CoW Swapper: Deep Dive

How the CoW Swapper enables trustless, MEV-protected ERC20-to-ERC20 swaps within Arcadia Accounts via CoW Protocol batch auctions. Covers the full flow (order signing, auction, settlement via flash ac

Source: Arcadia Finance Blog

In this post we will outline what the CowSwapper does, what the trust assumptions are, and how it works under the hood.

The CowSwapper enables trustless, MEV-protected ERC20-to-ERC20 swaps, while assets remain deployed as collateral inside an Arcadia Account. It can be used for compounding staked positions, auto-repaying debt, stop losses and much more!

Why you need the CowSwapper

Let's first quickly go over the existing Arcadia automations: the Compounder and Rebalancer.

Both are for managing DEX liquidity positions and the names are self-explanatory: the Compounder adds fees collected in the underlying tokens of the pool to the position, while the Rebalancer changes the range of the liquidity position.

They are triggered by an external initiator, but can be trustless. The smart contracts enforce that the pool is not manipulated, that swaps are executed without extracting assets or excessive slippage, and that a minimum amount of liquidity is minted after the compound or rebalance.

Both the Rebalancer and Compounder can do trustless swaps, since they rely on information from the pool itself. They are however limited to the two tokens of the DEX pool; the same mechanism cannot be generalised to swap between any two ERC20 tokens. For many use cases we need to swap to and from third tokens as well. Staking rewards are often paid in a third token (e.g. OP, ARB, AERO). Taking profit might mean swapping yield into a stablecoin. Repaying debt requires converting into the borrowed asset.

For these third-token swaps we still want the same guarantees: trustless execution, minimal slippage, and protection against MEV.

One approach would be to rely on price oracles to calculate minimum output amounts on-chain. But this only works for token pairs where oracles are already configured — it does not generalise to any-to-any token swaps.

The solution is an integration with CoW Protocol. The initiator still triggers the swap, but the actual execution is delegated to CoW Protocol's batch auction. Solvers compete to offer the best price, and the winning solver settles the trade. This guarantees competitive rates while providing MEV protection, since CoW Protocol settles trades off-chain in batches rather than exposing them to the public mempool.

Additionally, CoW Protocol allows users to execute arbitrary logic before or after the swap. This means that swaps can happen within Arcadia Flash Actions: assets can be swapped while they continue to serve as collateral. Nothing needs to be withdrawn by the Account Owner first, no debt needs to be repaid first. One token leaves and the second token enters in a single transaction, and the Account's health is never at risk.

Use Cases

Combining CoW Protocol swaps with Arcadia Flash Actions unlocks a number of features:

• Compounding staked positions: Staking rewards (paid in a third token like OP, ARB, or AERO) are automatically swapped back into the pool's underlying tokens and compounded into the liquidity position. The CowSwapper handles the third-token swap, the existing Compounder handles the rest.

• Take profit in any token of choice: Account Owners can automatically take a portion of their earned yield and swap it into any token they prefer (e.g. USDC) rather than compounding everything back into the pool.

• General ERC20-to-ERC20 swaps: Any ERC20 token held in an Arcadia Account can be swapped to any other ERC20 token via CoW Protocol, enabling flexible portfolio management without ever leaving the Account.

• Repay debt with yield: For leveraged positions, earned yield can be automatically swapped into the debt token and used to repay the loan, gradually deleveraging the position over time.

• Stop losses: Automatically swap a position's assets when certain price conditions are met, protecting against downside risk.

How it works

0. Setup

Only the Account Owner can configure the CoW Swapper. They have to set which address to whitelist as Initiator, a maxSwapFee cap on what the Initiator can charge (can be 0), and which OrderHook contract to use for additional per-account restrictions.

1. Signing the order

When the Initiator (or the Account Owner themselves) decides a swap should be done (e.g. to compound claimed staking rewards), they start by constructing and signing a valid CoW swap order. This order is then submitted to CoW's order book.

2. CoW Auction

The CoW Protocol runs a 'Fair Combinatorial Auction', where solvers compete to fill the order within a set amount of time.

The solver that can quote the best price wins the auction and can fill the order.

3. Settlement

The winning solver executes the order on-chain. The solver triggers the transaction via CoW's Flash Loan Router, which initiates a flash action on the Arcadia Account, pulling tokenIn out to the CowSwapper.

First, the CowSwapper logic is triggered. The CowSwapper reconstructs the order based on the input data, computes its hash, and stores the hash in transient storage.

Next, a user-defined OrderHook is called. Via this hook the user can enforce additional, highly customisable constraints (more on this in the next section).

Lastly, the actual swap is settled via CoW's Settlement contract. The settlement contract executes the swap and does a number of checks:

• Check that the order has not expired

• Check that the order has not been previously filled

• Check that the actual execution price was equal to or better than what was specified in the order

• Check the order's signature: for the CowSwapper we use EIP-1271 signatures. The contract checks two things: the hash matches what was just reconstructed from the order parameters, and the signature over that hash came from the Initiator or Account Owner.

The hash construction is the core of the trust model. Every field in the order — tokenOut, amountOut, deadline, fee — feeds into the hash that gets verified on-chain. If a solver modified any parameter between the Initiator's submission and settlement, the on-chain reconstruction produces a different hash, the signature check fails, and the transaction reverts. The Initiator commits to specific terms upfront. Those exact terms are what gets executed.

Order Hooks

Account Owners who want more control can use custom Order Hooks. Some examples of what a custom hook can do:

Oracle check. Verify the solver's output is within acceptable range of an on-chain price, as a second layer of protection on top of solver competition.

Token filters. Whitelist or blacklist specific assets. Stops the Initiator from swapping into tokens the owner hasn't approved.

Rate limits. Cap swap frequency or maximum size per time window, useful for strategies that should execute gradually rather than all at once.

Trust Assumptions

Initiators

Initiators can decide when to swap tokens, the tokenIn and tokenOut, the amountIn and the minimum amountOut.

The Account Owner can easily restrict the tokenIn and tokenOut via the Order Hook:

• Whitelist/blacklist, or fix tokenIn and/or tokenOut

• Set minimum cooldown periods

For the minimum amountOut, the decentralised batch auction provides a safety net. Even with a very low minimum amountOut, the batch auction should guarantee a competitive actual price. Account Owners can additionally use third-party oracles to set a minimum value via a custom Order Hook.

Solvers

Solvers cannot modify anything in the order. If they change any field of the order, or skip certain steps such as the flash loan or hook calls, the on-chain calculated hash will not match the signature.

If the auction mechanism fails or solvers collude, the worst case is that the minimum amountOut specified by the Initiator is what gets quoted.

Overview fees & costs

The Initiator can charge a fee: a percentage of the tokenOut received, where the percentage is set per order but always capped by the maxSwapFee configured by the Account Owner.

CoW Protocol charges the user gas costs indirectly by factoring them into the price quoted for the swap.