Separate intent, authorization, and custody.

System boundaries

• Wallet client: displays balances and quote terms, then requests the trader's transaction and EIP-712 signatures.
• RFQ service: routes pre-trade intent and verifies solver-signed exact quotes without taking custody.
• Compliance registry: records time-bounded eligibility used for new deposits and execution.
• Solver: prices requests, signs exact quotes, supplies output inventory, and submits accepted fills.
• Settlement contract: tracks liabilities, validates trader orders, consumes nonces, enforces minimum output, and moves assets atomically.

Execution flow

wallet -> shield -> wallet balance
wallet -> offchain RFQ -> solver-signed exact quote
wallet -> trader EIP-712 order -> selected solver
solver -> public settlement -> atomic fill
wallet -> unshield -> same wallet

Trust and visibility

Solvers and RFQ operators can observe requests sent to them. The registry operator controls eligibility, and the contract owner controls bounded administration such as pause and asset configuration. Wallet private keys remain in the wallet.

Only pre-trade RFQ intent is private/offchain; shield deposits, contract balances, final fills, and unshield withdrawals are public onchain.