A number on a screen only helps whoever is reading it
Agents, DCA bots, treasury execution and liquidations against stock collateral never read a quote. For them the band has to hold where the trade settles, so the guard runs as a program and refuses the fill itself.
How it holds
The guard never routes your swap and never moves a token. It brackets an untouched swap inside one transaction and checks what actually happened.
- 0record_pre_stateSnapshot balances, oracle price and the permitted band
- 1any swapJupiter, unmodified, any venue
- 2verify_fillCompare balance deltas against the band, or revert everything
Solana settles a transaction whole or not at all, so a failed check in step 2 unwinds the swap in step 1 that had already run.
Try it against the cluster
devnetPrice a fill outside the band and send it. The program decides, the cluster settles it, and you get the transaction back either way.
Devnet has no tokenized-stock pool to trade against, so the middle instruction mints the base and burns the quote instead of swapping. The guard reads balance deltas and has no opinion on what moved them, so the check it performs is the one it would perform on a real swap.
Each run is a new transaction on devnet, signed by this site’s own wallet. Nothing is simulated.
Two we ran earlier
band 301 bpBoth token transfers in the rejected fill had already executed when the check failed. The balance is identical either side of it because the chain threw the whole transaction away.
- Program, Solana devnet
- DeAF1jFtXTweJnC8x1P5VkzYNcdiqC6EfGiz6uxhi8ig
- Reference feed
- Crypto.SOL/USD, because devnet carries no live equity feed. The enforcement path is the one mainnet would run; only the asset being referenced differs.