Sato Swap
The swap that refuses
The only swap rail that will not fill a trade into something it cannot identify. Every quote names what it checked, what it found, and what it declined.
Start from an example
intent parses · every required field present
How it decides
1. Four targets are read — the input token, the output token, the venue and the recipient. Each reading names the rule that produced it.
2. A policy decides what those readings permit. Unknown refuses unless a stored policy says otherwise in writing.
3. Venues that quote the pair are ranked within their own lane, and the chosen one carries its own fee sentence.
4. In build-tx the transaction is simulated before it is handed back. If it reverts, you get the revert instead of the object.
Four targets, every quote
awaiting an intent- ·Token innot asked yetrule pending
- ·Token outnot asked yetrule pending
- ·Venuenot asked yetrule pending
- ·Recipientnot asked yetrule pending
Unknown refuses by default. A hollow hexagon is a target nothing was read for — that is not a finding against it, and it is not a pass either.
Post an intent and the answer builds here: the four readings, the policy that decided, the venue ladder with its fee sentence, the simulation, and either an unsigned object or the reason there is none.
What a gate decision is, and is not
A gate decision names what was checked, under which policy, and when. It is not a security review, a price opinion, or a statement about returns. Unknown means we hold no record — under a refuse-on-unknown policy that is a refusal, not a finding against the target.
Two modes, and only two
recommend
The chooser result, the fee disclosure and the verdicts. Never calldata, whatever the gate said — an agent can ask what it should do without being handed something it can sign by accident.
build-tx
The same, plus the unsigned transaction — and only when the policy allowed every verdict and the transaction did not revert in simulation. Otherwise you get the reason instead.
Sato never signs, holds or sends. What comes back is an unsigned object; you read it, you sign it, you broadcast it.
The default policy, stated
No stored policy applies to this caller, so the Sato Swap default policy was used: refuse on unknown, allow on caution, no Passport requirement, and a per-trade ceiling of 1000000000000000000 base units of the input token.
Unknown refuses by default. We hold no record for that target, and no record is not the same as a clear reading — a policy has to say so in writing before a swap is built on it.
The fee
Stable ↔ stable
3 bps
Any volatile leg
15 bps
Unsigned or failed
nothing
Sent as a fee parameter on the venue’s own quote, inside the transaction you sign. Several venues keep a share of it or take it on a different leg; the quote prints that venue’s own sentence rather than ours. Treasury: 0xcEE53Eb001d4d1743EF9df333Dcf45bC38622bE9.
Sato Swap is not investment advice, not a broker, and not a guarantee of execution, price or outcome. Routing to a venue is not an endorsement of it. Related: How Swap decides · Sato Route · How Route chooses · Preflight · House rules · OpenAPI