The claim reconstructs the confidential address from the program address, signer, factor, and fixed domain. It also validates signer non-inclusion against the AMM freezelist root. Knowing the public mapping values does not authorize a claim. The investigator compliance record is not a claim credential. The admin has no redirect or recovery function for lost factor material.

​
Router claims

When output or refund must cross a wrapper boundary, use the matching function in shield_swap_router.aleo:
  • claim_to_wrapped_refund_arc20
  • claim_to_arc20_refund_wrapped
  • claim_to_wrapped_refund_wrapped
Resolve both asset kinds from the selected environment’s contract registry.

​
Retry rules

On an ambiguous result:
  1. Query the claim transaction.
  2. Read swap_outputs[swap_id] again.
  3. If the mapping remains, verify the prior claim is rejected before resubmitting.
  4. If the mapping is absent, scan and decrypt the accepted transaction outputs.
Do not infer success from a client timeout. Do not reconstruct claim amounts from an old quote.