> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kash.bot/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Common questions about platform and account security

<img style={{ borderRadius: '0.5rem' }} className="block dark:hidden" src="https://mintcdn.com/kash/ccJqSmLmwHitLEdQ/assets/cover/cover.svg?fit=max&auto=format&n=ccJqSmLmwHitLEdQ&q=85&s=bd474b91f522088935255f33b33ddd96" alt="Hero Light" width="1500" height="500" data-path="assets/cover/cover.svg" />

<img style={{ borderRadius: '0.5rem' }} className="hidden dark:block" src="https://mintcdn.com/kash/ccJqSmLmwHitLEdQ/assets/cover/cover.svg?fit=max&auto=format&n=ccJqSmLmwHitLEdQ&q=85&s=bd474b91f522088935255f33b33ddd96" alt="Hero Dark" width="1500" height="500" data-path="assets/cover/cover.svg" />

# How Custody Works

<AccordionGroup>
  <Accordion title="Who controls my funds?">
    **You Do — Kash Is Self-Custodial**

    Here's the actual model:

    * When you sign up, a **Privy-powered embedded wallet** (a standard EOA) is created for you
    * That wallet is the signer for an **ERC-4337 smart account** — the smart account is what holds your funds
    * Only your wallet can authorize transactions from your smart account
    * **Kash cannot withdraw your funds.** The platform prepares transactions; they execute only under permissions you authorize

    **Proof of control:** you can **export your wallet key from Settings** at any time and use the wallet entirely outside of Kash.
  </Accordion>

  <Accordion title="Is there a seed phrase? How does recovery work?">
    **No Seed Phrase to Manage**

    * Your embedded wallet is secured by Privy's infrastructure and unlocked by your login — there's no 12-word phrase to write down or lose
    * **Recovery:** regain access through your login method (X, Google, email, or wallet) plus your **recovery email** if you've set one in Settings
    * **Independent backup:** exporting your key from Settings gives you access to your wallet no matter what happens to your Kash login

    **Set up now:** add a recovery email in Settings and enable 2FA on the account you log in with.
  </Accordion>

  <Accordion title="How secure is the Kash platform?">
    **Security Model**

    * **Self-custodial wallets:** you control your funds; Kash can't withdraw them — trades execute only under permissions you authorize
    * **ERC-4337 smart accounts:** your funds live in an audited account-abstraction smart account on Base
    * **Privy wallet infrastructure:** enterprise-grade embedded wallet security
    * **Base network:** built on an established Ethereum Layer 2
    * **Gasless transactions:** gas is sponsored via a paymaster, so you never handle ETH for gas
    * **Multisig-secured contracts:** privileged protocol actions require multi-party approval

    **Audits:** security audits of Kash smart contracts are conducted. For audit or security questions, contact **[security@kash.bot](mailto:security@kash.bot)**.
  </Accordion>
</AccordionGroup>

# Account Security Best Practices

<AccordionGroup>
  <Accordion title="How do I secure my Kash account?">
    **Security Checklist**

    **Login security (most important):**

    * Enable 2FA on the X or Google account you sign in with
    * Use a strong, unique password on your login provider
    * Add a **recovery email** in Kash Settings

    **Platform hygiene:**

    * Always verify the **app.kash.bot** domain before signing in
    * Only trust the verified **@kash\_bot** account on X — and only trust a trading account that @kash\_bot itself links to
    * Review your transaction history and notifications regularly

    **Key export safety:**

    * If you export your wallet key, store it offline and securely
    * Never share your exported key with anyone — including anyone claiming to be Kash support
  </Accordion>

  <Accordion title="What should I do if I suspect unauthorized access?">
    **Immediate Response**

    1. **Secure your login provider:** change the password and enable 2FA on the X/Google/email account you use to sign in
    2. **Contact support:** email **[support@kash.bot](mailto:support@kash.bot)** with your account details, timestamps, and screenshots
    3. **Review activity:** check your transaction history and wallet on [basescan.org](https://basescan.org)
    4. **Document evidence:** capture screenshots of any suspicious activity

    For suspected platform vulnerabilities (rather than account compromise), email **[security@kash.bot](mailto:security@kash.bot)**.
  </Accordion>

  <Accordion title="What happens if I lose my device?">
    **Device Loss Recovery**

    1. From another device, change the password on your login provider (X/Google/email) and enable 2FA
    2. Sign in to [app.kash.bot](https://app.kash.bot) from the new device — your wallet, balances, and history are restored automatically after authentication
    3. Monitor your account for unauthorized activity and contact [support@kash.bot](mailto:support@kash.bot) if anything looks wrong

    Your funds live on-chain in your smart account — losing a device doesn't put them at risk as long as your login remains secure.
  </Accordion>
</AccordionGroup>

# Common Security Concerns

<AccordionGroup>
  <Accordion title="Can Kash access my funds?">
    **No.**

    * **What Kash can do:** prepare transactions for your approval, sponsor gas, resolve markets, and execute payouts to your own smart account
    * **What Kash cannot do:** move your funds without your authorization, see or use your exported key, or freeze your wallet

    If the platform disappeared tomorrow, you could export your key from Settings and access your smart account directly on-chain.
  </Accordion>

  <Accordion title="How do I identify phishing attempts?">
    **Recognizing and Avoiding Scams**

    **Red flags:**

    * Anyone asking for your password, exported key, or a "wallet validation"
    * Lookalike accounts imitating @kash\_bot or Kash's trading account, or DMs from either — the real accounts never DM you first; only trust a trading account linked from the verified @kash\_bot profile
    * Lookalike domains — the only official domains are **kash.bot** (marketing site) and **app.kash.bot** (the app)
    * **Token scams:** Kash has **not launched a token**; anyone selling "\$KASH" is a scammer
    * Urgent demands for immediate action

    **If you encounter phishing:**

    * Don't click links or provide information
    * Report the account to X and email [support@kash.bot](mailto:support@kash.bot)
    * Warn the community in [Discord](https://discord.com/invite/n9eumqjMPb)
  </Accordion>

  <Accordion title="Who can use Kash?">
    **Eligibility and Geo-Blocking**

    * **18+ only:** you must be at least 18 years old (or the legal age in your jurisdiction)
    * **Geo-blocking:** access from OFAC-sanctioned regions is blocked
    * Compliance restrictions are enforced at the platform level and updated as regulations change

    See the [Legal FAQ](/getting-started/faqs/legal) for details.
  </Accordion>
</AccordionGroup>

# Reporting Security Issues

<AccordionGroup>
  <Accordion title="How do I report a vulnerability?">
    **Responsible Disclosure**

    * Email **[security@kash.bot](mailto:security@kash.bot)** with a detailed description, reproduction steps, and impact assessment
    * Please allow time for the team to review before any public disclosure
    * Smart contract vulnerabilities are in scope for the protocol bug bounty — see the [Bug Bounty page](/getting-started/ecosystem/bug-bounty-program)

    **Do not** test vulnerabilities against other users' funds or post exploits publicly.
  </Accordion>
</AccordionGroup>

<Warning>
  Security is a shared responsibility. Kash provides self-custodial infrastructure, but you must protect your login account and never share credentials or exported keys with anyone.
</Warning>

<Tip>
  Three things cover most of your risk: 2FA on your login provider, a recovery email in Settings, and never sharing your exported key.
</Tip>

<CardGroup cols={2}>
  <Card title="Account Security" icon="user" href="/getting-started/faqs/account">
    Learn about account protection
  </Card>

  <Card title="Bug Bounty" icon="bug" href="/getting-started/ecosystem/bug-bounty-program">
    Report security issues
  </Card>
</CardGroup>