Are DEXes Non-Custodial

The query are dexes non-custodial needs a qualified yes. Usually, a spot DEX lets you keep control of the wallet keys until a signed transaction executes against smart contracts. The exchange company does not hold a standing account balance for you. Yet approvals, deposited liquidity, limit-order escrows, bridges, upgrade keys, and derivatives margin can move control elsewhere.

A practical definition of custody

Custody is the ability to control or dispose of an asset.

On a centralized exchange, users normally deposit to addresses controlled by the operator. The exchange updates an internal ledger when trades occur. A withdrawal asks the operator to create an onchain transaction. If withdrawals pause, the user cannot force the internal balance out with a wallet signature.

A self-custodial DEX user holds a private key or controls a smart-account authorization policy. The user signs a transaction or a narrowly defined order. Smart contracts then enforce settlement.

The distinction has several layers:

A DEX can be non-custodial at the wallet layer while an upgradeable router or hostile interface creates another control path. Labels are too coarse for serious risk work.

How a spot swap settles

Consider swapping 1,000 USDC for ETH through an automated market maker.

First, the wallet may approve a router or permission contract to spend USDC. Then the user submits the swap transaction. The router pulls the authorized USDC, sends it into one or more pools, receives ETH or WETH, and directs the output to the chosen recipient. A minimum-output field protects against excessive price movement.

If any required condition fails, the EVM reverts the transaction state. Gas is still spent, but the swap transfers do not remain half-completed.

1. 01

   Authorize

   The wallet grants a specific token allowance or signs a permit with amount and time bounds.

2. 02

   Execute

   The router pulls the input and follows the quoted path through one or more liquidity sources.

3. 03

   Settle

   The output reaches the recipient and the full transaction succeeds, or state changes revert.

4. 04

   Review

   Any unused or unlimited allowance can remain after settlement and should be checked separately.

Uniswap Support says its routers are designed for transaction execution rather than holding user funds. That is a useful implementation property. It does not mean every contract calling itself a router behaves that way.

Approval is permission rather than a deposit

The ERC-20 standard defines approve, allowance, and transferFrom. An owner can let a spender transfer tokens up to an authorized amount.

Suppose a wallet holds 5,000 USDC and grants a router an unlimited allowance. The balance still reads 5,000 USDC. But the approved spender has a standing path to call transferFrom under its contract logic. If that spender is compromised, malicious, or upgradeable into dangerous behavior, the wallet balance can be exposed.

Approval size and trade size are different variables.

Uniswap's Permit2 documentation describes a two-step permission system. The user first gives the Permit2 contract an onchain token approval. A later signed message grants an application-specific permission. Time and amount constraints can reduce lingering exposure, provided the user reads what the signature authorizes.

A signature can carry financial authority even when the wallet shows no gas fee. Rejecting a vague typed-data request is sensible. Review the spender, token, amount, deadline, nonce, and chain.

Where funds sit by DEX model

Automated market maker spot swap

The trader's input moves to pool contracts and the output returns within one atomic transaction. Liquidity providers already deposited the pool reserves. Trader settlement is typically non-custodial; LP assets are committed to contract custody.

Onchain order book

Some order books require assets deposited into a trading contract before orders can match. Others authorize a settlement contract to fill signed orders directly from a wallet. Ask whether cancellation is a signature, an onchain transaction, or a withdrawal from escrow.

Intent and solver exchange

The user signs an order describing acceptable output, deadline, and other conditions. Competing solvers find execution. Funds can remain in the wallet until settlement, though the settlement contract or relayer needs valid authority to move them.

DEX aggregator

An aggregator can split an order across pools and market makers. The user may still self-custody before execution. Risk expands because the quote can call several contracts, and the API or frontend chooses the calldata.

0x's current contract documentation separates allowance targets from execution entry points. It warns users never to approve the Settler contract and says approvals should go only to the returned AllowanceHolder or Permit2 address. That precision is why copying an address from an old tutorial is unsafe.

Cross-chain DEX or bridge swap

Atomic settlement usually stops at the chain boundary. A bridge can lock assets, mint a representation, use liquidity providers, or wait for relayers. The destination transfer may complete later. Read what bridging in crypto is before treating a cross-chain swap like a local AMM trade.

Perpetual DEX

Perpetuals need collateral accounting over time. A protocol may hold margin inside smart contracts, a chain-specific account, or a vault. Positions depend on oracles, liquidators, funding, and an exit mechanism. The venue may remain non-custodial in the sense that no company withdrawal desk controls funds, while the trader cannot freely withdraw collateral supporting an open position.

RFQ and market-maker route

A professional market maker signs a quote, then onchain settlement exchanges assets. Check who the taker transfers to, whether settlement is atomic, and whether a relayer can alter the recipient or fee.

LPs give assets to contracts

Liquidity provision deserves separate language.

When someone deposits USDC and ETH into an AMM pool, those tokens move from the wallet into a smart contract. The LP receives fungible shares or an NFT position representing a claim under pool rules. Private keys control the LP position, while the underlying reserves sit in the contract.

That is contract custody. A normal withdrawal can be unilateral because the LP signs a burn or decrease-liquidity transaction. Pauses, hooks, lockups, vault wrappers, and upgrades can change the exit.

The economic risk also differs. A spot trader experiences price impact for one transaction. An LP remains exposed to price movement, fee income, token quality, and impermanent loss. A farm can add reward-contract approval and lockup risk.

Admin keys and frontend control

Immutable contracts cannot be upgraded in place. Proxy contracts often can. A multisig or governance system may change the implementation, fees, pause state, allowlist, oracle, or supported routes.

Review four questions.

• Is the contract upgradeable, and which address controls upgrades?
• Delay. Does a timelock give users time to exit before a new implementation executes?
• Can an admin pause withdrawals, settlement, or individual tokens?
• Are fees capped in code, or can governance raise them without a bound?

The frontend is another system. A website can be compromised while the underlying protocol contracts remain unchanged. A malicious interface can change the spender, output recipient, token address, or calldata.

Use a saved official domain and wallet simulation. Compare the transaction's to address with current official deployments. For a high-value trade, a hardware wallet screen that shows only “blind signing” provides weak evidence.

Current Uniswap and 0x instructions both spend considerable space on allowances. The 0x V2 docs distinguish the allowance spender from the execution contract and explicitly warn against approving Settler. That level of detail is absent from many search snippets, so I treat “non-custodial” as the start of the audit rather than its conclusion.

A custody matrix for common actions

“Usually” is doing real work in the table. Forked protocols can change one function and keep the familiar interface.

Non-custodial does not guarantee good execution

A user can control keys and still receive a terrible price.

AMM price impact grows with order size relative to liquidity. Slippage tolerance determines the worst execution allowed before a revert. Token transfer taxes, rebasing mechanics, or malicious code can distort received amounts.

MEV searchers may reorder or surround public transactions when profitable. Private relays and intent auctions can reduce certain forms of exposure, yet they introduce relayer or solver assumptions.

Check the minimum received in units of the output token. A percentage alone is easy to misread. For a quote of 2.000 ETH with 1% slippage tolerance, the minimum may be around 1.980 ETH before any separate fee, depending on the interface's calculation.

And identify the token contract. A non-custodial swap into a counterfeit asset settles exactly as coded.

How to test a DEX claim

1. Identify the wallet model

   Confirm that you control the signing key or smart-account policy. A login that merely exposes an exchange ledger is custodial even if it uses a wallet-shaped interface.

2. Trace the token before signing

   Record the owner wallet, token contract, allowance spender, execution target, liquidity source, recipient, and minimum output.

3. Read control documentation

   Find verified deployments, audits, upgrade roles, timelocks, pauses, and emergency procedures. A logo plus a TVL number gives none of this.

4. Simulate a small transaction

   Use the wallet preview or an independent simulator. Confirm balance changes and approvals. Then execute a small amount from a wallet that does not hold unrelated long-term assets.

5. Test the exit

   Remove liquidity, cancel an order, or withdraw collateral before increasing size. A working deposit says little about the reverse path.

6. Revoke what no longer serves a purpose

   Inspect remaining allowances after the operation with a trusted explorer or the token approval checker.

Common false assumptions

The website cannot access funds because it is a DEX

The website can propose a harmful transaction or signature. The wallet is the enforcement point. Read the request.

Tokens are safe because they still show in the wallet

An allowance can persist beside a visible balance. The approved spender may have authority to transfer later.

An audit proves non-custody

An audit reviews selected code, assumptions, and a version. Custody depends on the deployed architecture and control roles.

Open source means immutable

Published source can sit behind an upgradeable proxy. Check the actual proxy, implementation, and admin.

A decentralized protocol makes every interface decentralized

Different frontends can add fees, block locations, choose routers, or become compromised. Protocol and interface are separate.

DEX custody checklist

• I control the wallet key or the smart-account signer policy.
• Token contract and chain match the asset I intend to trade.
• The approval spender matches current official documentation.
• Approval amount and deadline are no broader than needed.
• Execution target, recipient, input amount, and minimum output are visible.
• I know whether the action is atomic, escrowed, margined, or cross-chain.
• Upgrade, pause, and emergency roles have been identified.
• The test trade and exit both succeeded.
• Remaining allowances were reviewed afterward.
• Long-term holdings remain separate from experimental contracts.

If you only do three things

1. Distinguish wallet custody from contract permissions and deposited collateral.
2. Verify the spender and transaction target against live official documentation.
3. Test both entry and exit with a small isolated balance, then review allowances.

Are DEXes non-custodial FAQ

›Do DEXes hold my crypto during a swap?

A conventional AMM spot swap transfers assets through contracts within one atomic transaction. The router usually does not keep a standing user balance. Other DEX designs may escrow orders or hold margin.

›Does a token approval give custody to a DEX?

An approval gives a specified spender authority to transfer up to an amount under the token contract. Your balance remains in the wallet until transferFrom executes, but the permission can persist and create exposure.

›Are liquidity pools non-custodial?

The LP controls a claim or position key, while the underlying reserves sit in the pool contract. Withdrawal can be unilateral under the code, subject to hooks, pauses, locks, upgrades, and available liquidity.

›Are perpetual DEXes non-custodial?

Some are, but collateral remains governed by margin, liquidation, and withdrawal contracts while a position is open. Inspect the specific venue's custody, chain, validator, and admin model.

›Can a non-custodial DEX freeze funds?

Immutable spot contracts may lack a freeze function. Upgradeable routers, pools, token issuers, bridges, and margin systems can have pause or control roles. Review each deployed component.

Sources and methodology

This analysis uses the ERC-20 specification, ERC-2612 permit standard, Uniswap's official approval guidance and Permit2 explanation, plus 0x's current Settler and allowance contract documentation. Architecture claims are scoped by DEX model because no universal implementation exists.

DeFi Farmer does not operate the protocols discussed. Self-custody makes transaction review your responsibility and does not remove smart-contract or market risk. Use isolated wallets for new applications and seek qualified advice where custody classification carries legal or regulatory consequences.