Slippage Protection Without A Slippage Tolerance.
381e35
8/27/2026
#plugs#swap#solver
A third of the trades your users make come in worse than the number you showed them.
That is not a guess. 
0x measured 673,000 trades through their own Swap API and published the distribution: 50% settled at the quote, 17% came in better, and 33% came in worse. On an aggregator, with routing that is genuinely good.
That study ran in 2021, and it is still the most rigorous public dataset anyone has put their name to. What has changed since is where the loss shows up, not whether it does.
Look at where the bad ones landed. Of the trades that finished with slippage between 0.49% and 0.50%, right at the edge of a 0.5% tolerance, over 90% showed evidence of a sandwich attack. Your tolerance is not a safety margin. It is a number you published to an adversary, and they took exactly it.
Put that against a wallet doing $100M a month, which is not a big wallet. A third of that volume is $33M arriving under quote. Assume the average shortfall on those is 30 basis points. That is conservative, since it sits well inside the tolerance most apps ship and the data says the bad ones cluster at the edge. You get $99,000 a month leaving your users' pockets. It is not a fee you charge. It is not revenue for anybody you could negotiate with. It is loss, and it arrives in your support queue with your logo on it.
None of this is bad luck, and none of it is a routing problem. It is the direct consequence of one decision nobody re-examines.
You Are Signing The Route
You ask an aggregator for a quote. It searches venues, splits across pools, prices gas, and returns transaction data. Your user signs that transaction data: the specific pools, the specific splits, the specific path, fixed at the moment of signing.
Then the transaction waits. Somebody trades through one of those pools. A block lands. By the time yours executes, the route your user signed describes a market that no longer exists.
There are exactly two endings and you have seen both. It reverts, and your user paid gas for nothing. Or the tolerance absorbs the difference, and your user got a worse price than the screenshot. There is no third ending, because the thing that went stale is the thing they signed.
This is not a criticism of anyone's router. Their routers are excellent. The router is not the problem. The signature is.
Look At What You Are Actually Signing
The integration surfaces say it out loud. 
LI.FI's own documentation describes the 
Enso describes its API as returning "signer-ready transaction data."
/quote response as "Quote with transactionRequest ready for signing", and the flow as /quote, then transactionRequest, then the user signs, then broadcast. That is the product. Not a price, not a guarantee. Bytes, and your user's signature on top of them.
Both blocks are the same trade through the same router. The only thing that changes is how much of it the signature nails down before the market has had its say.
The Whole Industry Already Agrees
Nobody is defending the frozen route anymore. Look at what the last three years of serious work actually did:
- Private mempools.
Flashbots Protect and
MEV Blocker hide the transaction so fewer people can trade against the route.
- RFQ. Move the freeze to a market maker, who now charges for the risk of holding a price.
CoW Protocol. Batch the orders and let solvers compete to fill them.
- UniswapX. Stop signing a route at all. Sign an order, let fillers compete. Uniswap
reports a 99.5% fill rate against it.
Every one of those is the same admission, which is that the user should not be signing the route. Uniswap, the largest DEX in the world, rebuilt its swap flow around that sentence.
They are right, and the results are real. 
EigenPhi's data has monthly sandwich extraction on Ethereum falling from roughly $10M in late 2024 to about $2.5M by October 2025, even as DEX volume climbed past $100B a month. Hiding works.
But notice what hiding does not do. It does not make the route fresh. It removes one of the ways a stale route costs you and leaves the rest: the reverts, the fills at the tolerance edge, the quote that was already old when it rendered.
And Look What They Hand You Instead
So the route came out of the signature. What went in its place?
A form.
That is 
UniswapX's order. Fixed fields, fixed meanings. You can express a Dutch auction over a token pair, and that is the entire vocabulary. It is a good form. It is also the only sentence you are allowed to say.
Try to express any of these in it:
- Buy the fixed rate, but only if it clears 4% against what Aave is paying me this block.
- Rebalance these five assets to these weights, in one transaction, at whatever prices clear.
- Repay my loan from the cheapest source available when the transaction lands.
None of them fit, and not because the form is badly designed. They do not fit because a form has fields and a strategy has logic. The moment your acceptance test is more complicated than did I receive at least X of token Y, you are outside the vocabulary, and the answer is to go back to signing a route.
The Third Option
Take the route out of the signature and put nothing in its place.
Not a form with better fields. Not an order type with a wider vocabulary. What your user signs is the swap described as behavior: what leaves their account, and what has to be true when the transaction is over. Everything in between is left open on purpose.
Here is the whole swap, written that way. Read my USDC balance. Send 1.5 WETH to whoever is filling. Let them fill it. Read my USDC balance again. Require that it went up by at least 4,180.
Four of those five sentences you can state completely at signing time. The fifth is the route, and you cannot. So the signature covers the four and stops at the fifth.
Read the trust boundary, because it is inverted from the usual one. The filler is not trusted. The route is not trusted. Whoever shows up to fill is not named anywhere in what was signed. They are handed exactly the 1.5 WETH the program sent them and nothing else, and the transaction cannot end anywhere except in front of your requirement. The route can be a contract deployed thirty seconds ago and it does not matter, because it cannot touch a token your program did not hand it, and the only way out is through the floor.
That is a real plug you can open and run. The floor is not a tolerance the app picked to keep reverts rare. It is a number that was signed, and the transaction cannot end below it.
Nothing Here Is Swap-Shaped
There is no
DutchOutput. There is no order type. There is a program, and one sentence in it says let them fill it. Everything before and after is behavior you wrote.Which means the same machinery does things no order form can express. A basket rebalance is several signed transfers and a ratio requirement instead of a floor. A refinance is the same fill, bracketed by health-factor reads. A rollover into a market that does not exist yet is the same idea aimed at a different unknown. None of these needed a new order type, because the acceptance test is authored rather than enshrined.
Every fix the industry shipped took the route out of your signature and put its own vocabulary in your hands. This one takes the route out of your signature and gives you back nothing, which turns out to be the only thing worth having.
What This Costs You To Try
Less than the meeting you would have about it.
You deploy nothing. Your users migrate to nothing, because they sign from the account they already have, and the swap above is an ordinary plug. The integration keeps the shape you already have: ask for a program instead of a quote, show your user a floor instead of a tolerance, submit. The change lands on your side of the wire, not theirs.
The API and SDK are open with no key. Deal your own treasury address a swap, watch what the floor does when you set it somewhere a tolerance would never let you, and compare the fill to the quote you would have shown.
Your users are not losing money because somebody's router is bad. They are losing it because they signed an answer to a question the market had not asked yet. Stop making them sign it.
Protocols · 8
Slippage Protection Without A Slippage Tolerance.
Back