Paragon Shield (MEV & Privacy)

Paragon Shield is our order-flow protection and private-routing layer. When you trade with Shield enabled, your swap is sent to a private relay + batch solver instead of the public mempool.

What you get (user guarantees)

  • No public exposure before execution – your order is withheld from the public mempool while the solver builds a route.

  • Sandwich resistance – batch clearing + private submission removes the timing edge for frontrunners.

  • Best-execution check – settlement compares output vs your minOut; if the solver can’t beat it, the trade reverts (or falls back if you opt in).

  • Surplus sharing – any extra value (better price, MEV saved, positive backrun) is split: 60% you / 30% LPs used / 10% stXPGN lockers (default).

  • Privacy options – choose how private you want your swap to be (see levels below).

How it works (high level)

  1. Submit privately

    • Classic swap: we package your call and send it via Shield Relay (not the public mempool).

    • Flow swap: you sign an EIP-712 Intent; the Flow Batcher groups intents for a block-window and invites solvers.

  2. Solve & protect

    • Solvers compute multi-hop routes across Paragon (and, later, external DEXes).

    • We clear the batch atomically to block frontruns.

    • Any surplus over minOut is logged for rebate.

  3. Settle on-chain

    • FlowSettlement verifies signatures, executes via our Router, and distributes surplus to: Trader, LPRebateVault, LockerVault.

    • If the solver can’t safely execute: your swap reverts or falls back (configurable).

Privacy levels

  • Shield-Lite (default) Private relay + anti-sandwich batch. Tx details become public only after the route is fixed. Good gas footprint, fastest fills.

  • Shield-Private Full intent mode (EIP-712). Your swap details are never broadcast to the public mempool; settlement happens only when included in the batch.

  • Shield-Stealth (advanced) Adds salts, delayed path disclosure, and stricter relay rules. Slightly slower; intended for large orders or sensitive trades.

Switch levels on the Swap page under “Shield settings”.

Fees & gas

  • No extra fee to enable Shield.

  • Standard AMM fees still apply.

  • In Flow mode, the protocol may take a small cut (0–5%) of captured surplus before splits; governed by DAO.

  • Gas is similar to a normal swap; batch settlements can be slightly higher.

Compatibility

  • Tokens: most ERC-20s. Fee-on-transfer or rebase tokens are allowed but may restrict routing.

  • Wallets: any EVM wallet supported by the app.

  • Chains: BNB Chain (testnet → mainnet). Cross-chain later.

  • UI: works on the Swap page (toggle), and is the default path when you choose “Swap with Intent (beta)”.

Limitations & caveats

  • Shield mitigates frontrun/sandwich but can’t eliminate market risk during your deadline window.

  • If oracles move or liquidity disappears mid-block, your minOut may fail → the trade reverts (or falls back if you enabled it).

  • When routing through external venues (phase-in), we whitelist executors and cap per-venue risk.

  • Privacy doesn’t equal anonymity: settlement is on-chain. (On-chain privacy modules are on the long-term roadmap.)

What “Proof-of-Best-Execution” means

With Flow enabled, settlement records:

  • Quoted minOut (from your intent)

  • Actual out received

  • Computed surplus (actual – minOut)

  • Rebate splits paid to trader / LPs / lockers

These values are emitted as events and surfaced in the UI so every trader sees “You saved X%” and where it went.

Developer notes (for integrators)

1) EIP-712 Intent (Flow mode)

// domain
const domain = {
  name: "ParagonFlow",
  version: "1",
  chainId,
  verifyingContract: FLOW_SETTLEMENT_ADDRESS,
} as const;

// types
const types = {
  Intent: [
    { name: "sellToken", type: "address" },
    { name: "buyToken",  type: "address" },
    { name: "amountIn",  type: "uint256" },
    { name: "minOut",    type: "uint256" },
    { name: "deadline",  type: "uint256" },
    { name: "receiver",  type: "address" },
    { name: "prefs",     type: "uint256" }, // bitfield: privacy level, fallback, etc.
    { name: "nonce",     type: "uint256" },
  ],
} as const;

// signable value
const value = {
  sellToken, buyToken, amountIn, minOut, deadline, receiver, prefs, nonce,
};

Submit {intent, signature} to the Shield Relay or directly to FlowSettlement.execute() if you operate your own solver.

2) Settlement interface (Solidity)

interface IFlowSettlement {
  struct Intent {
    address sellToken;
    address buyToken;
    uint256 amountIn;
    uint256 minOut;
    uint256 deadline;
    address receiver;
    uint256 prefs;
    uint256 nonce;
  }

  function execute(
    Intent calldata intent,
    bytes calldata signature,
    bytes calldata routeData // encoded hops/venues
  ) external returns (uint256 amountOut);

  event ShieldSubmitted(address indexed user, bytes32 intentHash);
  event ShieldSettled(
    address indexed user,
    bytes32 indexed intentHash,
    uint256 amountOut,
    uint256 surplus,
    uint256 traderRebate,
    uint256 lpRebate,
    uint256 lockerCut
  );
}

3) Rebate vaults

  • TraderRebateVault: claim(address user) or auto-stake option to stXPGN.

  • LPRebateVault: accrues by pool + block snapshot; LPs claim pro-rata to the liquidity used.

Using Shield in the app

  1. Open Swap → toggle “Paragon Shield (beta)”.

  2. Pick privacy level (Lite/Private/Stealth).

  3. Set slippage and deadline as usual.

  4. Confirm → Shield routes privately → you receive output + any cashback.

  5. Check the “Savings” banner and Rebates panel for claims.

FAQs

Is Shield always better than a public swap? Usually, yes—especially on volatile or crowded pairs. If the private path can’t beat your minOut, it reverts (or uses your configured fallback).

Does Shield cost more gas? Comparable. Batch settlements can be slightly higher; we optimize solver paths to offset with better prices.

Can I use Shield for limit orders? Limit/RFQ-style intents are on the roadmap; testnet may expose a preview.

What if a solver is malicious? Solvers are whitelisted at first, must post bonds, and are slashed for misbehavior. All settlements verify signatures, bounds, and route effects on-chain.

Where does the 10% to stXPGN go? It flows to the LockerVault and is claimable by stXPGN (PID-0) lockers. DAO can update the split.

Security & transparency

  • Contracts verified, timelocked, governed by multisig/DAO.

  • Shield has an emergency pause that only affects private routing; classic swaps remain open.

  • Testnet bug-bounty is live during the beta sprint.

Roadmap tie-ins

  • PoBE (Proof-of-Best-Execution) is the core metric surfaced in the UI and analytics.

  • veFlow voters will direct surplus routing weights and utilization emissions.

  • External venue routing (Thena, Pancake, etc.) is added post-testnet with caps.

PreviousGet Started (BSC)NextIntents & Batching

Last updated