Private Swaps - Veilify

A private swap spends notes of the input token, trades through a Uniswap V2 router as the pool, and credits a note of the output token to the swapper.

Flow

What the proof binds

selector: which router function
routerArgs: amountIn, amountOutMin, path[4], pathLength, deadline
receivingKeyCommitment: Poseidon2(rkHash, trapdoor) for the output owner
ciphertextSwap[6]: header and owner fields of the output note
UNISWAP_V2_ROUTER: supplied by the contract as public input #1

The output amount isn’t known when proving. The contract completes the output note with the measured amountOut, the output token and a zero value trapdoor.

Protections

Rule	Why
`amountOutMin > 0`	A zero floor hands a sandwich the entire swap
`deadline ≤ now + 30 min`	A proof can’t be sat on until the price moves
All path tokens whitelisted	No swaps into unvetted tokens
Paused by `withdrawalsPaused`	The input leaves the pool, so a swap is an exit
Router fixed per implementation	`UNISWAP_V2_ROUTER` is an immutable and a public input

Robinhood Chain requirement

UNISWAP_V2_ROUTER is set in the implementation constructor. Swaps go live only after a V2-compatible router, its WETH and usable liquidity are verified on Robinhood Chain.