1inch Aqua

Aqua is an allowance ledger, not a vault. Shipping a strategy writes an entry and moves nothing; a fill pulls from the maker's own wallet at the moment it fills. The wallet never stops holding its own money.

That one property is why Helico is built on it, and it has a consequence that is easy to state and easier to disbelieve: one wallet's balance can back several positions at once.

ship $2,800–3,200   3 Aqua events, 0 token transfers
ship $2,900–3,100   3 Aqua events, 0 token transfers
ship $1,000–9,000   3 Aqua events, 0 token transfers

committed  30 WETH against 10 held  —  300%
moved      0 WETH   0 USDC

Three concentrated ranges on the same ten ETH, on a fork of Arbitrum One. 300% is not leverage: whichever strategy fills first gets the tokens and the rest revert inside pull. It is a number an agent has to watch, which is one of the jobs the subgraph does here.

Two apps, because one cannot quote a one-sided maker

HelicoMandateSwap is an Aqua app in which the strategy is the mandate: an expiry, a named agent contract, and a per-token ceiling on what may leave the wallet. Aqua files a strategy under the hash of bytes it never reads, so every field is enforced in our contract or nowhere.

It prices as a constant product — and that is a real limit rather than a stylistic one. The price is the ratio of the two sides, so a maker holding only USDC has no price at all. Which is exactly the maker this product is built for: their USDC is earning in a lending market, and a fill is settled out of it mid-swap.

HelicoOracleBoard quotes that maker from a Chainlink feed, and brakes itself on Aqua's own ledger:

bid = mid × (BPS − spread − skew) / BPS
ask = mid × (BPS + spread − skew) / BPS

Both sides shift down as base inventory accumulates, so selling into the board gets steadily worse and buying the inventory back gets steadily better. Inventory is pushed home by the price rather than by anyone watching — the behaviour a constant product gets for free, rebuilt on top of a feed that knows nothing about who holds what.

Against the live ETH/USD feed on Arbitrum One:

chainlink ETH/USD  2483.504394
bid                2476.053880    empty inventory, the feed less 0.30%
ask                2490.954907
bid, half full     2451.218836    bent by half the skew

What they refuse, and why each refusal is named

• A maker with debt, at the venue the swap actually draws on. A lending market blocks a borrower from withdrawing collateral, so one ordinary borrow would otherwise disable a mandate and the failure would arrive as the market's error after the mandate looked fine.
• A venue that does not match the pool. A receipt token is an address the maker writes into their own mandate, so anything it says about itself could have been made up. The pool is asked which receipt it issues, not the other way round.
• A stale feed. The board refuses the fill rather than quoting yesterday's number.
• A quote that answers for a swap that would revert — the quote applies the same rules the swap does, or an agent builds a transaction that cannot land.

A venue that simply cannot pay is skipped, not fatal: liquidity is one of three conditions, and ending the search at the first strands a funded market further down the list.

Never an approval

Aqua's ledger is the only way this code moves anyone's tokens. It never takes an ERC-20 approval for a user's assets — not for a token, and especially not for a lending receipt. An approval outlives the mandate, ignores the ceiling, and survives dock. The ledger does none of those: it is a number the owner shipped, it falls as it is spent, and docking destroys it.

SwapVM

Powered by SwapVM — © Degensoft Ltd 2025. contracts/src/swapvm/ is a redeployment of Degensoft's AquaSwapVMRouter with one instruction added. Their VM, transfer phase, Aqua accounting and every published instruction are unchanged; the addition is opcode 34, marked as ours under their licence.

Why it exists: every SwapVM curve prices against balanceOut, and Aqua answers that from what the maker shipped — a number written with no transfer and no balance check. So a maker may commit 43,000 USDC while holding 5,000. The curve is right; what breaks is the transfer at the end, because tokens earning yield elsewhere are not there to pull. No published instruction can close that — none of them has a concept of a lending market. Ours unwinds exactly the shortfall, once, inside the transaction that needs it.

Deployed

The README points at the exact lines behind each claim here, pinned to the commit they were read from.