How it works

Execution no longer requires trust.

Covenant is an order book for trading ETH against USDT on Ethereum, with no backend, no database and no custody. It works like the order book you know from any exchange. The difference is that there is no exchange. Covenant is one example interface on AON: the orders, the matching rules and the settlement contract are open, and any other interface can use the same ones.

What it is

On a normal exchange you deposit funds and the exchange matches orders in its own database. On Covenant nothing is deposited. An order is a message you sign in your wallet: "I will sell up to 0.5 ETH at 3,010 USDT or better, for the next 24 hours." That message is published to AON, a peer-to-peer network, and your tokens stay in your wallet.

When two signed orders cross, a settlement contract on Ethereum checks both signatures and swaps the tokens directly between the two wallets in a single transaction. Either both sides move or neither does. Your tokens can only ever move on terms you signed.

How a trade works

1. Choose a market, a side, a price and an amount. The first time, you approve the token for the settlement contract.
2. You sign two messages, with no gas: an authorization that caps what the order can spend, and the order itself.
3. If your price crosses the book, the order fills right away against the best prices first, at each resting order's price.
4. Whatever doesn't fill rests on the book as a limit order until it fills, you cancel it, or it expires after 24 hours. Market orders never rest.
5. An executor picks up each matched fill from AON and submits it to the settlement contract, which swaps the tokens and records how much of each order is filled.

Security

Bounded authorizations

Every order comes with its own authorization that fixes the market, the side, the maximum amount, the price limit and an expiry. The contract rejects anything outside those bounds, so the worst case for any order is exactly what you signed.

No custody

Tokens are never deposited. They move straight from seller to buyer at the moment of settlement. Your approval lets the settlement contract move tokens only when it has a valid signed order from you.

No operator

There is no company or server in the middle: nothing that holds your funds, approves your trades or can freeze an account. Orders live on AON, matching happens in your browser, and settlement is a public contract anyone can call. The contract has no owner and no admin functions, so nobody can pause it, upgrade it or redirect it.

This website is one example interface, and just one way in. Anyone can build another on the same orders and the same contract, and orders placed through any of them meet in the same book. No interface can move your tokens. What any interface could do is show you a bad order to sign, which is why this one spells out your terms in plain words before you sign, and your wallet shows the exact values before you approve.

Every release of this site is also published on IPFS, where its address is a hash of the build itself, so nobody can change it or take it down. If this domain ever went away, the app would still be there. The footer shows which build you're running, and the release list in the source repository links each one to its IPFS address.

Partial fills, enforced on-chain

The contract keeps a running total of how much of each order has filled and never lets it go past what you signed, however many executors are running and in whatever order they submit. A fill that asks for more than is left settles only what's left, at the same price.

Atomic settlement

Both legs of a trade live on Ethereum and move in the same transaction. There is no window where one side has paid and the other hasn't, so there is nothing for a reorg or a failed counterparty to exploit.

What runs underneath

AON: Authorization Object Network ↗

Every order, fill, cancellation and settlement receipt is a signed, content-addressed object on AON, propagated across every connected node. Settlement is permissionless: anyone can run an executor and settle matched fills. If this website disappeared tomorrow, every order would still exist on the network and could still be settled against the contract.

Explore

← Back to trading Docs