Token Risk Engine
Because Sweepster accepts any ERC-20, every quote is gated by the Token Risk Engine. A token that fails the screen is declined before any settlement occurs.
Why screening is necessary
Accepting arbitrary ERC-20s exposes the service to:
- Fee-on-transfer tokens — tokens that deduct a fee on every transfer, causing the received amount to be lower than expected
- Honeypot tokens — tokens with sell-blocking mechanisms that cannot be swapped to the canonical asset
- Illiquid tokens — tokens with insufficient DEX depth to fill the swap without extreme slippage
- Oracle manipulation — tokens whose price can be cheaply manipulated relative to the oracle price
The Token Risk Engine screens all of these before a quote is issued.
Screening pipeline
Each token goes through a tiered sequence of checks:
1. Liquidity-depth check
→ Is DEX depth sufficient to fill the amountIn with acceptable slippage?
2. Oracle/DEX price sanity
→ Is the Chainlink (or TWAP) price within tolerance of the DEX spot?
3. Fee-on-transfer detection
→ Does the token deduct a transfer fee?
4. Honeypot / sellability simulation
→ Can the token actually be sold to the canonical asset?
5. Tier classification
→ Assign tier1 / tier2 / tier3 based on combined risk signal
6. Dynamic fee adjustment
→ Higher-risk tiers incur higher feesA token that fails any check is declined with a reason. The orchestrator returns a 422 with the decline reason.
Tier classification
| Tier | Risk level | Typical characteristics |
|---|---|---|
tier1 | Low | Major stablecoins, blue-chip ERC-20s with Chainlink feeds and deep liquidity |
tier2 | Medium | Mid-cap tokens with DEX liquidity but no Chainlink feed; small fee-on-transfer tokens |
tier3 | High | Low-liquidity tokens, complex tokenomics; accepted with highest fee and tightest slippage |
Sanctions / OFAC screening
The quote path includes sanctions screening. Addresses on OFAC SDN lists are declined before a quote is issued.
Provider implementations
The Token Risk Engine uses pluggable providers:
| Provider | Data source |
|---|---|
| Liquidity | DEX pool reserves (Uniswap V3, etc.) |
| Price | Chainlink feeds + DEX TWAP |
| Simulation | eth_call simulation of a sell |
| OFAC | Chainalysis / TRM Labs (planned) |
Provider implementations are unit-tested with mocked clients. Activation in production requires deployment configuration (Chainlink feed addresses, DEX pool addresses, liquidity→USD conversion factors).
Declining a token
If the Token Risk Engine declines a token, the POST /quote endpoint returns:
HTTP 422
{
"error": "token declined: insufficient liquidity"
}