⚡️ EagleSwap.to – No KYC crypto-to-crypto swap 🟪 From 0.4%

[EagleSwap]

⚡️ EagleSwap.to  – No KYC crypto-to-crypto swap


📄Info:

• Fees: Our fees typically range from 0.4% to 1%.
• Privacy: We don't require you to sign up. We don't do KYC.
• Coins: We have over 150 coins to choose from.
• Swap types: We support both fixed and float swaps.
• Resellers: Resellers are welcome! We offer both referral links and API access.

🤝Partners & Mentions

• NOTOKYC
• ANTIKYC ( $2000 Security deposit )
• MONERICA
• NOTKYC

• GlobeNewsWire
• CoinMarketCap

🔗 Links:

• Support: https://t.me/EagleSwapSupport
• Email: support@eagleswap.to

• Telegram Bot: https://t.me/EagleSwap
• Info & Updates: https://t.me/EagleSwapTG

[Decimation]

Welcome to the forum.

After visiting the site and found that it needs more updates. Pool has not been added here, so it is not possible to understand how much reserve each coin has. However, why was the domain name (.to) taken?

Attention should be given to customer service and it should be ensured in no way that the customers are harmed. May your journey be successful.

[EagleSwap]

Welcome to the forum.

After visiting the site and found that it needs more updates. Pool has not been added here, so it is not possible to understand how much reserve each coin has. However, why was the domain name (.to) taken?

Attention should be given to customer service and it should be ensured in no way that the customers are harmed. May your journey be successful.

Thanks for your message.

-We don't have our own liquidity, instead we use 3rd party liquidity.
-.to domain was chosen because popular domains were taken.

"Attention should be given to customer service and it should be ensured in no way that the customers are harmed." What do you mean by this?

[TryNinja]

-We don't have our own liquidity, instead we use 3rd party liquidity.

What happens if the 3rd party says: "Hey, the coins you sent us to exchange are dirty so we are blocking them. Please ask your customer to send their documents and proof of funds"?

Are all your 3rd party liquidity partners diehard fans of the no-KYC mantra?

Also, feel free to add yourself to bitlist: https://bitlist.co/suggest-project

[EagleSwap]

-We don't have our own liquidity, instead we use 3rd party liquidity.

What happens if the 3rd party says: "Hey, the coins you sent us to exchange are dirty so we are blocking them. Please ask your customer to send their documents and proof of funds"?

Are all your 3rd party liquidity partners diehard fans of the no-KYC mantra?

Also, feel free to add yourself to bitlist: https://bitlist.co/suggest-project

Yes they are, there is 0 risk for KYC on our platform. However we do AML checks, which means that we don't process high risk deposits and they will be refunded to user.

Appreciate the suggestion. We will definitely apply to bitlist!

[hosemary]

Yes they are, there is 0 risk for KYC on our platform. However we do AML checks, which means that we don't process high risk deposits and they will be refunded to user.

But your Terms of Use says something else. It says that that the funds will be refunded where "technically and legally possible."
What if that's not technically and legally possible, and the execution provider blocks the funds?

[Bitcoin_Arena]

Right now there are no limits (minimum and maximum amounts of coins that can be swapped) on the swap page, making the user clueless on whether they are swapping the accepted amount or not. I suggest you add them on the page

[hugeblack]

Apparently, their definition of NoKYC is

No KYC

Swap without creating an account or handing over personal information

How can a service that claims to be private, and that disabling JavaScript or clearing cookies might cause some errors? Also, EagleSwap have a clear policy on retaining data and records.

We retain information only for as long as reasonably necessary to provide the service, resolve disputes, prevent abuse, maintain records, and meet legal obligations.

Providers apply their own retention policies. Public blockchain records may remain available indefinitely.

In short, there is no need to promote the service as NoKYC or Swap privately. Just focus on the low fees and high liquidity, and you might find some interest.

[EagleSwap]

Yes they are, there is 0 risk for KYC on our platform. However we do AML checks, which means that we don't process high risk deposits and they will be refunded to user.

But your Terms of Use says something else. It says that that the funds will be refunded where "technically and legally possible."
What if that's not technically and legally possible, and the execution provider blocks the funds?

Thanks for pointing that out. The wording is a bit unclear. We’ll edit it to clearly state that, in the worst-case scenario, the user will receive their funds back

[EagleSwap]

Right now there are no limits (minimum and maximum amounts of coins that can be swapped) on the swap page, making the user clueless on whether they are swapping the accepted amount or not. I suggest you add them on the page

Some pairs do have a visible min max and some don't. You won't be able to create a swap if the amount is not supported. Anyway thanks for the suggestion, we will add a clear min max to all pairs.

[EagleSwap]

Apparently, their definition of NoKYC is

No KYC

Swap without creating an account or handing over personal information

How can a service that claims to be private, and that disabling JavaScript or clearing cookies might cause some errors? Also, EagleSwap have a clear policy on retaining data and records.

We retain information only for as long as reasonably necessary to provide the service, resolve disputes, prevent abuse, maintain records, and meet legal obligations.

Providers apply their own retention policies. Public blockchain records may remain available indefinitely.

In short, there is no need to promote the service as NoKYC or Swap privately. Just focus on the low fees and high liquidity, and you might find some interest.

Thanks for the feedback

No KYC simply means we don’t have a Know Your Customer process, which is true. Our website is not advertised as no JavaScript. We do also have a telegram bot if someone prefers that over our website.

[hosemary]

Thanks for pointing that out. The wording is a bit unclear. We’ll edit it to clearly state that, in the worst-case scenario, the user will receive their funds back

Does this mean you will refund the funds out of your own pocket, if the execution provider blocks the funds for any reason?
Or do you guarantee that the execution provider will never block the funds and they themselves will refund the funds, if needed?

[EagleSwap]

Does this mean you will refund the funds out of your own pocket, if the execution provider blocks the funds for any reason?
Or do you guarantee that the execution provider will never block the funds and they themselves will refund the funds, if needed?

Funds are refunded incase they are flagged as high risk.

[Cinexa]

I browsed eagleswap.to, checking the public pages and JS, not just the attractive graphic on the landing page.

1. Most any HTML I sampled had No CSP, No HSTS, No X-Frame-Options/frame-ancestors, No X-Content-Type-Options. Sloppy, for a site whose job is "paste withdrawal address and send coin". No frame protection allows the widget to be embedded into another site (standard overlay attack against address entry fields) . No HSTS allows Man-in-the-Middle interception of the first HTTP hit.

2. Even /admin/* is declared in robots.txt.

A dedicated dashboard with the following login, not admin user and password. One login - a single password: "dedicated dashboard password" that is available directly as JSON in the API.

You may partner with a numeric code (16 digits long).

One guess, or theft and there is full access. Am not writing out detailed instructions on stealing the codes; rather indicating the poor design for something that has visibility into swaps.

3. Recent swaps displayed might be fabricated. While there is a valid public feed, when it’s not enabled the front end displays simulated rows “2m ago BTCETH” on occasion. Use tickers on the screen only as an example rather than hard proof of volume.

4. Authenticated swap APIs for use when no account login is established. The public POST is used for submitting swaps. The GET method quotes swaps through another public endpoint - No account session and no CSRF token visible during testing, this is acceptable in a system with an opt-in account, as well as increasing potential for malicious behavior. Network validation when an entry is put into the withdrawal addresses is performed via Javascript using regular expressions and, as per the terms of service, does not confirm you are sending coins to the intended network.

[EagleSwap]

I browsed eagleswap.to, checking the public pages and JS, not just the attractive graphic on the landing page.

1. Most any HTML I sampled had No CSP, No HSTS, No X-Frame-Options/frame-ancestors, No X-Content-Type-Options. Sloppy, for a site whose job is "paste withdrawal address and send coin". No frame protection allows the widget to be embedded into another site (standard overlay attack against address entry fields) . No HSTS allows Man-in-the-Middle interception of the first HTTP hit.

2. Even /admin/* is declared in robots.txt.

A dedicated dashboard with the following login, not admin user and password. One login - a single password: "dedicated dashboard password" that is available directly as JSON in the API.

You may partner with a numeric code (16 digits long).

One guess, or theft and there is full access. Am not writing out detailed instructions on stealing the codes; rather indicating the poor design for something that has visibility into swaps.

3. Recent swaps displayed might be fabricated. While there is a valid public feed, when it’s not enabled the front end displays simulated rows “2m ago BTCETH” on occasion. Use tickers on the screen only as an example rather than hard proof of volume.

4. Authenticated swap APIs for use when no account login is established. The public POST is used for submitting swaps. The GET method quotes swaps through another public endpoint - No account session and no CSRF token visible during testing, this is acceptable in a system with an opt-in account, as well as increasing potential for malicious behavior. Network validation when an entry is put into the withdrawal addresses is performed via Javascript using regular expressions and, as per the terms of service, does not confirm you are sending coins to the intended network.

Thanks for reporting these. We will work on these next.

[Cinexa]

Thanks for reporting these. We will work on these next.

You're welcome.
I must say that your UI looks good.
However, the color palette match with another popular exchange.
Since the UI is totally different, I am not going to mention their name.

[EagleSwap]

You're welcome.
I must say that your UI looks good.
However, the color palette match with another popular exchange.
Since the UI is totally different, I am not going to mention their name.

Appreciate it. We had a more dark ish purple theme before but thought that a lighter theme would be more appealing so we switched without really checking other sites.