> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravn.exchange/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Model

> Non-custodial by design. You always receive the real token, never a wrapped copy.

RAVN is an **orchestration layer, not a custodian**. It finds routes and normalizes execution.
It never holds, wraps, or mints user funds.

## Non-custodial

* The user signs or sends directly to the venue. RAVN never takes custody of funds at any point
  in a swap.
* For `DEPOSIT` routes, the user sends the origin asset to a venue-generated address. For
  `SIGNATURE` and `TRANSACTION` routes, the user signs or broadcasts directly.

## The real token out, and no bridge of our own

RAVN routes through RFQ market makers, intent networks, solver and relayer networks,
validator-vault networks, and on-chain DEX aggregators. You always receive the real token, never
a wrapped copy (only one you picked, like WBTC). RAVN runs no bridge of its own. NEAR Intents
moves coins in and out through its own bridge, so on its routes your deposit is held as a
matching token on NEAR for the minutes the swap takes. Every quote names the winning venue.

## Quote integrity

* Quotes are returned as an opaque, signed `quoteToken`. It is tamper-evident, so any
  modification of the amount, fee, or route invalidates it, and execution rejects it with
  `QUOTE_INVALID`.
* Quotes expire, and execution re-validates the expiry before building the transaction.

## Venue-enforced settlement

Each venue independently validates the economics and signatures of the order it settles. RAVN
never asks a user to sign anything the destination venue will not verify on its own.

## Gasless where it counts

On RFQ and gasless venues, the user needs zero native gas. They sign an off-chain message and a
solver covers execution. The user only ever needs the asset they are selling.

<Note>
  Reliability signal: [`GET /health`](/api-reference/health) reports live per-venue status, so
  integrators can surface degraded routing in real time.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.