Who is holding your tokens at each step of a swap

A swap traced instant by instant: what the allowance permits, when your balance actually falls, which contract holds the tokens in between, what the floor check does at the end, and why a failed swap cannot leave you halfway through.

BlazePhoenix Engineering · updated 2026-08-13 · 8 min · written from the deployed bytecode

By Mitra (@Sigmacrit) — anonymous developer of the BlazePhoenix protocol. The code is the résumé.

Abstract in 15 languages · resumo · resumen · 摘要 · 要旨 · ملخص

English — A swap traced instant by instant, naming the holder at every step: nothing moves until the router pulls your tokens using the allowance you wrote, the pools hold them one leg at a time, and the floor check at the end decides settlement — all inside one atomic transaction with no pause a human could act in, which is why a failed swap cannot leave you halfway through.

Português — Um swap seguido instante a instante, nomeando quem detém a cada passo: nada se move até o router puxar os teus tokens com a allowance que escreveste, as pools seguram-nos uma perna de cada vez, e a verificação do piso no fim decide a liquidação — tudo dentro de uma transação atómica, sem pausa em que um humano pudesse agir, e é por isso que um swap falhado não te pode deixar a meio.

Español — Un swap trazado instante a instante, nombrando al tenedor en cada paso: nada se mueve hasta que el router jala tus tokens usando la allowance que escribiste, las pools los sostienen un tramo a la vez, y la comprobación del suelo al final decide la liquidación — todo dentro de una transacción atómica, sin pausa en la que un humano pudiera actuar, y por eso un swap fallido no puede dejarte a mitad de camino.

Français — Un swap tracé instant par instant, en nommant le détenteur à chaque étape : rien ne bouge tant que le routeur ne tire pas vos tokens avec l'allowance que vous avez écrite, les pools les tiennent un segment à la fois, et le contrôle du plancher à la fin décide du règlement — le tout dans une transaction atomique, sans pause où un humain pourrait agir, raison pour laquelle un swap échoué ne peut pas vous laisser à mi-chemin.

Deutsch — Ein Swap Augenblick für Augenblick verfolgt, mit dem Halter bei jedem Schritt: Nichts bewegt sich, bis der Router deine Tokens per der von dir geschriebenen Allowance zieht, die Pools halten sie jeweils ein Leg lang, und der Boden-Check am Ende entscheidet das Settlement — alles in einer atomaren Transaktion ohne Pause, in der ein Mensch eingreifen könnte, weshalb ein fehlgeschlagener Swap dich nicht auf halbem Weg zurücklassen kann.

Русский — Своп, прослеженный мгновение за мгновением, с именем держателя на каждом шаге: ничего не движется, пока роутер не потянет ваши токены по записанному вами разрешению; пулы держат их по одному плечу за раз, а проверка порога в конце решает расчёт — всё внутри одной атомарной транзакции без паузы, в которую мог бы вмешаться человек, поэтому неудавшийся своп не может бросить вас на полпути.

Türkçe — Bir takas an be an izlenir, her adımda tutan taraf adlandırılır: yönlendirici, yazdığın allowance ile tokenlarını çekene dek hiçbir şey kımıldamaz, havuzlar onları bacak bacak tutar ve sondaki taban kontrolü mutabakatı belirler — hepsi tek atomik işlem içinde, bir insanın müdahale edebileceği duraklama olmadan; bu yüzden başarısız bir takas seni yarı yolda bırakamaz.

العربية — مبادلة تُقتفى لحظة بلحظة، مع تسمية الحائز في كل خطوة: لا شيء يتحرك حتى يسحب الموجّه عملاتك بالسماح الذي كتبته، والمجمّعات تمسكها ساقاً بساق، وفحص الأرضية في النهاية يقرر التسوية — كل ذلك داخل معاملة ذرّية واحدة بلا توقف يمكن لإنسان التصرف فيه، ولهذا لا يمكن لمبادلة فاشلة أن تتركك في منتصف الطريق.

हिन्दी — क्षण-दर-क्षण खोजा गया स्वैप, हर क़दम पर धारक का नाम लेते हुए: तब तक कुछ नहीं हिलता जब तक राउटर आपकी लिखी allowance से टोकन नहीं खींचता; पूल उन्हें एक-एक लेग थामे रहते हैं, और अंत में फ़्लोर-जाँच निपटान तय करती है — सब कुछ एक परमाणु लेनदेन के भीतर, बिना ऐसे विराम के जिसमें कोई मनुष्य दख़ल दे सके; इसीलिए असफल स्वैप आपको आधे रास्ते में नहीं छोड़ सकता।

日本語 — スワップを一瞬ごとに追跡し、各段階で誰が保持しているかを名指しします。あなたが書いたallowanceを使ってルーターがトークンを引き出すまで何も動かず、プールはレッグごとに一時的に保持し、最後のフロア検査が決済を決めます。すべては一つの原子的トランザクションの中で起き、人間が介入できる間隙はありません。だから失敗したスワップが途中の状態であなたを放置することはできないのです。

中文 — 把一笔交换逐瞬追踪，点名每一步的持有者：在路由器用你写下的授权额度拉取代币之前，什么都不会动；池子一条腿一条腿地暂持它们，最后的下限检查决定是否结算——一切都在一笔原子交易内完成，没有任何人可插手的间隙，这就是失败的交换不可能把你丢在半途的原因。

한국어 — 스왑을 순간순간 추적하며 매 단계의 보유자를 짚습니다. 라우터가 당신이 기록한 허용량으로 토큰을 끌어가기 전까지 아무것도 움직이지 않고, 풀들은 레그 하나씩 잠시 보유하며, 마지막의 하한 검사가 정산을 결정합니다 — 모두 하나의 원자적 트랜잭션 안에서 일어나 사람이 개입할 틈이 없으며, 그래서 실패한 스왑이 당신을 중간에 버려둘 수 없습니다.

Bahasa Indonesia — Sebuah swap dilacak sesaat demi sesaat, menyebut pemegangnya di setiap langkah: tak ada yang bergerak sampai router menarik tokenmu memakai allowance yang kamu tulis, pool memegangnya satu kaki pada satu waktu, dan pemeriksaan lantai di akhir memutuskan penyelesaian — semuanya di dalam satu transaksi atomik tanpa jeda yang bisa dimasuki manusia, itulah mengapa swap yang gagal tak bisa meninggalkanmu di tengah jalan.

বাংলা — মুহূর্তে-মুহূর্তে অনুসৃত একটি সোয়াপ, প্রতিটি ধাপে ধারকের নাম ধরে: আপনার লেখা allowance দিয়ে রাউটার টোকেন টেনে না নেওয়া পর্যন্ত কিছুই নড়ে না, পুলগুলো এক-এক লেগ করে ধরে রাখে, আর শেষে ফ্লোর-যাচাই নিষ্পত্তি ঠিক করে — সবই একটি পারমাণবিক লেনদেনের ভেতরে, মানুষের হস্তক্ষেপের কোনো বিরতি ছাড়া; তাই ব্যর্থ সোয়াপ আপনাকে মাঝপথে ফেলে রাখতে পারে না।

Filipino — Isang swap na sinusubaybayan bawat sandali, pinapangalanan ang may hawak sa bawat hakbang: walang gumagalaw hangga't hindi hinihila ng router ang mga token mo gamit ang allowance na isinulat mo, hawak ng mga pool ang mga ito nang isang leg sa bawat pagkakataon, at ang pagsusuri ng floor sa dulo ang nagpapasya sa settlement — lahat sa loob ng iisang atomic na transaksyon na walang pahingang mapapasukan ng tao, kaya ang nabigong swap ay hindi ka maiiwang nasa kalagitnaan.

You press a button and, some seconds later, one token has become another. In between, your tokens exist somewhere, held by someone, under some rule. This article names the holder at every instant, because that is the only honest way to answer the question people actually mean when they ask whether a swap is safe.

Everything below assumes the previous article: your balance is a row in the token contract, and an allowance is a ceiling you wrote permitting a contract to move up to some amount of it. We now spend that allowance.

Before you press anything

You hold 100 of token A. The interface shows you a quote for token B. That quote was computed by asking a contract, at a recent block, what a trade of 100 would return. Nothing has been reserved, nothing has been locked, and no one has touched your row. A quote is a calculation, not a commitment.

Two rows exist that concern you: your balance of A, and the allowance you granted to the router for A. If the allowance is smaller than 100, the swap cannot pull your tokens, and your wallet will ask for an approval transaction first. That approval, again, moves nothing.

Step one: the transaction is signed and broadcast

You sign. At this instant you still hold all 100 tokens. The signed transaction goes to the network and waits to be picked up and put into a block.

This waiting room is public. Anyone watching can see that you intend to trade 100 of A for B, and at what minimum. That visibility is the origin of front-running, and it is worth naming here rather than at the end: it cannot be prevented by any contract, because the contract does not exist until the transaction runs. What a contract can do is bound the damage, which is the subject of the article on minimum output.

Nothing is charged yet. If the transaction never gets included, your balance never changes.

Step two: the router pulls your tokens

The block producer includes your transaction and the code runs. Its first act is to call the token contract and move 100 of A from your row to the router contract, using the permission you wrote earlier.

Two numbers change in the same instant: your balance of A falls by 100, and your allowance for the router falls by 100 — unless you granted the unlimited value, in which case it stays where it was.

From this moment until the end of the transaction, the router holds your 100 tokens. This is the interval people are really asking about. Note what "holds" means: no person can act during it. The whole transaction is executed by one machine, in one step, with no pause in which a human could intervene. There is no window between step two and step six.

Step three: the tokens go to the pools

The router now sends your tokens into one or more pools, according to the plan the quote produced. If the plan splits the order, it sends the pieces to different pools; if it routes through an intermediate token, the output of one pool becomes the input of the next.

Each pool holds your tokens for the duration of its own leg and gives back the output its formula requires. Those pools are not ours. They are third-party contracts holding third-party liquidity, and this is a genuine risk surface: routing through a pool means executing that pool's code.

What limits the exposure is that the router does not choose pools by reputation. It quotes them on-chain, against their real balances, and a pool that cannot deliver what it advertised fails the checks that come next.

Step four: the router counts what actually arrived

Here is the distinction that separates a careful router from a careless one. After each leg, the router does not assume it received the amount the pool said it would send. It reads its own balance before and after, and takes the difference as the amount received.

Why this matters can be shown with a number. Suppose a pool reports sending 90.66 tokens, but the token itself takes 1% on transfer, so 89.75 actually arrives. A router that trusts the report is now working with 90.66 tokens it does not have, and every subsequent number it computes is wrong — including the amount it promises you. A router that measures works with 89.75, which is the truth.

The general form of the rule is worth keeping for everything else you read about DeFi: trust the measured quantity, never the nominal one.

Step five: the floor check

With the final amount measured, the contract compares it against a minimum. Two minimums apply, and both must hold.

The first is yours: the amount you accepted when you set your slippage tolerance. The second is the protocol's own, and you cannot switch it off. Each leg of the route must return at least 8,000 basis points — 80% — of what the chain itself quoted for that leg immediately beforehand, and the aggregate floor is clamped so that it can never fall below 80% either. The reference is the on-chain quote for the last hop, taken before the protocol fee is applied.

Be exact about what 80% is for. It is not a good deal; it is a catastrophe stop. A route that delivers 81% of its own on-chain quote is a terrible fill that the protocol will still execute. The number that protects your wallet in ordinary conditions is the tighter one you set yourself.

If either floor fails, the transaction reverts.

What "reverts" means, and why it is the whole safety story

A revert is not a partial trade or a refund. The chain undoes every state change the transaction made, as though it had never run. Your 100 tokens of A are back in your row, the pools are back to their prior balances, and the allowance decrement is undone with everything else.

What you do not get back is the chain fee, because the network did the work of running the code and finding out that it failed. That is the honest cost of a failed swap, and it is the reason this article quotes no gas figures anywhere: a gas number is not reproducible without stating the chain, the block, the build and whether the storage was warm or cold, and a number you cannot reproduce is a number you should not be given.

So the interval in step two, where the router holds your tokens, has this property: either all six steps completed and you hold your output, or none of them did and you hold your input. There is no state in which the router has your tokens and you have nothing.

Step six: you are paid, and the fee is taken

The router keeps 28 basis points of the output — 0.28% — and sends you the rest. On an output of 90.6611 tokens the fee is 90.6611 x 0.0028 = 0.2539, and you receive 90.4072. That constant has no setter anywhere in the contract, which means it cannot be raised on you later.

One residue remains after everything settles: your allowance. If you approved an exact amount, it is now spent to zero. If you approved the unlimited value, the router can still move your A tokens tomorrow. Nothing in this transaction cleaned that up, and nothing will unless you do it.

Do not trust this page — reproduce it

Every claim above is checkable against the chain. Start here:

Open your swap transaction on a block explorer and read the Token Transfers list. Every movement in the six steps above is one line: your address to the router, the router to each pool, each pool back, and the router to you. Count them and compare with the route the quote showed you.
Cite this article

Licensed CC BY 4.0 — quote, translate and reuse freely, including commercially, with attribution and a link. Copy a ready-made citation:

BlazePhoenix (2026). Who is holding your tokens at each step of a swap. BlazePhoenix Engineering. https://blazephoenix.xyz/learn/where-your-tokens-are-during-a-swap
@misc{blazephoenix_where_your_tokens_are_during_a_swap,
  title  = {Who is holding your tokens at each step of a swap},
  author = {BlazePhoenix},
  year   = {2026},
  url    = {https://blazephoenix.xyz/learn/where-your-tokens-are-during-a-swap},
  note   = {Accessed: reproduce the claim with the command above}
}

Writing an answer, a wiki entry or a paper? The claim above is reproducible against the chain before you quote it — which is the only sound basis for citing a technical source at all.

Contracts are verified on every chain we deploy to — addresses in the protocol manifest. Deeper formal treatment: the whitepaper (PDF).

Share this article · join the discussion

Share on X ↗Telegram ↗WhatsApp ↗Farcaster ↗💬 Discuss on Telegram

Related engineering