The quote is the fill.

Aggregator spoofing is a hidden tax

Documented on Solana aggregators, then on PropAMMs and Uniswap V4 hooks.

Every version of the trick works the same way: the venue can observe something that differs between being quoted and being filled. A storage counter, a transient counter, a staticcall, the gas stipend, tx.origin, block parity, who is calling. Each is a channel that separates "being looked at" from "being traded with." Candor closes all of them at once.

How Candor works

Probe by real, reverted execution. Then execute the winner through the identical frame.

What the venue can observe

A venue can still discriminate on who is trading (every Candor user, say) but not on when. That is a price, not a spoof: it is the price the user is shown and gets, and the venue simply does not win the flow.

Proof

The test suite reproduces every spoofing pattern and shows the router cannot be gamed by any of them.

Adversarial audit

An independent adversarial review ran four passes before deployment: 23 findings in total (6 high, 6 medium, 7 low, 4 info), all fixed, each with a regression test. Round one found that a venue could forge a probe result through a bubbling revert, that the old fallback path could fill a venue whose own planned leg then reneged and strike an honest venue, that revert-data bombs were copied into the outer frame, and that the registry allowed free identity variants, crowd-out and unbounded reads. Round two found that the first fix for the fallback path had itself opened a split-mode price spoof (tight at plan time, wide at the pre-leg re-probe) and that a malicious token could still forge a probe result through the router's own token calls. Round three found a free gas-amplification path through repeated re-plans and an intra-transaction sandwich between venues; both are closed by the frame budget and the on-chain best-single floor. The mechanism described on this page is the post-audit design. Full write-up in the whitepaper and DESIGN.md in the source.

On Monad mainnet state

Fork tests against 17 live venues (Uniswap V3, PancakeSwap V3, Uniswap V4 native-MON pools, and two-hop paths through USDC) at block height of 2026-09-14:

100 WMON → USDC   11 venues probed, best: Uniswap V4 native/USDC 0.05%
                  fill == best same-block probe (minus 0.05% fee)
2000 WMON → USDC  greedy split: 500 via V3, 1500 via V4 — beats best single venue
100 WMON → USDT0  a 2-hop path (V4 native→USDC, V3 USDC→USDT0 0.01%) beat all 3 direct pools
USDC → native MON, native MON → USDC   round-trip within 0.2%

On mainnet, for real

First swap through the live router on 2026-09-14: 0.5 MON → USDC, best of 11 registered WMON/USDC venues, filled through the Uniswap V3 adapter with the 0.05% fee accrued in-contract. Transaction 0x8c681dcda103bc06b9a8d69a74cbec2d1769766d189c1898c4358d41f874e07b.

Contracts

Monad mainnet, chain id 143. Deployed 2026-09-15. Router v1 was superseded the same day by v2 (identical logic, test hook removed from bytecode, ownership timelocked).

Machine-readable: deployments.json.

Governance

Ownership of the router and the registry is held by an OpenZeppelin TimelockController with a 24-hour delay. Every admin action (fee within the cap, per-venue gas stipend, registry pointer, adapter allow-list, moderation) must be scheduled publicly and can only execute a day later; anyone may execute a matured operation. The deployer key is the sole proposer today and is meant to be replaced by a multisig. The two-step ownership transfers were scheduled at deployment and take effect once the delay passes.

Seeded venues

76 venues across 22 pairs, every pool with live liquidity on Uniswap V3, PancakeSwap V3 and Uniswap V4 native-MON pools at seeding time. Native MON works on either side of any WMON pair.

Anyone can add more: any pool behind an allow-listed adapter, 1 MON bond. Live list: VenueRegistry.idsFor(tokenA, tokenB).

Fee

0.05% of routed output, taken after routing so it never changes which venue wins and never touches the probe-equals-fill invariant. Hard-capped in code at 0.30%; can be set to zero. Fees accrue in the router and are pulled with collectFees, so a fee transfer can never block a swap. Quotes report gross, fee and net.

Listing bond

Registering a venue costs a 1 MON bond, refundable after a 7-day minimum listing while the venue has no strikes, slashed on the first strike (or by the owner for junk). The adapter validates at registration that the params describe a live pool for the pair. Identity is canonical per pool, so a struck pool cannot come back under a different encoding. At most 32 live entries per pair.

Meme tokens, on-chain keeper

nad.fun tokens are venues too, on the bonding curve and after graduation, and a contract decides which ones get listed.

Seeded at launch, every nad.fun token above $200k on 2026-09-14: JAMES, BUSY, CHOG, MUSHROOM, emo, moncock, MOLANDAK. Paste any nad.fun token address on the swap page to trade it through the router.

Cross-chain

Probe-by-revert cannot reach across chains, so a bridge is never a Candor venue. Instead the bridge page bundles Wormhole Connect (Token Bridge, CCTP for USDC, NTT) so anyone can bring assets in from Ethereum, Solana, Arbitrum, Base and others with Monad as the destination, swap through Candor, and bridge back out. Same rails the WRAITH wallet routes on; Candor never holds bridged funds.

Use it

Wallets, bots, and other routers can call the router directly. Anyone can list a pool.

Swap

struct SwapParams {
  address tokenIn;      // address(0) = native MON
  address tokenOut;     // address(0) = native MON
  uint256 amountIn;
  uint256 minAmountOut; // on the net amount, after fee
  address recipient;
  uint256 deadline;
  uint8   chunks;       // 1 = best single venue; 2..8 = greedy split
  uint8   maxVenues;    // 0 = default (8)
  Venue[] venues;       // empty = use the registry; or bring your own list
}
function swapExactIn(SwapParams calldata p) external payable
  returns (uint256 amountOut, Fill[] memory fills);
function quote(SwapParams calldata p) external payable returns (Quote memory); // eth_call it

TypeScript (viem)

import { createPublicClient, http } from "viem";
import { createCandor, MONAD, NATIVE } from "@candor/sdk";

const client = createPublicClient({ transport: http("https://rpc.monad.xyz") });
const candor = createCandor({ client, router: "0xd2e3efca153eb574eeed7c838efde93fe38b79bc", registry: "0xd7dc225c69afbf55f9c2d39c6053662e1ab8bcfc" });

const req = { tokenIn: NATIVE, tokenOut: MONAD.USDC, amountIn: 10n ** 18n, minAmountOut: 0n, recipient: me, chunks: 2 };
const { amountOut } = await candor.simulate(req, me);          // exact fill, same code path as the tx
const tx = candor.buildSwap({ ...req, minAmountOut: amountOut * 995n / 1000n });
const gas = await candor.gasLimit(req, me);                     // Monad bills the gas limit

List a venue

// any pool, behind an allow-listed adapter; 1 MON bond (refundable while strike-free)
VenueRegistry.register{value: 1 ether}(tokenA, tokenB, UniV3Adapter, abi.encode(pool));
VenueRegistry.register{value: 1 ether}(WMON, USDC, UniV4Adapter, abi.encode(PoolKey(...), hookData));
VenueRegistry.withdraw(id);   // disable + refund, if never struck
// venues that fill below their own probe get struck, slashed and quarantined with exponential backoff
event Reneged(uint256 id, address adapter, uint256 expected, uint256 actual, uint32 strikes, uint64 quarantinedUntil);
event BondSlashed(uint256 id, uint256 amount);

Monad has no public mempool and charges the gas limit, not gas used. Size the limit from an estimate plus modest headroom; the SDK does this for you. chunks = 1 is the default and the always-available mode; split routing (chunks > 1) is best-effort and can revert where single-venue mode succeeds, so offer it only when a simulation with it succeeds.