Apsis runs a single first-party operator. Quoting, inventory, and execution are all operator-run; the contract enforces a narrow set of rules around them. Nothing waits on a cross-chain message, because the destination payout is made from float that is already there.

​
Roles

Because the vault pays out of its own balance, there is no ERC-20 approval held by any operator wallet, and a compromised executor cannot move float to itself.

​
Settlement path

1

Quote

The pricing pipeline reads median-aggregated prices from multiple independent providers, gas from the block stream, aggregator routing for token legs, and current inventory. It persists the canonical order parameters and returns their keccak hash.
2

Deposit

The user calls depositToken or depositNative on the inventory vault, or depositWithSwap on the router, with the quote hash. On a gasless quote the user signs instead and the operator relays the deposit. Either way the funds land in the vault and a Deposit event is emitted.
3

Index

The indexer matches the event to the stored quote, records the deposit, and creates the order. A finality worker advances it once the required confirmations accrue.
4

Fulfill

A relayer worker claims the order, leases an executor, and submits the destination transaction. The vault pays the principal and any gas drop out of its own balance. The order is finalized when that transaction confirms.

​
Same-chain swaps

When source and destination chain are equal, the router performs the swap inside the deposit transaction and the order is marked fulfilled once it confirms. No relayer, no second transaction, no destination inventory. See Same-chain swaps.

​
When a deposit does not match

The quote hash binds the deposit to exact parameters. A deposit with the wrong token, the wrong amount, or a reused quote is never fulfilled: the order is created directly in pending_refund. Fulfill failures land in the same place after attempts. The refund worker deducts the fees already committed in the quote, defers while live gas exceeds that commitment, and pays the net amount back to the refund address from the vault’s balance on the source chain. See Refunds.

​
Making transactions land

Every submission is pinned to one executor and one nonce, and its full intent is persisted on the order. If it stalls, the tracker re-signs the same nonce at a higher gas price while the fee budget allows, and burns the nonce when the transaction is stuck beyond its deadline. Solana uses durable nonces for the same purpose, so an in-flight transaction never expires. Reverts and burns move the order into a consistency window rather than a guessed outcome. After a quiet period both hashes are re-polled and the order moves to the state matching what actually landed on chain.

Order lifecycle

Every state an order can reach, and which ones are terminal.

Trust model

What the operator controls and what the contract enforces.