Hey, thanks for all the updates here.
Since my previous M2 analysis, I’ve seen that several of the points I had marked as incomplete have now been delivered or substantially progressed, while some others were moved into the revised M3 scope. The main thing I’d like to see is a clear reconciliation of the scope: what was originally committed, what was delivered in M2, what moved to M3, and what still remains open.
Thanks for the feedback, @Kaf_Anode .
I agree that a clear reconciliation between the original M2 commitments, completed deliverables, and items moved into M3 would make the transition clearer.
1. Split routing algorithm
The split routing algorithm has been implemented and validated through comparison testing.
The original verification method was to build a public comparison page using both SwaptoX API and OpenOcean API.
The comparison page has been deployed publicly and tested multiple times with different tokens and trade sizes.
2. API optimization and infrastructure improvements
Cloudflare integration has been completed. Although the measurable latency improvement is limited due to RPC and backend factors, it improves global accessibility and infrastructure reliability.
3. Router governance upgrade
Developed the SwaptoXTimelock governance contract for future governance upgrades, fee management, and controlled contract changes.
4. Audit plan
Completed the audit preparation phase:
The audit process can proceed independently from M3 development.
The following items are UI-related improvements and have been moved into the revised M3 scope:
5. UI improvements
Including:
The current M3 scope includes:
Migrating the frontend to a React/Next.js architecture.
Developing the SwaptoX Widget component (previously referred to as Mini-SDK) to allow other DApps to quickly integrate swap functionality.
Creating developer documentation for the API and SwaptoX Widget.
Building a mobile-optimized application using SwaptoX Widget:
This will be used as the mobile-focused product entry point for future user acquisition.
Completing the UI-related items deferred from M2.
The detailed M3 scope can be found here:
Since @ChronoTrigger has already started the internal discussion regarding audit funding, the audit process can continue in parallel with M3 development.
To avoid unnecessary delays, I will prepare the M3 proposal for voting. Any additional questions or concerns can still be raised during the voting period.
Thank you everyone for the feedback and support.
I support releasing the final M3 funding.
The project has made substantial progress since the original M2 review, and the updated scope now gives a clearer separation between work completed in M2 and the UI, frontend, widget, documentation, and mobile deliverables to be completed in M3.
That said, I agree with @Kaf_Anode’s conclusion that M2 should remain formally open until the final delivered/deferred scope and outstanding security and testing items are verified. Releasing M3 funds should not be interpreted as closing M2 or as confirming completion of the timelock, fee-lock, or audit-related requirements.
The remaining audit funding decision and final contract deployment should continue as separate, evidence-based steps. Clear reporting against the revised M3 scope will be important before final closure.
Thanks @SwaptoX, the reconciliation is helpful and the M2 to M3 split is much clearer now. One correction on the audit plan item though. The quotes are collected, which is real progress, but the provider, the scope and the funding are all still open, so I would record that one as in progress rather than complete. The internal discussion I started is not a decision yet and I would not want it read as one.
On that, the main direction being explored internally is an agreement with Areta so builders have an audit route they can rely on with support from the Collective, rather than each grant negotiating its own arrangement. Nothing is final yet, but could you reach out to them and ask for a quote on the Router plus Timelock scope? Having a real number from them to compare against would move this along, and I would suggest waiting for it before committing to a provider.
The other thing worth fixing while the record is being tidied. The deferred list covers the four UI items, but the Timelock deployment and the 2028 fee lock verification are not in it, and in your earlier post those were going to be verified against the final audited version during M3. As written they sit in neither column. Adding them to the M3 side would keep it consistent with what @Axia noted about M3 funding not confirming those items. With that, I am supportive of M3 going ahead and will vote in favor.
Supported M3. Grateful to @Kaf_Anode — the milestone analysis clarified and shared an itemized picture of where M2 actually stood, and it also gave @SwaptoX the opportunity to respond and show progress addressing points delegates had raised, providing greater milestone clarity.
Thanks @SwaptoX for the detailed M2/M3 breakdown already shared in this thread — and it may be useful to do the same for the full project: total grant funds received to date, what’s been delivered against each milestone’s original scope, and what remains outstanding, along with audit spend once that parallel conversation is resolved, so the Collective has a complete picture of what this solution actually cost.
This grant’s original timeline had all three milestones completing within 3 months, and we’re now roughly 8 months in — all justified, but it’s a pattern worth the Collective learning from and how we best keep track of changes as they happen.
Thank you everyone for the votes. I see that Milestone 3 has reached the required quorum.
I agree with @ChronoTrigger that the audit item should be recorded as in progress rather than completed.
I will contact Areta to request a quotation for the SwaptoXRouter + SwaptoXTimelock audit scope, so we can compare it with the existing proposals and make a more informed decision.
Additionally, I will update the M3 scope to include the following items:
Currently, SwaptoX has received $9,000 in grant funding, and Rootstock is the only ecosystem where SwaptoX has received funding. No other ecosystem grants have been awarded.
Current overall development progress:
Regarding audit funding, the final decision has not been made yet and is still under discussion.
The total approved grant amount for SwaptoX is currently $18,000.
The original proposal timeline was:
Later, the revised V2.1 proposal changed the milestone structure to:
After completing Milestone 1, the milestone structure was adjusted again:
Milestone 1 was approved on March 2, 2026.
The project has taken longer than the original schedule, mainly because additional technical scope was introduced, including split routing development, Timelock governance design, audit preparation, and the related review process.
I requested audit quotations through Areta and have now received 11 proposals.
The proposed audit scope covers:
SwaptoXRouter.sol
SwaptoXTimelock.sol
Below is a summary of the proposals and my assessment.
Quote: $9,000
Team:
2 Senior Researchers
1 CTO providing overall technical oversight
2 team days for the initial/interim audit
1 team day for re-audit and review of fixes
MixBytes explained that the lower price compared with their previous quotation is due to increased audit efficiency and optimized internal processes using AI tools, without compromising audit quality.
Quote: $10,950 or $20,440
Two service options were proposed:
Option 1 — Human-Led, AI-Assisted Security Review: $10,950
1 senior human security researcher
Supported by Oak’s AI tooling
Option 2 — Redundancy-Focused Team Audit: $20,440
2–3 independent human auditors
Overlapping review by multiple auditors
Supported by Oak’s AI tooling
Quote: $5,000 (ex-GST)
The proposed scope includes:
Manual line-by-line code review and standards compliance review
Manual penetration testing and simulated protocol interaction testing
Static and dynamic analysis
Tool-assisted security analysis
Gas optimization analysis
Up to 2 rounds of code re-review after fixes
Additional services included at no extra cost:
Bug bounty program hosting, including setup, rules and initial triage
PR campaign with up to 10 promotional channels after the audit
Social media and website certification graphics
Initial quote: $3,000
No formal quotation document was provided. The exact scope and team configuration would need to be confirmed directly with Beosin.
Quote: $20,000
No formal quotation document was provided.
Dedaub proposed a full security audit of SwaptoXRouter.sol and SwaptoXTimelock.sol, covering approximately 1,040 lines of Solidity.
5 audit days
Senior Dedaub auditors
Proposed start date: September 13, 2026
Proposed completion: September 18, 2026
Quote: $5,300–$8,300
The proposed audit objectives include:
Vulnerability detection, including reentrancy, overflows and logic flaws
Risk prioritization and severity assessment
ERC standards and security best-practice compliance
Security hardening against attack vectors and unexpected behavior
Functional reliability and edge-case testing
User asset protection and transaction integrity
Multi-sig and administrative security review
Operational security review, including key management, network security, API/RPC exposure and access control
Quote: $8,500
Included services:
Manual audit — 3 days of line-by-line review
AuditHub AI Agent security scan
Static analysis using the proprietary Vanguard tool, with findings manually triaged
Specification-guided fuzzing using OrCa
Official publishable audit report
Fix validation included for 4 weeks after the audit
Their tooling runs in parallel with the manual review to increase coverage.
Quote: $8,000
Bailsec proposed a 2×2 competitive hybrid audit model, including:
Two independent audit teams working in parallel
At least 4 senior auditors in total
Independent reviews without teams seeing each other’s progress
Aggregation, deduplication and severity assessment of findings by a lead
An additional AI-assisted security review layer
Human validation of all AI-generated security signals
Quote: $8,000
Standard price: $12,000
The proposal calculates the standard price based on 2 security researchers × 3 days × 8 hours/day × $250/hour/researcher. The discounted investment for SwaptoX is $8,000.
Audit period: 3 business days
Team:
2 security researchers
Additional auditors can be added if necessary without increasing the client’s cost
Other notable aspects include:
Iterative remediation and re-audit process
Joint kickoff and code walkthrough
Architecture and trust-assumption analysis
AuditAgent security tooling
AgentArena for additional security analysis
Co-marketing support at no additional cost
Quote: $5,200
Softstack uses a transparent code-size-based pricing model:
1,040 nSLOC
Base rate: $500 per 100 nSLOC
Complexity factor: Low
Calculation: 1,040 / 100 × $500 = $5,200
Estimated delivery: 5–7 business days
Team:
1 Lead Auditor
2 Senior Web3 Auditors
1 Junior Web3 Auditor
Total: 4 auditors.
Quote: $7,000
Team:
4 auditors
4 audit days
Full remediation support throughout the process
Hexens has relevant audit experience with projects including:
1inch
EigenLayer
Lido
LayerZero
PancakeSwap
The proposal also includes post-audit support and additional security/marketing benefits.
Because there was clear competition among multiple audit firms, I believe the competitive quotation process resulted in significantly better pricing than some of the earlier quotations I received.
I also contacted Areta regarding the payment process. I was informed that the project is expected to work directly with the selected audit firm, while Areta does not participate in the transaction or payment process.
Therefore, the idea of having Rootstock make a single payment to Areta and have Areta distribute the funds to the auditor does not appear to be feasible.
However, I would support Rootstock paying the selected audit firm directly, if this is possible under the grant process.
After reviewing all 11 proposals, I recommend the following three firms:
Strongest DeFi-specific technical fit.
MixBytes has particularly relevant experience with DEX aggregators, routers and DeFi infrastructure, including work related to 1inch and OKX DEX Router. Their experience is closely aligned with the security model and technical complexity of SwaptoX.
Strongest overall combination of security expertise, Ethereum ecosystem credibility and long-term value.
Nethermind combines smart contract security with deep Ethereum infrastructure and engineering capabilities, providing broader technical depth beyond a conventional audit engagement.
Strong dedicated security-audit focus and strong auditor allocation.
Hexens proposes 4 auditors working for 4 days, with full remediation support, and has relevant experience auditing major projects including 1inch, EigenLayer, Lido, LayerZero and PancakeSwap.
I would be comfortable proceeding with any of these three firms. The final selection is ultimately up to the Rootstock representatives, and I fully respect whichever firm they consider the most appropriate.
Hey SwaptoX,
Thank you for the thorough job of compiling and reviewing these quotations
I agree with the three you highlighted as well.
Curious to know your assessment on Hashlock, I found the price competitive, with additional benefits at no cost, their quote document looks solid. I understood from the quote that the code is reviewed by a human auditor, as well as tool-assisted (i.e. AI), and their track record includes 1Inch, Sushi Swap, Eigen Layer, Rocket Pool and Gala Games.
For easy reference:
I think it’s important other community members pitch in as well, including Tamara, from Rootstock Labs, as she’s participating in the discussions about audit funding. Tagging @tamlerner @Raphael_Anode and delegates @Axia @Curia @SEEDGov @DAOstar_gov @DAOplomats @Kaf_Anode @Tane @PGov
Hey ChronoTrigger. Thanks for keeping this top of mind. We have an open line of communication to Areta for a potential deployment of their audit market. However the program seems not right sized for the Collective at this moment. We’re looking to see if there’s a potential adaptation that would fit.
In the meantime, since @Kaf_Anode is already doing some technical evaluation, we’d be more than happy to facilitate a similar audit matching fund that is tailored to the volume and builders in the Collective.
The biggest question here is of course if the funds for this are available or can be procured. Leaving this to @tamlerner and @sascha.collective.
Appreciate the work here, SwaptoX. Beyond the quotations themselves, a separate question for the Rootstock team on this one: I’m wondering what Rootstock’s future plan is for other projects that will need audit funding down the line. @Raphael_Anode mentioned that he’s already talked to Areta about deploying their audit market but that it’s not right-sized for Rootstock’s current state. Is there a plan to subsidize part of future audit costs for grantees?
I think that’s the right question to be asking, would be great to have clarification from the foundation. @tamlerner @sascha.collective
Sorry for the delayed response. I recently received three additional audit quotations:
1. HackenProof
Quotation: https://cdn.swaptox.com/audit-quoter/2/offer_SwaptoX_HackenProof.pdf
Audit fee: $5,500 USD
Audit duration: 7 business days
Team & testing model: A hybrid crowdsourced model. 1–2 independent auditors from the TOP 20 members of the HackenProof community would conduct the primary testing, followed by a final review by HackenProof’s internal expert team.
Deliverables & management: Real-time access to the audit report, a centralized vulnerability tracking system with labels and status updates, remediation verification, and a final comprehensive security report.
2. Consensys Diligence
Quotation: https://cdn.swaptox.com/audit-quoter/2/offer_SwaptoX_Consensys%20Diligence.pdf
Audit fee: $30,000 USD standard price, discounted to $18,000 USD for a long-term partnership
Audit duration: 1 calendar week
Team: 2 security experts
3. Sherlock
Audit scope: 3 days
Engineering team: Option of 2 or 3 engineers
Includes: Official Fix Review and Audit Report
1 Elite SR + 2 Sherlock SR: $9,500
1 Elite SR + 1 Sherlock SR: $7,750
2 Sherlock SR: $6,750
Thanks for pointing this out. I had reviewed the quotations with AI assistance, but I missed Hashlock’s previous audit experience with 1inch and SushiSwap.
After taking a closer look, I agree that Hashlock is also a strong option worth considering. The $5,000 quote is quite competitive, especially with two re-review iterations, bug bounty triage, and the additional benefits included at no extra cost.
Hi @ChronoTrigger! To ensure complete transparency regarding the security audit proposal from Hashlock, we reached out to their team with a set of specific questions. Below are the questions and their official responses:
Hashlock Response: I’l prepare a list of auditors, that I feel would be the best fit for this audit specifically and send it over for you to review! Then you can also chose who you prefer, in case you favor one over another. Now, for this size we usually do 1 senior researcher with relevant experience on the specific tech stack. Happy to add another one if you’d like, but that would also mean a related increase in the price-point. (Note: It is worth noting that the $5,000 baseline fee only includes one security researcher).
Hashlock Response: This refers to the ‘initial’ audit. The overall timeline depends on you as well and how fast your team goes through with the fixes basically.
Hashlock Response: Yes, you are absolutely correct. This price point includes the 2 fix reviews within the original scope, with no additional charges for that.
Hashlock Response: Yes, this promotion is included in the price point and there are no additional costs for you. We do offer a ‘premium’ PR as well via Coingecko, but that’s a paid service.
Hashlock Response: It covers the setup, management and triage of submissions in conjunction with your team. It doesn’t cover the payout to the researchers as that’s up to the project and how much they want to offer in their bug bounty. That’s also why it’s optional as some projects don’t go for it, if they are early stage for example.
Hashlock Response: Yes I can confirm that the $5k fee is all inclusive for the audit including the two fix reviews, plus the complimentary PR, with no additional charges taxes for you.
If we consider adding a second security researcher to Hashlock’s proposal for cross-auditing and enhanced security, their price would increase to $7,000.
Compared to the $7k price point, Hexens becomes a much more compelling choice. For a superior configuration, Hexens is providing a team of 4 elite security researchers with extensive man-hours.
You can review the profiles of the 4 assigned Hexens auditors here:
Hexens is able to offer this top-tier audit configuration because SwaptoX has been accepted into the Hexens Builder Support Program: https://hexens.io/pages/builder-support-program
Congratulations on getting accepted in their builders program!
Hi everyone,
The scheduled delivery date for Milestone 3 has arrived, and I’m sorry to announce that I need to request another extension. Milestone 3 covers a relatively broad scope, and I’ve also taken some time to rest recently. As a result, I need a little more time to complete the remaining integration and documentation work.
The swaptox-widget (SDK) is now complete. The remaining work mainly involves integration, documentation, and finalizing the other deliverables. I plan to deliver Milestone 3 by October 30, 2026.
Here is a brief overview of the Milestone 3 deliverables:
swaptox-widget (SDK)
The SDK is complete. Detailed feature descriptions and usage instructions will be provided in the documentation.
app.swaptox — React / Next.js Architecture
Transitioning the main application to a React / Next.js architecture.
mini.swaptox — Mobile-Optimized Swap Interface
A mobile-focused interface built with swaptox-widget, optimized for mobile devices.
API and SDK Documentation
Comprehensive documentation covering API endpoints, SDK features, integration, and usage.
Security Audit and Contract Verification
This item depends on the judges confirming the audit budget and selecting an auditing firm. Discussions are still ongoing, so the timeline will depend on those decisions.
The split-routing comparison page remains available and the results continue to hold up in my recent development and testing. Across multiple tests, SwaptoX has maintained a win rate of 60% or higher against the comparison baseline.
Everyone is welcome to check the results at any time:
I’ve also included screenshots below showing some of the more complex routing scenarios handled by SwaptoX.
Thank you for your patience and continued support. I apologize for the delay and will focus on completing the remaining work and delivering Milestone 3 by October 30.
