Docs
Covenant Documentation
Covenant separates permission from custody.
Covenant is one example interface on AON. Everything below (the order format, the matching rules, the settlement contract) is open, so other interfaces can trade in the same book.
Core rule
Execution is valid only when a current authorization covers it. The check happens at settlement time: if the authorization has expired, been used up, or doesn't cover the price, settlement fails regardless of what was matched.
Markets
ETH/USDT on Ethereum mainnet, with more pairs to follow. Token addresses are fixed in the interface. On ETH/USDT, buy orders are paid out in native ETH: the contract unwraps WETH during settlement. Orders must be worth at least 25 USDT, so settlement gas stays a small part of each trade. Sellers need WETH, because a signed order can't pull native ETH from a wallet, so the interface wraps it as a step before signing. All markets run on the generic aon:evm-spot namespace and settle through one AonEvmSpotSettlement contract.
Objects
- Authorization — EIP-712 signed. Market, side, maximum base (sell) or quote (buy) exposure, executor fee budget, price band, validity window.
- Order — EIP-712 signed. Limit price and size, bound to its authorization. One order can take liquidity, then rest and be filled as a maker.
- Fill — a proposed match between a resting order and an incoming one, at the resting order's price. Anyone can publish one; the contract decides if it's valid.
- Receipt — published by the executor after the settlement transaction confirms.
- Revocation — signed by the order's owner. Cancels the order's authorization.
Matching
Price-time priority. A new order walks the opposite side of the book from the best price, up to its limit, filling each resting order at that order's price. Each match becomes one fill object. The unfilled remainder of a limit order rests on the book as the same signed order. Market orders are signed only for the size that matched and expire after 15 minutes.
Matching happens in the trader's browser against the book as published on AON. If two traders race for the same liquidity, the contract's per-order fill accounting lets only one succeed. The other fill fails harmlessly and its size returns to the book after 10 minutes.
The interface hides orders whose owner no longer has the balance or approval to cover them, and blocks orders that would trade against your own resting orders.
Front-running protection
Orders are public on AON before they settle. Without protection, someone could see a buy with a 3,015 limit, place their own sell at 3,015 and settle against it first, so the buyer pays 3,015 instead of the 3,005 in the book.
So an order that fills right away names, in its signed terms, the exact resting orders it matched and exactly how much it takes from each. Until that part has filled, the settlement contract only lets it trade with those orders, never more than the named amount from each and always at exactly its price, and nobody else can trade with your order at all. If a matched order has a little less left by the time your trade settles, you get what's left of it. Whatever of that part hasn't filled within five minutes (for example because someone took a matched order first) is simply void: it never opens up at your limit. Whatever else you ordered rests in the book as usual.
Market price and warnings
The market price shown next to each book comes from Chainlink's price feeds, read directly from Ethereum through the Chainlink Feed Registry and converted from USD to USDT with Chainlink's USDT/USD feed. It is a reference only; Covenant trades at whatever prices traders sign.
The order form compares your order to it. Anything that fills now is judged by its average price, and anything left waiting in the book by its limit price, since anyone can take it at that price. From 2% worse than market you see a note; from 10% you must confirm before signing. If a feed is missing or more than 26 hours old, there is no reference and no warning.
Connections
Once your wallet is connected to Ethereum, Covenant reads the chain through your wallet's own connection, so it needs no RPC of its own. The order book comes from AON nodes, tried in order. You can set your own RPC and AON node under Network live → Connections.
Roles
Trader
Signs bounded orders. Tokens stay in the trader's wallet until settlement.
Executor
Watches AON for executable fills and submits them to the settlement contract. Permissionless: anyone can run one. The buyer can pay the executor a small fee, a percentage of each fill. The contract caps it in proportion to the fill's size, so a tiny fill can only carry a tiny fee.
No executor is required. Any trader can settle their own matched trade straight away with "Settle now": the interface builds the same transaction an executor would and sends it from your wallet. You pay the gas, and any executor fee in the trade goes to you.
Settlement contract
Verifies both authorizations and both orders, checks prices, exposure limits and cumulative fills, then transfers base and quote between the two wallets in one transaction.
Cancellation
Cancel publishes a revocation, signed by you, to AON. It's free, and executors and the interface stop matching the order immediately. The contract itself doesn't read AON, so until expiry someone could still settle the signed order by calling the contract directly, though only at your limit price or better.
Cancel on-chain does the same and also calls revokeAuthorization on the settlement contract, which makes the order unsettleable by anyone. It costs gas.
Security boundaries
- No deposits and no internal balances.
- Every fill must satisfy both parties' signed price limits.
- Cumulative fills per order and exposure per authorization are enforced on-chain.
- Each fill settles at most once; replays revert. If less is left than a fill asks for, it settles what's left (at the same price, never more than either side signed).
- Signatures use EIP-712 with low-s enforcement.
- Settlement status comes from the contract, not from receipts, so a forged receipt can't mark a trade as settled.
Launch status
Covenant is experimental software and the settlement contract has not been audited. Trade sizes you're comfortable losing.