Security and custody
Who can move your assets, and what has and has not been verified.
Custody
SquirtFi holds no user funds and has no contract in the execution path. Your tokens move from your wallet to Uniswap protocol contracts, and your position NFT is minted to your address.
SquirtFi cannot sign, cannot initiate a transfer, and cannot move a position. What it can do is construct calldata and ask your wallet to sign it, which is why the preview shows the spender, the amounts, the recipient and the deadline before every step.
What can move your assets
| Contract | When it can move tokens |
|---|---|
| Uniswap non-fungible position manager | Up to the allowance you granted, when you mint or increase a position. |
| SwapRouter02 | Up to the allowance you granted, inside a Protected Zap transaction you signed. |
| Anything else | Nothing. No SquirtFi contract exists in this path. |
What has been verified
- Contract addresses are taken from primary sources and recorded with their provenance. Nothing is inlined at a call site.
- SwapRouter02’s deployed runtime was rebuilt from its verified 63-file compiler input with the exact reported compiler settings and matched
eth_getCodebyte for byte. Its runtime hash is re-checked on every preview. - Price-feed addresses were confirmed on chain by reading the feed’s own
description(), rather than being matched by ticker.