Skip to main content

Vault & router

Two supporting contracts sit on either side of the hook: the vault holds funds, and the router is how users reach the pool.

CovenantVault — custody​

The vault owns custody of protocol funds, held as ERC-6909 claims inside the Uniswap v4 PoolManager rather than as raw token balances. This is deliberate:

  • Keeping value as PoolManager claims lets the hook move funds efficiently within the v4 unlock flow, without extra transfers in and out of the pool.
  • The vault never decides anything — it is pure custody. All real value movement is initiated by the hook.

It tracks the protocol reserve (the ETH buyers pay into absorptions, and CVN held for settlement) and emits ReserveUpdated as those balances change. Its state-changing entry points are restricted to the hook (Unauthorized otherwise), and it is initialized once (AlreadyInitialized guards re-init).

CovenantRouter — the entry point​

CovenantRouter is what a user (or the dApp) actually calls to trade. It:

  • wraps a buy or sell and drives the PoolManager's unlock callback flow (implementing IUnlockCallback);
  • enforces the caller's slippage guard (Slippage reverts if the result is worse than the minimum);
  • calls the hook's flushTax after the swap so accrued buy-tax ETH is paid out to the creator in the same interaction.

The router holds no protocol funds and has no privileged control over covenants — it is a thin, stateless-by-design conduit to the hook and pool. Only the PoolManager may invoke its unlock callback (NotPoolManager guards it).

Why route through the hook at all​

Direct liquidity operations on the pool are blocked (ExternalLiquidityBlocked) — all liquidity is protocol-owned and managed by the hook. Routing every trade through the hook is what guarantees the tax, retention, and absorption rules can never be bypassed.

Continue to Events & errors for the exact interface, or Parameters for the constants.