How Routa works.
Everything on this page describes the code that is running, not a roadmap. Where a number appears in the interface, this page says where it came from and how it was combined.
Routa is a risk interface for Robinhood Chain (chain id 4663). It lists where capital is moving, builds a report for any token address, scores risk from observable data, and tests whether a token can be sold at all. Launches runs that sell test on every pool the moment it appears. All of that is read-only and needs no wallet.
Market lists cover every pool on the chain except the tokenized equities Robinhood issues itself, such as its NVIDIA and Meta tokens. Those are left out on purpose: they are listed securities, not the launches Routa is built to read, and they all carry the issuer’s logo rather than their own.
On top of that sit two pages that can act on what a report says: a swap that routes across every venue on the chain, and a portfolio that shows balances and every open token approval. Only the swap and the revoke button ever ask for a signature, and both are described in Wallet and safety.
Two rules shape every number you see. First, unknown inputs are reported as unknown and lower the score’s coverage; they are never guessed. Second, every input names its source, so a figure can always be traced back to the API or RPC call that produced it.
A token report combines all of these in one request and is cached for 30 seconds. When an upstream call fails, the last good value is served if there is one; otherwise that input becomes unknown and the error is listed in the report. Blockscout is linked from the interface but is never called from the server, because its Robinhood Chain instance blocks server-side traffic.
Each input awards between zero and its full weight in risk points. The score is the points awarded divided by the weight of the inputs that could actually be measured, scaled to 0 to 100 and rounded. Coverage is the measured weight divided by 130. If fewer than 20 points of weight could be measured, no score is shown at all.
Categories: Low Risk below 25, Moderate below 50, Elevated below 75, High Risk at 75 and above. Two floors override the arithmetic: a honeypot footprint raises the score to at least 90, and an identity collision raises it to at least 60.
Cards in Markets are scored from market data alone, so their coverage is around 70%. The report page adds holder distribution, verification, contract metadata, the identity check and the sell simulation, which is why a score there can differ from the card.
The simulation answers one question: if you bought this token right now, could you sell it back, and how much would you lose? Routa asks the chain directly with eth_simulateV1. A stand-in sender is funded by a state override, then a buy, an approval and a sell run in sequence inside one simulated block. Nothing is signed and nothing is broadcast.
Venue discovery is quote-based. Fourteen candidate routes are quoted concurrently: Uniswap V3 from WETH to the token at the 0.01%, 0.05%, 0.30% and 1.00% fee tiers, the same tiers via USDG, and Uniswap V2 directly and via USDG. The route with the highest expected output wins. If that route cannot complete the round trip, the best route of the other venue family is tried once. Uniswap V2 sells that revert are retried with the fee-on-transfer variant, and the plain revert is reported.
Uniswap V4 and Pons bonding curves are covered too. When a token’s deepest reported pool is a V4 pool or a curve, the round trip runs there instead: the buy, the approvals and the sell go through the real Universal Router (or the curve itself) inside the same simulated block, which is the only way to see a hook that permits buys and blocks sells. A V4 pool quoted in USDG is reached by buying USDG on V3 first, in the same block, and the proceeds are valued at that same rate; the report says so. Revert reasons are decoded, so a hook rejecting a sell reads as “the hook blocks sells” rather than as an opaque error, and the token is flagged as a honeypot.
The probe spends 0.01 ETH, scaled down to about 0.5% of the reported liquidity and never below 0.0005 ETH. Buy tax is the shortfall of tokens received against the in-block quote. Sell tax is the shortfall of ETH received against the in-block quote of the reversed path. Round-trip loss is simply ETH in minus ETH out, so it also contains pool fees and price impact.
The sellability input scores both, and the worse reading wins. Transfer tax alone misses a pool whose fee is the trap: a Uniswap V4 hook may charge 80% on every swap, which costs nothing in tax and almost everything on the way out. Because a round trip always pays two legs of fee and impact, loss is banded much wider than tax: measured across Robinhood Chain, a 0.01% pool costs 0.02%, a 0.30% pool 0.60%, a 1% pool 2.19% and the most expensive ordinary pool seen 9.93%. Loss from 12% is a watch, from 25% it raises COSTLY_EXIT, and from 75% the input is scored in full.
A token is treated as a honeypot when the sell reverts in every variant, when 90% or more of the proceeds disappear as tax, or when a round trip hands back less than 25% of the stake — you can sell, but the outcome is a honeypot’s. A token is reported as not simulated only when no route of any supported kind could be quoted — no indexed pool, a hook the quoter could not read, or an upstream that was rate limited. The sellability input then falls back to GeckoTerminal’s honeypot flag when one exists, and is otherwise unknown.
The newest pools on the chain, from the same new-pools list as Markets, newest first. Every row is put through the full sell simulation as it appears on the page, two at a time in list order so the public RPC is not flooded. Rows further down read Queued until their turn.
A verdict is one of five. Sellable: the round trip completed, and its cost is shown. Costly exit: it completed but lost 25% or more. Trap: the sell went through yet 90% of the proceeds were taken, or the round trip lost 75% or more. Sell reverted: the buy worked and the sell did not, the honeypot footprint. Not testable: no supported venue could quote the token yet.
Nothing is stored. The list and every verdict are fetched fresh, so a verdict describes the block the test ran on and nothing after it. It is a measurement, not a promise about the next trade.
Copycat tokens borrow the name or ticker of something people trust. Routa keeps a small registry of canonical contracts on Robinhood Chain: USDG at 0x5fc5360d0400a0fd4f2af552add042d716f1d168, WETH at 0x0bd7d308f8e1639fab988df18a8011f41eacad73, and PONS. A token that uses one of those names or tickers from a different address is flagged as an impersonator, which raises its score to at least 60 and shows the real address in the report.
A second list covers tickers of major assets and tokenized equities such as USDC, WBTC, NVDA or SPY. A contract using one of those tickers that CoinGecko does not recognise as that asset is flagged the same way, with a note to verify the issuer.
Everything described above runs without a wallet. A wallet is needed for two actions only: signing a swap, and signing a revoke of a token approval. Connecting is always something you do, never something a page does on load, and the connector list comes from the wallets your own browser announces plus Coinbase Wallet and, when the operator configured a project id, WalletConnect.
Routa is non-custodial by construction. There is no server-side signer and no key material anywhere in the codebase. Routa never asks for a seed phrase or a private key. It builds a transaction, checks it, simulates it, and hands it to your wallet; your wallet signs and sends it.
Five rules are enforced in the browser, on the transaction that is about to be signed, not merely on the server that proposed it:
- Allow-listed targets. Every transaction target and every approval spender must appear in the registry: the V2 and V3 routers, both Universal Routers, Permit2, or the token being approved. A Pons curve counts only after it has been confirmed on-chain as created by the registered Pons factory and as naming the same token back.
- A real minimum. Every swap carries a minimum output derived from your slippage setting (0.5% by default) and a deadline where the venue supports one. A quote whose minimum is zero, or does not match the calldata, is refused.
- Exact approvals. Approvals are for the amount of the trade. Unlimited is an explicit opt-in that resets on every page load, and an approval whose calldata does not match its own label is refused.
- A pre-send simulation. Each transaction is simulated from your address against current state right before it is sent, and the gas limit comes from that estimate rather than a hard-coded number. A failing simulation blocks the send and shows the decoded revert reason.
- Honest reporting. A swap is called successful only after a receipt with a success status. If a transaction was sent but the receipt could not be read, that is what it says, with a link to the explorer — never “failed”, and never “nothing was sent”.
A quote prices the pair on every venue at once and ranks the results by what you actually receive after the estimated gas cost, expressed in the buy token where that can be done honestly. Routes that did not work are not hidden: each venue reports whether it had no pool, was unsupported, reverted or errored, and the reason is on the page.
With a wallet connected, the same call returns the ordered transactions: approvals first, then the swap. A Uniswap V4 sell needs two approvals, the token to Permit2 and Permit2 to the Universal Router, the second with a 30-minute expiry. Before the routes are returned the best one is simulated from your address; if that fails, the route carries the warning instead of a gas hint.
Before any of that is reachable, the buy token’s risk score and flags are shown. A honeypot or impersonator flag, or a token whose risk could not be established, disables the button until the warning is explicitly acknowledged. Quotes go stale and are refreshed; a stale quote is refused rather than sent, because its minimum was computed against a price that has moved.
Holdings for any address: a candidate set is built from the canonical tokens, the tokens in the four market lists and the address’s own ERC-20 transfer logs, then every balance is read in Multicall3 batches and priced from DexScreener with GeckoTerminal as a fallback. Values below one dollar are separated as dust. Rows link straight back to the report and to a pre-filled swap.
Approvals are read live rather than inferred from logs: for every held token, the current allowance against each known router, Permit2, the token’s own Pons curve and every spender seen in that address’s approval logs, plus the Permit2 sub-allowances with their expiries. An unlimited allowance to a contract that is neither in the registry nor verified on Sourcify is marked for attention; a spender that turns out to be an ordinary wallet is marked too.
Log discovery on a shared public RPC is not reliable for busy wallets, so it is bounded and measured: queries are serialised, a timed-out range is bisected, and each scan reports the share of the block range it actually covered. That figure is printed on the page. Anything a scan once found is remembered for the session, so a later throttled scan never makes earlier finds vanish.
Revoking builds one transaction — approve(spender, 0) to the token, or lockdown to Permit2 — re-decodes it and checks target, function and arguments, simulates it, and confirms only from a receipt. It is offered only when the connected wallet is the address being viewed.
Every page in the interface is built on these JSON endpoints, and the read ones are open to use. Responses are wrapped in an envelope: { ok: true, data } on success and { ok: false, error, code } on failure, with 400 for bad input and 502 when an upstream provider is down.
The endpoints behind the swap and portfolio pages follow the same envelope. They are never cached publicly, because their answers depend on an address or on your browser key.
None of these endpoints signs or broadcasts anything. /api/quote returns transactions for your wallet to sign, and /api/rpc refuses every signing and send method outright.
curl "https://your-host/api/simulate?address=0x39dbed3a2bd333467115de45665cc57f813c4571"
Responses carry short public cache headers, 30 to 60 seconds. Upstream providers are rate limited, GeckoTerminal at roughly 30 requests per minute, so keep polling modest.
The score is a summary of observable signals. It is not an audit, it cannot read intent, and it does not know about off-chain promises. A Low Risk score means nothing measurable looked wrong at that moment; it does not mean an asset is safe. Holder distribution comes from GeckoTerminal and includes pools and locked supply among the top wallets.
The simulator covers Uniswap V2, V3 and V4 and Pons bonding curves. Swapping is stricter than simulating: a V4 pool is routable only when it has no hook or carries the Pons hook, so a token whose only market sits behind an unrecognised hook can be analysed and flagged but not traded here, and the quote says so. Multi-hop V4, exact-output swaps and curves quoted in something other than ETH are not supported and are reported as unsupported rather than guessed at.
Both the public RPC and GeckoTerminal are rate limited and shared, which is the main source of slow or partial answers: quotes can take tens of seconds, portfolio log scans can cover only part of the chain, and a token’s risk can come back unmeasured on a cold cache. Where that happens the interface says which part is missing rather than filling it in. Market data is refreshed on the cache schedule above, so a card can lag the chain by up to a minute. Routa serves Robinhood Chain only. Nothing here is financial advice.