Add StealthEX swap plugin

[j0ntz]

CHANGELOG

Does this branch warrant an entry to the CHANGELOG?

• Yes
• No

Dependencies

none

Description

Adds StealthEX as a centralized swap provider, on the v4 API.

Asana: https://app.asana.com/0/1215088146871429/1217498055202092

Asset identity. StealthEX names every asset by a symbol plus a network, so src/mappings/stealthex.ts records both halves per chain: the symbol and network of the chain's native asset, plus the network its tokens live on. A chain's native asset usually sits on mainnet, but plenty do not (BNB on bsc, AVAX on avax-c, WAXP on wax, OSMO on cosmos, ETH on each L2's own network), which is why the mapping spells out both rather than deriving one from the other.

Token symbols are not unique across listings, so quoting on a symbol alone could point a deposit at the wrong token. Each side of a quote is confirmed against StealthEX's own currency record (GET /v4/currencies/{symbol}/{network}) before any order is created: a token requires a present, matching contract_address, and a native asset requires StealthEX to have no contract address either, so a token listing can never be resolved for a native swap. StealthEX omits the contract address on some token listings (USDC on Tron among them); those tokens stay unsupported rather than quoted on an unverified symbol match. Resolved currencies are cached for the lifetime of the plugin; failed lookups are not, so newly listed assets work without an app restart.

Rate type. Quotes use a fixed rate when both assets support one, which is also what makes "quote by the amount I want to receive" work (StealthEX only offers reversed estimation on fixed rates). Both assets advertising fixed support does not guarantee the pair has a fixed route, so a missing route falls back to a floating quote with isEstimate: true.

fetchSwapQuote runs checkInvalidTokenIds first, so the shared same-asset guard and the default invalid-token list apply here as they do in the sibling central plugins.

Other notes. Requests go through io.fetchCors: StealthEX blocks browser-origin requests, and swap plugins run inside a WebView. Limits come from POST /v4/rates/range and map to SwapBelowLimitError / SwapAboveLimitError; NoPair / NoExchangeRoute / RouteIsDisabled / MarketUnavailable map to SwapCurrencyError and NotAllowed to a reasonless SwapPermissionError: StealthEX returns NotAllowed for causes it does not name (it was observed refusing a route minutes after the identical call succeeded), so claiming a geographic restriction would be a guess.

Telos and Monad are listed by StealthEX but mapped to null: neither listing carries an address format, so which address space they expect cannot be confirmed, and a wrong guess loses funds.

Companion GUI PR wires the plugin up: EdgeApp/edge-react-gui#6160

[j0ntz]

📸 Test evidence

stealthex quote

stealthex success

stealthex tx details

Captured by the agent's in-app test run (build-and-test).

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8ae9a4d. Configure here.}