Ekubo: concentrated liquidity, approval recovery and wallet authority

Ekubo is an automated market maker operating on Starknet and EVM networks. Its pool architecture combines concentrated liquidity, shared settlement and optional extensions. A trader begins with a compatible wallet, chooses the correct chain and assets, and reviews a quote before authorising execution. The official introduction describes a Shared Revenue License, so published source code should not be treated as an unrestricted licence to reuse every component commercially.[1]

The quoter pins its calculation to a block and can combine routes across different pool designs. Exact-input and exact-output swaps protect different sides of the trade. Extensions also change the economics: MEV-capture pools levy an additional charge on sufficiently price-moving swaps. That fee is credited at a later interaction with a later block timestamp, so the liquidity eligible then can differ from the liquidity present during the original trade.[3]

A DCA order needs a compatible pool. Selling is represented as a continuous rate, with the actual chain processing at most once per block. The documented minimum time grid is 256 seconds on EVM and 16 seconds on Starknet, expanding for more distant schedules. Opposing flows can offset without a pool fee; the imbalance trades against liquidity. The order can be stopped, but already executed sales remain completed. Its NFT represents the remaining capital.[6]

The audit index now describes Starknet limit-order placement as deprecated. Older product explanations of that extension should therefore not be read as confirmation that new limit orders remain available. The same index distinguishes superseded EVM V2 contracts from V3. A profile of the current service must preserve those version differences rather than collecting every historical feature into one menu.[13]

For an illustrative 100 tokens of gross LP swap fees, the stated protocol shares leave 90 tokens on EVM or 80 on Starknet, before other costs. These are deductions from earned fees, not 10% or 20% charges on the traded principal. Core itself applies no protocol fee; the canonical Positions contract applies this share.[4]

Gas optimisation comes from shared accounting and settling net movements, rather than transferring tokens between separate contracts at every intermediate step. That can reduce work, but the network still prices execution and the selected route still embeds trading costs. An output already adjusted for its pool fees should not have the same fee deducted again merely because the preview displays it separately.[25]

The current Yul router uses a minimum output for exact-input trades and a maximum input for exact-output trades. If a fee-adjusted quote is 250 tokens and the illustrative tolerance is 0.5%, the minimum is 248.75 tokens. The interface sets a 30-minute deadline from the latest block timestamp when the user signs. Omitting a deadline through the SDK permits indefinite validity: a price bound alone does not limit time.[14]

A swap integration must match the chain, SDK and deployed router version. The current guide identifies Yul router v0.8.0 and distinguishes mainnet from testnet deployments. The existence of an address on two networks does not make the balances interchangeable. Check the asset contract and network before moving funds from a centralised exchange or another wallet, and retain the native asset needed to submit the next transaction.[24]

Integrated transfer flows can pass the chosen networks, assets, amount, recipient, refund address and related transaction information to Layerswap and downstream providers. Confirm those details before proceeding. A cross-chain transfer is a separate workflow from a same-chain swap; a source transaction alone does not demonstrate that the intended asset has arrived at the final destination.[26]

The terms warn that some integrated routes place assets under a provider’s or liquidity provider’s control pending settlement. Their own eligibility, fees and refund rules apply. An estimated arrival time is not a guarantee, and a refund can be delayed, reduced or unavailable.[10]

To provide liquidity, select the full pool configuration: token pair, fee, tick spacing and any extension. Then select a range and quantities. Reversing the displayed quote convention does not create a different pair. As price moves beyond a boundary, the position can become entirely one asset. Withdrawal therefore returns the current inventory, which can differ substantially from the original deposit even when fees have accrued.[5]

Wallet review separates the request from its approval. The native app shows the payload, asks for operating-system authentication and rechecks state before signing. Closing a review is not an approval. Token permits need particular care: a signature’s acceptance deadline is not necessarily an expiry for the resulting allowance, and later spending can happen without another wallet prompt. Disconnecting the display does not revoke an on-chain permission.[21]

Shared Core settlement uses a transaction-level accounting lock. That term describes an atomic settlement boundary, not a promised long-term lockup of every user balance. Positions, order managers and routers perform different jobs around Core. Consequently, a claim that Core is immutable says nothing by itself about a peripheral contract, bridge provider or the software that proposes an approval.[9]

Third-party privacy contracts can be upgraded or paused by their operators. That can delay or prevent access to assets held through shadow accounts.[10]

On 5 May 2026, a Huff-router parsing flaw enabled spending against other wallets’ token approvals. Ekubo’s detailed summary identifies about US$1.42 million lost across 31 addresses, involving four Ethereum and Arbitrum routers. They were outside independent audit scope and remain immutable and vulnerable. The interface stopped routing through them; finite approvals were cleared through a protective intervention, while remaining unlimited approvals still require revocation. The current interface limits approvals to the amount being spent.[28]

Revoke.cash independently maintains an affected-approval checker for the incident. Its account separates vulnerable router approvals from the unaffected Core liquidity contracts and Starknet deployment. The lasting issue is the permission granted to an old spender, not simply whether a user has revisited the old website. Check the exact chain and spender, because connecting a different wallet or closing a browser does not remove that approval.[31]

The executed 15 June DAO proposal financed a 300,000-USDC recovery fund from its Ethereum USDC-USDT position. The July account describes the transfer, conversion and return of the remaining position proceeds. That establishes a funded recovery programme, not full reimbursement of approximately US$1.42 million in identified losses. Per-address caps matter. A later change of router does not itself pay a claim or prove that every eligible address collected.[29]

The published recovery-contract review requires the claimant to accept conditions and call from the allocation’s address. Its code also allows an owner to end claims; recorded allocations do not themselves prove adequate funding or successful payment. That repository review is not an external audit or an independently replayed payout ledger. This profile therefore does not certify universal recovery, a permanent claim window or standing insurance for future incidents.[30]

Audit coverage must follow the version. The audit index lists independent Core and extension reviews alongside a July Cantina automated scan. The current router reference separately explains that July reviews predate later functionality, while September/October reviews of v0.7.1 and v0.8.0 were internal. A previous review should not be promoted into complete independent coverage of the current router.[13][14]

The optional wallet’s security guide documents a material Windows/Linux limitation: malware running as the same operating-system user can extract private keys from the credential backend and sign elsewhere, bypassing wallet policies and its activity records. Closing the wallet does not delete those credentials. macOS uses stronger application-specific Keychain controls, but this is not protection against a compromised operating system or wallet process. In-app agent restrictions cannot cure a key extracted outside the app.[18]

Website terms v1.3, effective 13 October 2026, require adulthood and exclude sanctioned parties and sanctioned or embargoed locations. A wallet connection does not override those conditions. Additional asset and third-party restrictions can narrow access further.[10]

The public MCP service applies jurisdiction checks to restricted assets, including tokenised equities on Robinhood Chain. It uses detected location and fails closed where that check cannot be resolved; users cannot simply supply a preferred country. Discovery can still show an asset that cannot be purchased. The documented restriction is designed to preserve exits such as withdrawing liquidity, collecting proceeds and revoking approvals.[22]

The October privacy feature is limited: private swaps are exact-input, and shadow accounts do not currently offer DCA or limit orders, migration of existing public positions, or transferable private positions. The account’s transactions remain public even though the wallet-to-account association is shielded. Amounts and timing can still reveal relationships. These are separate third-party privacy contracts, not an anonymity guarantee for every Ekubo activity.[32]

The privacy policy explains that browser and infrastructure data can link activity. Cloudflare and WalletConnect-related services can receive connection or page information, and requests involving a shadow account can originate from the same browser as the ordinary wallet. Privacy on a blockchain does not imply that the interface, wallet provider and network services see no identifying information.[26]

The official wallet documentation links Ekubo’s Discord for help. For a failed action, retain the network, public transaction hash, account address and the exact workflow involved. A locally prepared plan, a signed request and a mined transaction are different states. No emergency dealing desk or guaranteed customer-service turnaround was established from the inspected material. Recovery of a local key depends on the wallet backup, not a conventional exchange account reset.[15]

If the optional wallet signs a transaction but every broadcast endpoint rejects it, the activity can remain marked Signed. Its Send now action retries the same signed envelope. Before preparing a replacement, check whether the original was accepted elsewhere; otherwise two separately valid transactions could express more exposure than intended. A support message cannot undo a confirmed transfer.[21]

Formal notices go to [email protected]. The terms provide an informal dispute conference within 45 days of notice, followed by their individual arbitration framework. They also disclaim an obligation to provide support or maintenance. A complaint process is not a transaction-cancellation instruction.[10]

The July operational account also describes a June Starknet limit-order correction and an earlier episode in which affected pools required governance action before unfreezing. These histories show why an interface being reachable does not prove every product can immediately exit. During a problem, establish which chain, contract and position are affected rather than assuming the entire brand has one uniform status.[29]

The published 9 October ownership matrix records 33 peripheral-contract transfers to DAO proxies across 11 EVM chains. These were company-signed, board-approved transfers, not transactions executed by a DAO vote. Six Positions or Orders contracts on BNB Smart Chain and Monad remained company-controlled. Positions ownership permits collection of accrued protocol fees and administration; Orders ownership does not itself permit withdrawing user funds. These distinctions matter more than a blanket claim that every deployment is DAO-controlled.[12]

The governance documentation says production messaging through the ten L2/sidechain owner proxies remained unproven despite ownership checks and fork testing. If delivery fails, relevant owner-only functions could be unreachable until repaired. That qualification does not itself transfer user positions or change immutable EVM Core. Corporate registration and governance configuration also do not establish a financial-services permission. No exchange-specific authorisation or statutory compensation entitlement was verified for Ekubo, Inc.[11]

Ordinary EKUBO governance staking has no lockup or withdrawal penalty; this differs from a long-duration Ve33 stake.[11]

Ekubo, Inc. is identified as a Delaware C corporation founded by Moody Salem. It developed the original protocol, interface, indexer, API and governance tooling. The website terms name it as the site provider, while token governance and individual integrations exercise separate responsibilities.[11]

The 15 August 2026 STONX report covers its first two weeks, from 31 July to 14 August: 240,361 swaps and approximately US$46.43 million of volume, with US$1.07 million TVL at the cutoff. Ekubo, Inc. represented 99.1% of the reported stake. These are a dated product launch’s issuer figures, not current global daily activity or a human-user count. The report’s participating addresses should not be relabelled as registered customers.[27]

Operator

Ekubo, Inc. supplies the interface and software; protocol governance and third-party integrations have separate control roles.

Exchange model

Decentralised

Service scope

Spot swaps, liquidity provision and TWAMM orders across Starknet and EVM deployments; an optional desktop wallet adds automation.

Client types

Retail clients

Pricing publication

Public pricing

Funding scope

Crypto wallets and integrated transfer providers; chain, recipient and refund conditions are route-specific.

Custody and asset handling

Wallet keys, protocol positions, third-party transfers and privacy contracts have different asset-control arrangements.

Client eligibility

Adults with legal capacity, excluding sanctioned parties and restricted jurisdictions; asset and provider conditions also apply.

Support

Official Discord; no guaranteed customer-service response time established.

Authorisation and registration scope

Corporate identity and protocol governance are documented; no entity-specific exchange licence or statutory client compensation was verified.

Exchange metadata checked 20 Oct 2026Source 1Source 2Source 4Source 9Source 10Source 11Source 15Source 26Source 32

Reward campaigns specify their chain, token, dates and qualifying pools or positions. Ekubo measures useful liquidity near market prices rather than merely the amount deposited, and distributes rewards through periodic claim drops. Estimated accrual is therefore different from currently claimable tokens. Some drop contracts let the owner recover unclaimed funds. There is no verified universal withdrawable signup bonus, and reward-token prices can change before or after a claim.[7]

Ve33 voting stakes can be locked for up to four years, with voting weight reflecting both amount and remaining time. Voters receive pool swap fees while LPs receive emissions; a transfer of the stake NFT transfers the associated position. An emissions programme does not promise a stable return or permanent funding.[8]

Desktop installation is documented for Apple Silicon macOS and x86 Windows and Linux. Creating an account does not automatically display a recovery key; the owner must use the wallet’s explicit export process when arranging a backup. These are desktop capabilities, and this review did not establish feature-equivalent native mobile applications. The chosen operating system’s custody limitations remain relevant after installation.[16]

WalletConnect sessions are held only in memory and disconnect when the app quits, updates or restarts. They do not automatically reconnect. Personal-message and typed-data signatures always require native review. This session behaviour should not be confused with ERC-20 allowances or on-chain orders, which can outlive a disconnected session and need their own revocation or cancellation.[20]

The indexer turns chain events into queryable data for swaps, positions, fees and other activity, with reorganisation handling and self-hosting options. Its public API and database snapshots can help reconcile a position’s history. They do not establish a complete user tax statement. A useful reconciliation separates deposits, trades, fees, rewards, position changes and withdrawals rather than treating every incoming token as investment profit.[23]

The public MCP endpoint is unauthenticated and produces quotes, reads and unsigned transaction plans; it does not hold keys, sign or submit. IP-based rate limits can change, so no fixed institutional quota or service guarantee follows. The optional local wallet can consume a plan, validate and simulate it, then apply the owner’s signing rules. Some plans use other protocols, so supported integrations are not all trades against Ekubo pools.[22]

Signing policy defaults to review and applies across requesters: a transaction allowed for an AI agent can also match a connected dapp or automation. Rules are evaluated in order, and the least-permissive call governs a batch. Per-call value limits are not cumulative spending budgets. Agents can propose policy changes but cannot install them; widening authority requires owner action. These controls define execution permission, not whether the proposed trade is financially sensible.[17]

Automations operate only while the wallet app is running and skip missed ticks. An agent can install one within already granted policy, without acquiring new signing rights. A policy revision stops existing automations pending review; execution failures can disable them. Stopping automation does not close positions already created. Its bounded local history is not a substitute for complete chain records, and no separate copy-trading responsibility agreement was verified.[19]