Incog Swap Documentation

Incog Swap is a privacy-first cross-chain swap aggregator. It scans connected swap providers in real time, compares routes, and lets you create a non-custodial swap order with the provider you select — without an account, KYC or wallet connection.

Incog Swap belongs to the Incog ecosystem, which treats privacy as a foundational architectural property rather than an additive feature. Every component is designed around the question: what is the minimum information that needs to be observable for this function to work?

Incog Swap is one surface of a broader privacy stack. The ecosystem includes a decentralized relay mesh, hardware-backed node operators, the Incog Privacy Browser, a private inference runtime, and the $INCOG token that aligns incentives across operators and users.

Components

• ▸Incog Privacy Browser — hardened browsing client with isolation-first execution.
• ▸Incog Mesh Network — decentralized relay infrastructure for traffic-routing obfuscation.
• ▸Node Operator Layer — hardware-backed relay participation and reward distribution.
• ▸$INCOG Token — incentive coordination and network participation alignment.
• ▸Incog Wallet — privacy-preserving on-chain interaction layer.
• ▸Incog LLM — private inference runtime for browser-integrated AI.
• ▸Incog Swap — the privacy-preserving cross-chain swap aggregator.

Trust-minimized design

No single party — including Incog itself — needs to be trusted to maintain user privacy. Privacy-sensitive operations execute client-side, routing is distributed across independent operators, and the incentive layer penalises defection.

Privacy properties

• ▸Unlinkability — sessions, origins and time periods cannot be linked back to one user.
• ▸Unobservability — an adversary cannot determine whether a specific user accessed a specific resource.
• ▸Pseudonymity — context-scoped identities without linkage to real-world identity.

Adversary classes

• ▸Class 1: passive network observer (ISP, CDN) — fully defended by the relay layer.
• ▸Class 2: active site fingerprinter — defended by API normalization and storage partitioning.
• ▸Class 3: compromised relay operator — defended probabilistically by multi-hop diversity.
• ▸Class 4: global passive adversary — explicitly out of scope.

Incog Swap queries every configured provider in parallel for a given pair and amount. Each provider returns a normalized quote: send amount, receive amount, network fee, ETA, privacy score and rate type. Results are sorted by receive amount and presented as a route comparison.

Providers that don't support an exact token/network variant (for example USDC-BASE vs USDC-SOL) are filtered out before display, so an order can never be created on a network the provider doesn't handle.

Quotes lock for 90 seconds. Confirming a route rebinds the order to the locked amount, pair, rate type and provider so the receive amount you see is the receive amount the provider commits to.

Incog Swap currently aggregates seven privacy-first providers. Each is connected through its own server adapter and only appears in results when the provider's API key is configured.

• ▸FixedFloat — fixed and floating rates, high privacy score.
• ▸LetsExchange — wide token coverage, fast settlement.
• ▸SideShift — non-custodial, no account required.
• ▸StealthEX — no-KYC routing for major chains.
• ▸Exolix — privacy-focused with strong refund flow.
• ▸SimpleSwap — low minimums, broad asset list.
• ▸ChangeNOW — large liquidity pool, fixed/floating modes.

Incog Swap never touches your assets. Funds are sent directly to the selected provider's deposit address. The provider executes the swap and broadcasts the outgoing transaction to your destination wallet.

• ▸No accounts, no sign-up, no KYC.
• ▸No wallet connection, no seed phrase, no private keys.
• ▸Email is optional and only used for order updates.
• ▸Refund address is captured per order so providers can return funds if a deposit arrives outside the expected window.

Floating rate

The quoted receive amount may move slightly with the market before the swap completes. Floating routes are typically cheaper and have lower minimums.

Fixed rate

The receive amount is locked for the quote window. As long as the deposit arrives before expiry, the provider commits to the locked amount. Fixed routes carry a small premium to cover the lock.

USDC on Base is a different asset from USDC on Solana — and a different provider supports each. Incog Swap models token variants as first-class objects: every quote is bound to a specific (token, network) pair on both sides of the swap.

Destination address validation runs per-network. Sending USDC-SOL to an EVM-shaped address is blocked client-side and re-validated on the server before the order is created.

Every order gets a private tracking link bound to a single-use token. The tracking page shows the QR code, deposit address, expected receive amount, provider, provider order ID, expiry timer, live status timeline and email-notification state.

The tracking page polls the provider every 15–20 seconds. Statuses are normalized to a single set: order created → awaiting deposit → deposit detected → confirming → exchanging → sending → completed (or failed / expired / refunded).

If the provider API fails the page retries automatically and continues to show the last known status — never a fake status.

• ▸Server-side address validation per receive network — frontend checks are not trusted.
• ▸Quote-set binding prevents tampering between quote and order creation.
• ▸Provider order IDs are restricted to safe alphanumerics before being sent to provider URLs.
• ▸Tracking tokens are 32-byte URL-safe values; lookup is constant-time.
• ▸Email rendering is React Email with prop-only data — no raw HTML interpolation.
• ▸Suppression list is consulted before every send; bounces and complaints feed back automatically.

Does Incog Swap hold my funds?

No. Funds go directly to the selected provider's deposit address.

Will I receive email updates?

Yes if you provide an email — order created, deposit detected, exchanging, completed, failed, expired and refunded events are emailed from no-reply@incogswap.org.

Why do quotes expire?

Rates move with the market. Locking quotes for a 90-second window keeps you out of unbounded slippage. After expiry just rescan.

What if the provider fails?

Set a refund address. Providers refund to that address when a deposit arrives outside the expected window or the swap cannot complete.

Do I need an account?

No. No account, no ID, no KYC, no wallet connection. Email is optional.

What is the privacy score?

A 0–100 composite weighting KYC policy, log retention, IP shielding, jurisdiction and on-chain hygiene per provider.