Swaps

Token safety

Anyone can deploy a token called "USDC" on Elysium, and several people have. The router has three layers of protection, all visible in the API so your UI can show them.

1. Verified list

Each network file carries a curated verifiedTokens list (address, symbol, name, decimals, logoURI, tags). Verified tokens:

have verified: true in /tokens, /tokens/{address},
come first in /tokens,
are the only ones returned by /tokens?strict=true (the "strict list", for UIs that only want known tokens).

The list lives in api/networks/<network>.json and is reviewed by hand. On mainnet it's checked against Kinetiq's published addresses on launch day.

2. Automatic warnings

warnings (on tokens, and prefixed in: / out: in a quote) can contain:

Warning	Trigger
`impersonator: same symbol as a verified token`	Unverified token whose symbol matches a verified one (e.g. a fake `USDC`)
`duplicate symbol: 0x… has more liquidity`	Another token with the same symbol has more live pools. You probably want that one
`honeypot: buying works but selling fails`	Probe result
`transfers to other wallets are blocked`	Probe result: a transfer from a holder to another wallet reverts
`buy tax ~X%`, `sell tax ~X%`, `transfer tax ~X%`	Probe result, shown above 0.1%
`launchpad token (pre-graduation): …`	The quote is on a bonding curve

3. Honeypot and tax probe

The probe runs a simulated buy → transfer → sell of a token inside one eth_call, using TokenProbe.sol injected with a state override: the contract is never deployed, and nothing is sent.

The probe contract gets 1 HYPE through the state override, then buys the token for 0.001 HYPE through the router's best route. The shortfall between what the quote promised and what arrived is the buy tax.
It transfers part of it to another address. The shortfall is the transfer tax; if nothing arrives, transfers are blocked.
It sells the rest back to HYPE through the best sell route. If the sell reverts while the buy worked, it's a honeypot. Otherwise the shortfall versus the sell quote is the sell tax.

Anything under 0.1% counts as rounding noise, not a tax.

Result (check field):

"check": { "status": "taxed", "buyTaxBps": 300, "sellTaxBps": 500, "transferTaxBps": 0, "transferBlocked": false, "checkedAt": 1762400000 }

status is ok, taxed, honeypot or unknown (the probe couldn't find a route or a revert was ambiguous).

When it runs:

In the background, every hour, over the 300 most-traded tokens (first sweep 30 s after start).
On demand, the first time someone calls GET /v1/tokens/{address} for a token that was never checked.
When a quote touches a token whose result is missing or older than 6 hours, a re-check starts in the background (that quote uses the cached result).
Results are kept with the indexer snapshot.

How the quote uses it:

A honeypot output token → 422 honeypot: this token can be bought but not sold. The API won't build that trade.
Taxes are deducted from amountOut and minOut (taxBps), so taxed swaps don't fail on slippage and the user sees the real number.

On-chain backstops

Even if the API is wrong about a token, the contracts protect the swap:

The Executor measures actual balances at every hop, so fee-on-transfer tokens are handled correctly.
minOut is checked against what the recipient actually received.
A token that blocks transfers makes the simulation fail, so you get simulation.ok = false instead of a reverting transaction.

What it can't catch

A token whose owner can change its tax or block sales later (the probe sees today's behavior only).
Rug pulls: liquidity being withdrawn after you buy.
Taxes that depend on the amount, the time, or the wallet in ways a small simulated trade doesn't trigger.

Treat verified as the strong signal and warnings as hints.

Next: Errors and limits