Use mint and program identity
Resolve tokens by mint, decimals, token program, and verified market or pool addresses. Similar symbols can refer to wrapped, bridged, or unrelated assets. Route adapters should preserve exact identities and required accounts even when they expose normalized prices.
Allowlist reviewed tokens and programs. Unknown contract behavior, owner changes, and upgrades trigger a fail-closed response. A system that can discover arbitrary programs should not automatically gain permission to sign their instructions.
Construct bounded transactions
A transaction builder assembles instructions, accounts, recent validity context, compute settings, minimum output, and fee policy. Complex routes may face size or compute constraints. Route optimization should account for operational complexity, not only estimated output.
Signing should be isolated from route discovery. The signer validates fee payer, programs, assets, destinations, value, and instruction pattern. It rejects arbitrary transfers and stale approvals.
Simulate and expire quickly
Simulation can expose program errors, account problems, compute use, and expected output. Record the referenced state and logs. Classify failures so a broken adapter or route family can be quarantined rather than retried blindly.
A successful simulation remains a snapshot. State can change before inclusion. Minimum output, profit floor, route expiration, and resimulation protect against some drift. A wide tolerance can turn an arbitrage into an unplanned directional swap.
Price compute and inclusion
Compute limits and priority fees influence whether a transaction lands and how much it costs. Calibrate them from measured routes, set absolute and profit-relative caps, and include failed attempts in economics. Congestion should increase selectivity, not automatically increase bids.
RPC providers and submission channels are dependencies. Monitor slot progress, latency, errors, and disagreement. When state confidence falls, stop creating new exposure while preserving status checks and reconciliation.
Coordinate centralized and onchain legs
A Solana swap and centralized exchange order are not atomic together. Pre-funded inventory can allow near-simultaneous execution, while transfers are handled as rebalancing. Verify that the exchange supports the exact mint and network and that deposits are active.
Track transaction signature, confirmation, exchange order state, deposit status, fees, and final inventory. Duplicate economic execution can occur when operators rebuild a trade before an earlier uncertain attempt is resolved.