Security Model

RAVN is an orchestration layer, not a custodian. It finds routes and normalizes execution. It never holds, wraps, or mints user funds.

​

Non-custodial

• The user signs or sends directly to the venue. RAVN never takes custody of funds at any point in a swap.
• For DEPOSIT routes, the user sends the origin asset to a venue-generated address. For SIGNATURE and TRANSACTION routes, the user signs or broadcasts directly. A broadcastViaRavn transaction is signed by the user and sent by RAVN as signed, after a check.

​

The real token out, and no bridge of our own

RAVN routes through RFQ market makers, intent networks, solver and relayer networks, validator-vault networks, and on-chain DEX aggregators. You always receive the real token, never a wrapped copy (only one you picked, like WBTC). RAVN runs no bridge of its own. NEAR Intents moves coins in and out through its own bridge, so on its routes your deposit is held as a matching token on NEAR for the minutes the swap takes. Every quote names the winning venue.

​

Checked before the wallet

@ravnexchange/sdk (0.3.0 or later) checks every execution before it can reach your user’s wallet, against what they asked to swap: transactions only to the contracts RAVN’s venues use, only the input token, at most the input amount, RAVN’s fee at most 1% and only to RAVN’s own wallet, only known kinds of signature. The SDK ships through npm, apart from RAVN’s servers, so on EVM chains and Bitcoin even a compromised RAVN couldn’t use your integration to empty a wallet: the most at stake is the amount being swapped. On Solana, give the SDK your Solana RPC (0.3.2 or later): it then simulates each transaction there and holds every transfer out of the user’s SOL and SPL token accounts to the swap, as the chain stands at that moment; without one, the wallet’s simulation covers what a venue program’s own instruction moves. RAVN’s server runs the same check on every venue’s answer before handing it out. See the check before the wallet.

​

Quote integrity

• Quotes are returned as an opaque, signed quoteToken. It is tamper-evident, so any modification of the amount, fee, or route invalidates it, and execution rejects it with QUOTE_INVALID.
• Quotes expire, and execution re-validates the expiry before building the transaction.

​

Venue-enforced settlement

Each venue independently validates the economics and signatures of the order it settles. RAVN never asks a user to sign anything the destination venue will not verify on its own.

​

Gasless where it counts

On RFQ and gasless venues, the user needs zero native gas. They sign an off-chain message and a solver covers execution. The user only ever needs the asset they are selling.