Before you sign.

What a swap must pass

The client and server both validate the token pair, chain, authoritative minimums, technical bounds, connected taker, selected slippage, and fees. They also check the allowance target, transaction target, value, calldata meaning, route, the provider simulation result, and expiry. Confirm swap is bound to the trade currently shown in the review.

Calldata is the instruction data sent to a contract. Checking its meaning helps ensure the transaction performs the intended action, rather than merely checking that data exists.

What a liquidity plan must pass

LP validation is tied to the fixed chain, pool, tokens, managers, zero hooks, aligned full range, recipient, step order, amount bounds, and deadlines.

A prepared plan contains the intended amounts, current allowance state, exact targets and calldata, transaction order, limits, and expiry. It is kept private off-chain.

Wallet authorization for each step

Before an LP transaction prompt, the wallet signs a domain-separated authorization tied to one intent, one step, and a pending nonce. Domain separation binds the authorization to its intended context. A nonce identifies a transaction’s place in a wallet’s sequence.

FeatherFi verifies that authorization and records a public nonce reservation. It does not retain the raw authorization signature. The reservation helps prevent competing submissions from using the same pending step.

The final check happens just before action

1. Require a validated executable swap quote with a complete provider simulation result. Approval and LP steps have their own exact simulation checks.
2. Check readiness again before submission.
3. Stop if readiness cannot be proven: a disabled release switch, missing or stale configuration, or unknown readiness must fail closed.

Fail closed means the action is blocked when the system cannot establish that it is permitted and ready. LP actions stay disabled regardless of what the read-only pages display.