Skip to main content
Hero Light

​
How Custody Works

You Do — Kash Is Self-CustodialHere’s the actual model:
  • When you sign up, a Privy-powered embedded wallet (a standard EOA) is created for you
  • That wallet is the signer for an ERC-4337 smart account — the smart account is what holds your funds
  • Only your wallet can authorize transactions from your smart account
  • Kash cannot withdraw your funds. The platform prepares transactions; they execute only under permissions you authorize
Proof of control: you can export your wallet key from Settings at any time and use the wallet entirely outside of Kash.
No Seed Phrase to Manage
  • Your embedded wallet is secured by Privy’s infrastructure and unlocked by your login — there’s no 12-word phrase to write down or lose
  • Recovery: regain access through your login method (X, Google, email, or wallet) plus your recovery email if you’ve set one in Settings
  • Independent backup: exporting your key from Settings gives you access to your wallet no matter what happens to your Kash login
Set up now: add a recovery email in Settings and enable 2FA on the account you log in with.
Security Model
  • Self-custodial wallets: you control your funds; Kash can’t withdraw them — trades execute only under permissions you authorize
  • ERC-4337 smart accounts: your funds live in an audited account-abstraction smart account on Base
  • Privy wallet infrastructure: enterprise-grade embedded wallet security
  • Base network: built on an established Ethereum Layer 2
  • Gasless transactions: gas is sponsored via a paymaster, so you never handle ETH for gas
  • Multisig-secured contracts: privileged protocol actions require multi-party approval
Audits: security audits of Kash smart contracts are conducted. For audit or security questions, contact security@kash.bot.

​
Account Security Best Practices

Security ChecklistLogin security (most important):
  • Enable 2FA on the X or Google account you sign in with
  • Use a strong, unique password on your login provider
  • Add a recovery email in Kash Settings
Platform hygiene:
  • Always verify the app.kash.bot domain before signing in
  • Only trust the verified @kash_bot account on X — and only trust a trading account that @kash_bot itself links to
  • Review your transaction history and notifications regularly
Key export safety:
  • If you export your wallet key, store it offline and securely
  • Never share your exported key with anyone — including anyone claiming to be Kash support
Immediate Response
  1. Secure your login provider: change the password and enable 2FA on the X/Google/email account you use to sign in
  2. Contact support: email support@kash.bot with your account details, timestamps, and screenshots
  3. Review activity: check your transaction history and wallet on basescan.org
  4. Document evidence: capture screenshots of any suspicious activity
For suspected platform vulnerabilities (rather than account compromise), email security@kash.bot.
Device Loss Recovery
  1. From another device, change the password on your login provider (X/Google/email) and enable 2FA
  2. Sign in to app.kash.bot from the new device — your wallet, balances, and history are restored automatically after authentication
  3. Monitor your account for unauthorized activity and contact support@kash.bot if anything looks wrong
Your funds live on-chain in your smart account — losing a device doesn’t put them at risk as long as your login remains secure.

​
Common Security Concerns

No.
  • What Kash can do: prepare transactions for your approval, sponsor gas, resolve markets, and execute payouts to your own smart account
  • What Kash cannot do: move your funds without your authorization, see or use your exported key, or freeze your wallet
If the platform disappeared tomorrow, you could export your key from Settings and access your smart account directly on-chain.
Recognizing and Avoiding ScamsRed flags:
  • Anyone asking for your password, exported key, or a “wallet validation”
  • Lookalike accounts imitating @kash_bot or Kash’s trading account, or DMs from either — the real accounts never DM you first; only trust a trading account linked from the verified @kash_bot profile
  • Lookalike domains — the only official domains are kash.bot (marketing site) and app.kash.bot (the app)
  • Token scams: Kash has not launched a token; anyone selling “$KASH” is a scammer
  • Urgent demands for immediate action
If you encounter phishing:
  • Don’t click links or provide information
  • Report the account to X and email support@kash.bot
  • Warn the community in Discord
Eligibility and Geo-Blocking
  • 18+ only: you must be at least 18 years old (or the legal age in your jurisdiction)
  • Geo-blocking: access from OFAC-sanctioned regions is blocked
  • Compliance restrictions are enforced at the platform level and updated as regulations change
See the Legal FAQ for details.

​
Reporting Security Issues

Responsible Disclosure
  • Email security@kash.bot with a detailed description, reproduction steps, and impact assessment
  • Please allow time for the team to review before any public disclosure
  • Smart contract vulnerabilities are in scope for the protocol bug bounty — see the Bug Bounty page
Do not test vulnerabilities against other users’ funds or post exploits publicly.
Security is a shared responsibility. Kash provides self-custodial infrastructure, but you must protect your login account and never share credentials or exported keys with anyone.
Three things cover most of your risk: 2FA on your login provider, a recovery email in Settings, and never sharing your exported key.

Account Security

Learn about account protection

Bug Bounty

Report security issues