Functions

DISCLAIMER // NFA // DYOR

This analysis is based on observations of the contract behavior. We are not smart contract security experts. This document aims to explain what the contract appears to do based on the code. It should not be considered a comprehensive security audit or financial advice. Always verify critical information independently and consult with blockchain security professionals for important decisions.

⊙ generated by robots | curated by humans

METADATA
Contract Address	`0x658bF1A6608210FDE7310760f391AD4eC8006A5F` (etherscan)
Network	Ethereum Mainnet
Analysis Date	2026-02-28

Function Selectors

SELECTOR	FUNCTION SIGNATURE	CATEGORY
`0xe1fd10bc`	`getQuotes(bool,address,address,uint256)`	View
`0xee9a5b9d`	`quoteV2(bool,address,address,uint256,bool)`	View
`0xac67a76e`	`quoteV3(bool,address,address,uint24,uint256)`	View
`0x61d65dee`	`quoteV4(bool,address,address,uint24,int24,address,uint256)`	View
`0xc0bb84b3`	`quoteZAMM(bool,uint256,address,address,uint256,uint256,uint256)`	View
`0xe7798987`	`buildBestSwap(address,bool,address,address,uint256,uint256,uint256)`	View
`0xe453166e`	`buildBestSwapViaETHMulticall(address,address,bool,address,address,uint256,uint256,uint256)`	View

Summary

CATEGORY	COUNT
Total Functions	7
User Functions	0
Admin Functions	0
View Functions	7

View Functions

Function: `getQuotes(bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount)`

OverviewKey ObservationsCode

Queries all 14 Automated Market Maker (AMM) pools (V2, Sushi, zAMM ×4 fee tiers, V3 ×4 fee tiers, V4 ×4 fee tiers) for the given token pair and amount. Returns the full array of all 14 quotes plus the single best quote determined by _pickBest.

For exact-in (exactOut == false): best = maximum amountOut.
For exact-out (exactOut == true): best = minimum amountIn.

ATTRIBUTE	VALUE
Selector	`0xe1fd10bc`
Parameters	`exactOut` — true for exact-out, false for exact-in; `tokenIn` — input token (address(0) = native ETH); `tokenOut` — output token; `swapAmount` — amount in (exact-in) or amount out desired (exact-out)
Access	External view — anyone

FLAG	OBSERVATION
◇	Returns 14 quotes in a fixed-size array. Unavailable pools (no liquidity, nonexistent, or failed) return `(0, 0)` and are skipped in best-selection.
◇	The `best` field is initialized to the first non-zero quote encountered; ties on the primary metric are broken by the secondary metric, then fee tier.
△	If all 14 pools return `(0, 0)`, `best` will be a zero-value Quote struct. Callers should check `best.amountIn == 0 && best.amountOut == 0` before using the result.
◇	V2/Sushi fee is hardcoded at 30 bps in the Quote struct; zAMM fees are 1/5/30/100 bps; V3/V4 fees are 1/5/30/100 bps.

function getQuotes(bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount)
    public
    view
    returns (Quote memory best, Quote[] memory quotes)
{
    unchecked {
        quotes = new Quote[](14);
        (uint256 amountIn, uint256 amountOut) = quoteV2(exactOut, tokenIn, tokenOut, swapAmount, false);
        quotes[0] = Quote(AMM.UNI_V2, 30, amountIn, amountOut);
        (amountIn, amountOut) = quoteV2(exactOut, tokenIn, tokenOut, swapAmount, true);
        quotes[1] = Quote(AMM.SUSHI, 30, amountIn, amountOut);
        (amountIn, amountOut) = quoteZAMM(exactOut, 1, tokenIn, tokenOut, 0, 0, swapAmount);
        quotes[2] = Quote(AMM.ZAMM, 1, amountIn, amountOut);
        // ... (4 zAMM fee tiers, 4 V3 fee tiers, 4 V4 fee tiers)
        best = _pickBest(exactOut, quotes);
    }
}

Function: `quoteV2(bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, bool sushi)`

OverviewKey ObservationsFailure CasesCode

Quotes a single Uniswap V2 or SushiSwap swap. Computes the pool address deterministically via CREATE2, reads the current reserves via getReserves(), and applies the standard constant-product formula (0.3% fee).

Returns (0, 0) if the pool does not exist, has zero reserves, or the output amount would equal or exceed the reserve.

ATTRIBUTE	VALUE
Selector	`0xee9a5b9d`
Parameters	`exactOut` — swap direction; `tokenIn` / `tokenOut` — token pair (address(0) treated as WETH); `swapAmount` — input or output amount; `sushi` — true for SushiSwap, false for Uniswap V2
Access	Public view — anyone

FLAG	OBSERVATION
◇	Native ETH (`address(0)`) is automatically mapped to WETH before pool lookup — consistent with how zRouter handles ETH in V2 swaps.
◇	Pool address is computed entirely on-chain via CREATE2 hash with the correct factory and init code hash constants. No registry call is made.
☑	Uses `_isContract()` check to confirm the computed pool address actually exists before reading reserves.
◇	For exact-out, enforces `swapAmount < reserveOut` — requests for the full reserve or more return `(0, 0)` gracefully.

CONDITION	REVERT MESSAGE
`amountIn == 0` (internal `_getAmountOut`)	`InsufficientInputAmount()`
`reserveIn == 0 \\|\\| reserveOut == 0`	`InsufficientLiquidity()`
`amountOut == 0` (internal `_getAmountIn`)	`InsufficientOutputAmount()`

function quoteV2(bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, bool sushi)
    public view returns (uint256 amountIn, uint256 amountOut)
{
    unchecked {
        if (swapAmount == 0) return (0, 0);
        if (tokenIn == address(0)) tokenIn = WETH;
        if (tokenOut == address(0)) tokenOut = WETH;
        (address pool, bool zeroForOne) = _v2PoolFor(tokenIn, tokenOut, sushi);
        if (!_isContract(pool)) return (0, 0);
        (uint112 reserve0, uint112 reserve1,) = IV2Pool(pool).getReserves();
        (uint256 reserveIn, uint256 reserveOut) = zeroForOne ? (reserve0, reserve1) : (reserve1, reserve0);
        if (reserveIn == 0 || reserveOut == 0) return (0, 0);
        if (exactOut) {
            if (swapAmount >= reserveOut) return (0, 0);
            amountIn = _getAmountIn(swapAmount, reserveIn, reserveOut);
            amountOut = swapAmount;
        } else {
            amountIn = swapAmount;
            amountOut = _getAmountOut(amountIn, reserveIn, reserveOut);
        }
    }
}

Function: `quoteV3(bool exactOut, address tokenIn, address tokenOut, uint24 fee, uint256 swapAmount)`

OverviewKey ObservationsCode

Quotes a Uniswap V3 swap by delegating to the Uniswap V3 QuoterV2 contract (0x5e55C9e6...). Resolves the pool address via the V3 Factory first, then calls quoteExactInputSingleWithPool or quoteExactOutputSingleWithPool depending on the exactOut flag.

Returns (0, 0) if no pool exists for the fee tier or if the quoter call reverts (caught with try/catch).

ATTRIBUTE	VALUE
Selector	`0xac67a76e`
Parameters	`exactOut` — swap direction; `tokenIn` / `tokenOut` — token pair (address(0) mapped to WETH); `fee` — pool fee in V3 units (100, 500, 3000, 10000); `swapAmount` — amount in or amount out
Access	Public view — anyone

FLAG	OBSERVATION
☑	Uses `try/catch` around both Quoter calls — any failure (pool not found, insufficient liquidity, revert) silently returns `(0, 0)` rather than propagating the revert.
◇	The `sqrtPriceLimitX96` is set to `MIN_SQRT_RATIO_PLUS_ONE` (selling token0) or `MAX_SQRT_RATIO_MINUS_ONE` (selling token1) — effectively no price limit, letting the full swap execute.
△	Delegates to an external contract (V3 Quoter) that itself makes state-changing calls internally and reverts to obtain the quote. This is a known pattern but means `quoteV3` is not a pure function.

function quoteV3(bool exactOut, address tokenIn, address tokenOut, uint24 fee, uint256 swapAmount)
    public view returns (uint256 amountIn, uint256 amountOut)
{
    unchecked {
        address tIn = tokenIn == address(0) ? WETH : tokenIn;
        address tOut = tokenOut == address(0) ? WETH : tokenOut;
        address pool = IUniswapV3Factory(V3_FACTORY).getPool(tIn, tOut, fee);
        if (pool == address(0)) return (0, 0);
        uint160 sqrtPriceLimitX96 = tIn < tOut ? MIN_SQRT_RATIO_PLUS_ONE : MAX_SQRT_RATIO_MINUS_ONE;
        if (!exactOut) {
            try IQuoter(V3_QUOTER).quoteExactInputSingleWithPool(...) returns (...) {
                return (swapAmount, amtOut);
            } catch { return (0, 0); }
        } else {
            try IQuoter(V3_QUOTER).quoteExactOutputSingleWithPool(...) returns (...) {
                return (amtIn, swapAmount);
            } catch { return (0, 0); }
        }
    }
}

Function: `quoteV4(bool exactOut, address tokenIn, address tokenOut, uint24 fee, int24 tickSpacing, address hooks, uint256 swapAmount)`

OverviewKey ObservationsCode

Quotes a Uniswap V4 swap by simulating the full tick-crossing swap loop locally. Reads pool state (sqrt price, current tick, liquidity, fees) from the V4 StateView lens, then iterates through initialized tick ranges using the embedded V4TickBitmap library until the swap is fully filled or the price limit is reached.

Returns (0, 0) for uninitialized pools, zero-liquidity pools, amounts exceeding int256.max, or exact-out swaps that cannot be fully fulfilled.

ATTRIBUTE	VALUE
Selector	`0x61d65dee`
Parameters	`exactOut` — swap direction; `tokenIn` / `tokenOut` — token pair (address(0) = native ETH supported natively in V4); `fee` — pool fee in V4 units; `tickSpacing` — pool tick spacing; `hooks` — hooks contract address (pass `address(0)` for hookless pools); `swapAmount` — amount in or amount out
Access	Public view — anyone

FLAG	OBSERVATION
△	This is the most complex function in the contract. It reimplements the V4 swap loop in Solidity, including tick compression, bitmap navigation, SwapMath step computation, and liquidity delta application across tick crossings.
◇	Sign convention differs from V3: exact-in uses negative `amountRemaining` (counting toward zero), exact-out uses positive (counting down).
◇	Reads multiple external state slots per tick crossing (getSlot0, getLiquidity, getTickBitmap, getTickLiquidity) — gas-intensive for pools with many initialized ticks.
☑	Gracefully returns `(0, 0)` if the exact-out swap cannot be fully filled (`amountRemaining != 0` at loop end).
◇	`getQuotes` always passes `hooks: address(0)` — only hookless V4 pools are quoted by default.

function quoteV4(bool exactOut, address tokenIn, address tokenOut,
    uint24 fee, int24 tickSpacing, address hooks, uint256 swapAmount)
    public view returns (uint256 amountIn, uint256 amountOut)
{
    unchecked {
        if (swapAmount == 0) return (0, 0);
        if (swapAmount > uint256(type(int256).max)) return (0, 0);
        (bytes32 poolId, bool zeroForOne) = _v4PoolId(tokenIn, tokenOut, fee, tickSpacing, hooks);
        (uint160 sqrtPriceX96, int24 tick, uint24 protocolFee, uint24 lpFee) =
            IStateViewV4(V4_STATE_VIEW).getSlot0(poolId);
        uint128 liquidity = IStateViewV4(V4_STATE_VIEW).getLiquidity(poolId);
        if (sqrtPriceX96 == 0 || liquidity == 0) return (0, 0);
        // ... tick simulation loop ...
        if (exactOut && amountRemaining != 0) return (0, 0);
    }
}

Function: `quoteZAMM(bool exactOut, uint256 feeOrHook, address tokenIn, address tokenOut, uint256 idIn, uint256 idOut, uint256 swapAmount)`

OverviewKey ObservationsCode

Quotes a swap on zFi's zAMM protocol. Constructs the pool key (id0, id1, token0, token1, feeOrHook) and reads the pool's reserves directly from the IZAMM.pools(poolId) mapping. Applies the constant product formula with the fee scaled in basis points (10,000 base).

Returns (0, 0) if the pool has zero reserves or the exact-out amount equals or exceeds the available reserve.

ATTRIBUTE	VALUE
Selector	`0xc0bb84b3`
Parameters	`exactOut` — swap direction; `feeOrHook` — pool fee in bps (1, 5, 30, or 100); `tokenIn` / `tokenOut` — token pair; `idIn` / `idOut` — token IDs (0 for standard ERC-20/ETH); `swapAmount` — amount in or amount out
Access	Public view — anyone

FLAG	OBSERVATION
◇	Uses a different fee scaling than V2: `(10000 - swapFee)` out of `10000` rather than V2's `997 / 1000`. This matches zAMM's native fee representation.
◇	Pool ID computed via `keccak256(abi.encode(PoolKey{...}))` — must match zAMM's internal pool key hashing exactly for correct reserve lookup.
◇	Supports ERC-1155 and native token variants via `idIn`/`idOut` parameters; standard ERC-20 / ETH uses `id = 0`.

function quoteZAMM(bool exactOut, uint256 feeOrHook, address tokenIn, address tokenOut,
    uint256 idIn, uint256 idOut, uint256 swapAmount)
    public view returns (uint256 amountIn, uint256 amountOut)
{
    unchecked {
        if (swapAmount == 0) return (0, 0);
        (address token0, address token1, bool zeroForOne) = _sortTokens(tokenIn, tokenOut);
        (uint256 id0, uint256 id1) = tokenIn == token0 ? (idIn, idOut) : (idOut, idIn);
        PoolKey memory key = PoolKey(id0, id1, token0, token1, feeOrHook);
        uint256 poolId = uint256(keccak256(abi.encode(key)));
        (uint112 reserve0, uint112 reserve1,,,,,) = IZAMM(ZAMM).pools(poolId);
        (uint256 reserveIn, uint256 reserveOut) = zeroForOne ? (reserve0, reserve1) : (reserve1, reserve0);
        if (reserveIn == 0 || reserveOut == 0) return (0, 0);
        if (exactOut) {
            if (swapAmount >= reserveOut) return (0, 0);
            amountIn = _getAmountIn(swapAmount, reserveIn, reserveOut, feeOrHook);
            amountOut = swapAmount;
        } else {
            amountIn = swapAmount;
            amountOut = _getAmountOut(amountIn, reserveIn, reserveOut, feeOrHook);
        }
    }
}

Function: `buildBestSwap(address to, bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, uint256 slippageBps, uint256 deadline)`

OverviewKey ObservationsFailure CasesCode

Combines quoting and calldata generation in one call. Calls getQuotes internally, identifies the best route, applies slippage tolerance to compute amountLimit, and encodes the appropriate zRouter function call (swapV2, swapVZ, swapV3, or swapV4) as ABI-encoded calldata.

Also returns msgValue — the ETH to attach to the zRouter call when tokenIn is native ETH.

Reverts if no route is available (all 14 pools returned (0, 0)).

ATTRIBUTE	VALUE
Selector	`0xe7798987`
Parameters	`to` — recipient of swap output; `exactOut` — swap direction; `tokenIn` / `tokenOut` — token pair; `swapAmount` — amount in or out; `slippageBps` — slippage tolerance in basis points; `deadline` — deadline timestamp (passed through to zRouter)
Access	Public view — anyone

FLAG	OBSERVATION
◇	For SushiSwap routes, the `deadline` is forcibly set to `type(uint256).max` regardless of the caller-supplied value — matching zRouter's sentinel convention for Sushi.
◇	Slippage is applied as: exact-in → `minOut = floor(quotedOut * (1 - bps/10000))`; exact-out → `maxIn = ceil(quotedIn * (1 + bps/10000))`.
△	The `ZROUTER` constant this calldata targets (`0x000000...1254835`) is the older zRouter from August 2025. Callers intending to use the newer zRouter (`0x000000...F600e4`) must use calldata against that address directly.
◇	V4 fee tier is internally converted from bps (1/5/30/100) back to V4 units (100/500/3000/10000) and tick spacing is recovered via `_spacingFromBps`.

CONDITION	REVERT MESSAGE
All 14 pools return (0,0)	`NoRoute()`
Best source is not a recognized AMM enum value	`UnsupportedAMM()`

function buildBestSwap(address to, bool exactOut, address tokenIn, address tokenOut,
    uint256 swapAmount, uint256 slippageBps, uint256 deadline)
    public view returns (Quote memory best, bytes memory callData, uint256 amountLimit, uint256 msgValue)
{
    unchecked {
        (best,) = getQuotes(exactOut, tokenIn, tokenOut, swapAmount);
        if (best.amountIn == 0 && best.amountOut == 0) revert NoRoute();
        uint256 quoted = exactOut ? best.amountIn : best.amountOut;
        amountLimit = SlippageLib.limit(exactOut, quoted, slippageBps);
        // build callData based on best.source (UNI_V2, SUSHI, ZAMM, UNI_V3, UNI_V4)
        msgValue = _requiredMsgValue(exactOut, tokenIn, swapAmount, amountLimit);
    }
}

Function: `buildBestSwapViaETHMulticall(address to, address refundTo, bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, uint256 slippageBps, uint256 deadline)`

OverviewKey ObservationsFailure CasesCode

Handles ERC-20 → ERC-20 swaps by routing through WETH as an intermediary (two-hop: tokenIn → WETH → tokenOut). Internally calls getQuotes twice — once for each leg — and assembles a multicall-compatible array of call entries that includes the two swap calls plus safety sweep calls for dust recovery.

Falls back to a single-hop path if either token is native ETH, WETH, or if a direct single-hop is sufficient.

Reverts if either leg returns no route.

ATTRIBUTE	VALUE
Selector	`0xe453166e`
Parameters	`to` — final recipient; `refundTo` — address receiving any leftover/dust swept from router; `exactOut` — swap direction (overall); `tokenIn` / `tokenOut` — ERC-20 tokens; `swapAmount` — overall amount; `slippageBps` — per-leg slippage; `deadline` — timestamp
Access	Public view — anyone

FLAG	OBSERVATION
◇	Single-hop fallback triggers if `tokenIn == address(0) \\|\\| tokenOut == address(0) \\|\\| tokenIn == WETH \\|\\| tokenOut == WETH`.
△	For exactOut two-hop paths where leg-2 is V2/Sushi, leg-1 routes output directly to the pool address (`leg1To = pool`) to prefund the V2 exactOut pull. This is a subtle but correct optimization matching zRouter behavior.
◇	Sweep entries for WETH and ETH are conditionally omitted when leg-2 is zAMM exact-out — an edge case where the router may not hold intermediate WETH.
◇	Returns two Quote structs (`a` for leg-1, `b` for leg-2) plus the calls array and `msgValue`. Callers submit the `calls` array to `zRouter.multicall`.
◇	Like `buildBestSwap`, the generated multicall targets the `ZROUTER` constant (`0x000000...1254835`).

CONDITION	REVERT MESSAGE
`swapAmount == 0`	`ZeroAmount()`
Leg-1 returns no route	`NoRoute()`
Leg-2 returns no route	`NoRoute()`

function buildBestSwapViaETHMulticall(address to, address refundTo, bool exactOut,
    address tokenIn, address tokenOut, uint256 swapAmount, uint256 slippageBps, uint256 deadline)
    public view returns (Quote memory a, Quote memory b, bytes[] memory calls, uint256 msgValue)
{
    unchecked {
        require(swapAmount != 0, ZeroAmount());
        // single-hop if either side is ETH/WETH
        if (tokenIn == address(0) || tokenOut == address(0) || tokenIn == WETH || tokenOut == WETH) {
            // ... single-hop path ...
            return (a, b, calls, msgValue);
        }
        // two-hop via WETH
        address MID = WETH;
        // ... exactIn or exactOut routing logic ...
        // ... assemble calls array with sweep entries ...
    }
}

Functions

Function Selectors

Summary

View Functions

Function: getQuotes(bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount)

Function: quoteV2(bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, bool sushi)

Function: quoteV3(bool exactOut, address tokenIn, address tokenOut, uint24 fee, uint256 swapAmount)

Function: quoteV4(bool exactOut, address tokenIn, address tokenOut, uint24 fee, int24 tickSpacing, address hooks, uint256 swapAmount)

Function: quoteZAMM(bool exactOut, uint256 feeOrHook, address tokenIn, address tokenOut, uint256 idIn, uint256 idOut, uint256 swapAmount)

Function: buildBestSwap(address to, bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, uint256 slippageBps, uint256 deadline)

Function: buildBestSwapViaETHMulticall(address to, address refundTo, bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, uint256 slippageBps, uint256 deadline)

Function: `getQuotes(bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount)`

Function: `quoteV2(bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, bool sushi)`

Function: `quoteV3(bool exactOut, address tokenIn, address tokenOut, uint24 fee, uint256 swapAmount)`

Function: `quoteV4(bool exactOut, address tokenIn, address tokenOut, uint24 fee, int24 tickSpacing, address hooks, uint256 swapAmount)`

Function: `quoteZAMM(bool exactOut, uint256 feeOrHook, address tokenIn, address tokenOut, uint256 idIn, uint256 idOut, uint256 swapAmount)`

Function: `buildBestSwap(address to, bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, uint256 slippageBps, uint256 deadline)`

Function: `buildBestSwapViaETHMulticall(address to, address refundTo, bool exactOut, address tokenIn, address tokenOut, uint256 swapAmount, uint256 slippageBps, uint256 deadline)`