FILL
sepolia · 2 solver bots competing on this box right now

Every swap.
An auction.

Sign your trade. Solvers fight over who gets to fill it. Whatever extra they squeeze out vs. the AMM is yours, not the bot's. We don't skim.

  • v4 hookopt in per pool. no router migration, no aggregator lock-in.
  • gaszero on submit. you sign, you don't pay. fee comes out of surplus.
  • if nothing fillsyour tokens never moved. order expires, wallet unchanged.
ready
you sell
min @ 0.5% slipno route
slippage
deadline
solvers online
0
open orders
0
fills · 24h
0
fills · all-time
0
v4 hook · ships as a single contract·two solver bots fighting on this box·surplus → user · always·fee → stakers · 0% today, ≤2% cap·permit2 means zero gas on submit·order didn't fill? wallet didn't move.·21 forge tests · CI blocks red·2 critical findings · patches in flight·external audit gates mainnet·v4 hook · ships as a single contract·two solver bots fighting on this box·surplus → user · always·fee → stakers · 0% today, ≤2% cap·permit2 means zero gas on submit·order didn't fill? wallet didn't move.·21 forge tests · CI blocks red·2 critical findings · patches in flight·external audit gates mainnet·
// what actually happens

Three solvers walk into a bar.
You pocket the tip.

The diagram on the left isn't a mockup — that's the auction shape. Solver A is fastest, B stalls mid-race, C is just bad today. Whichever one quotes the best price wins the order. The bit they beat the AMM by? That's the surplus. It goes to you.

ready · gates closed
step 01
sign · zero gas
step 02
solvers race · best bid wins
step 03
surplus · 100% to user
orderbook idle · waiting for the next fill
// in plain english

It's just signing a piece of paper. No new router.

STEP 01v4-hook

You sign

An EIP-712 message. Says "I'll trade X for at least Y, valid until Z." That's it. No transaction sent. Permit2 means we don't even pull tokens until a fill lands.

STEP 02v4-hook

Bots fight

Our solver bots — and anyone else who wants to write one — read your order off an open orderbook. They compete on who can deliver more Y. Whoever quotes best, wins.

STEP 03v4-hook

You get paid

Settlement transfers Y to your wallet. If a solver quoted 1.03Y for your 1.00Y minimum, you get 1.03Y. We don't take that 0.03. No team treasury skim, no "fee on top."

// the comparison chart we made ourselves

Where we sit.

Yes, this is the table where we look best. We're aware. The honest read: UniswapX and CoW are real products that ship today; we're a v4-native variant that doesn't ask you to migrate routers. Pick whichever fits — we just wanted the v4 version to exist.

 AMMUniswapXCoWFill
solver competition—✓✓✓
surplus to user—partial100%100%
v4 pool native✓——✓
aggregator-compatible✓——✓
no new router———✓
amm fallback safen/a——✓
// the $FILL token

The token does
two things. That's it.

01 · SOLVER BOND

Solvers post a bond

If you want to settle batches at any kind of scale, you put $FILL up as collateral. Misbehave — settle a bad batch, fail to deliver — and your bond gets slashed. The slashed $FILL goes straight to stakers. Solvers eat the loss, stakers eat the cake.

min bond
1,000 $FILL
unbond delay
14 days
slashed →
to stakers
02 · STAKE

Stakers get the fees

The protocol charges a small fee on each fill, paid in whatever the user sold. We don't keep it. Anyone can push the accrued fees to the staking contract with a permissionless call — they get distributed pro-rata, in the original token, same block.

stake lock
7 days
protocol fee
≤ 2% (gov-tunable, starts at 0)
reward tokens
up to 16, paid in the real asset
// fee flow, end to end
you sign an ordersolver fills it · pays feefee → stakers, pro-rata

No buy-back-and-burn theatre. No "treasury allocation." No emission schedules that pretend to be yield. The fee literally moves from one contract to the other in a single pushFeesToStaking() call. If that call doesn't fit the kind of yield you like, we're not the protocol for you, that's fine.

// security · the honest version

We audited ourselves before paying anyone.

Found two CRITICAL issues on day one — both in the settlement contract's interaction model, both have fixes in flight. We wrote up the full audit in AUDIT.md. Mainnet is gated on an external auditor signing off after our fixes land. No shortcuts.

forge tests
21 / 21
every commit. CI blocks merges on a single red.
audit · internal
DONE
2 critical findings open. fixes in PR. external audit gates mainnet.
permit2 replay
NONE
nonces are single-use per signer · canonical Permit2 enforces it
contractroleaddress (sepolia)
FillSettlementbatch settlement · pulls via Permit2 · pays users0x0481…Fc03 ↗
FillHookv4 hook · routes opted-in pools through Fill0x2c1f…8088 ↗
$FILL tokensolver bond + staker reward0x00f2…D94c ↗

sepolia only. mainnet ships when an external auditor signs the report. that's the gate. we're not racing.

// questions we kept getting

Stuff people ask.

How is this different from just swapping on Uniswap?
Uniswap pays you the curve price — the math says 1000 USDC gets you 0.32 ETH, you get 0.32 ETH. Fill makes solvers compete to beat that math. If one of them can find a path that gives you 0.3208 ETH, you get 0.3208. Same minimum protection (you set your own minOut), but if there's any slack between the curve and the real market, it ends up in your wallet instead of an MEV bot's.
Do I have to trust the solver not to rug me?
No. The signed order has a minimum-out you set. The settlement contract pulls your tokens via Permit2 inside the same transaction that pays you the output — atomically. If the solver can't deliver your minimum, the whole transaction reverts and your wallet looks exactly like it did 5 seconds before you signed. There is no "send first, hope later" state.
What if no solver shows up?
Nothing happens. Your order has a deadline (default 60s for market, up to 7d for limit). When it passes, the orderbook marks it expired and forgets it. Your wallet is untouched — Permit2 hasn't pulled anything, you paid no gas. Worst case: you walk back to Uniswap and swap there.
What's the fee right now?
Zero. We turned it off until our two critical audit findings are patched and an external auditor's signed off. After that, governance can set it up to 2% (hard-capped in the contract). Whatever it lands at, the fee goes to $FILL stakers — not to us.
How is this a v4 thing?
FillSwap is a v4 hook. A v4 pool opts in by passing a flag in hookData on swap; the hook checks the orderbook, and if there's a Fill quote that beats the curve, the swap routes through us. If not, it falls back to the AMM. We're not asking anyone to migrate liquidity or replace their router — just to opt in per pool.
Is the code open and verified?
The Sepolia contracts are verified on Etherscan (links above). The audit lives in AUDIT.md. The public repo opens when the external audit publishes — we don't want a half-written repo to be the first thing someone forks before the fixes land.
Who's behind this?
Two of us, working remotely. We're not raising, we're not selling points, we don't have a token sale page. The orderbook and solver bots are running on a single Linux server we pay for. Sepolia first, mainnet when the audit clears.
// note from us
every time we swap on a public chain we lose 5-30 bps to mev. that's our money. the bots get it. we got tired. so we wrote this. you sign once, two solver bots fight over your order on the orderbook running 8787 on this server, and whoever quotes better gets to fill. the surplus is yours. the protocol takes a fee — eventually — and routes that fee to people who staked the token. no allocation to "team", no schedule to "advisors", no points farms. if that's weird in 2026, we're fine being weird. mainnet ships when an external auditor signs off, not before. mostly because we found two critical bugs on ourselves opening day. better than discovering them in prod. — the two of us · sepolia · 2026
// early access

First 500 wallets in. Then we slow down on purpose.

If we onboard everyone at once we'll discover bugs the loud way. We'd rather do it the quiet way — small group, real fills, fix things before scaling.