> ## Documentation Index > Fetch the complete documentation index at: https://supersmooth.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Supersmooth Security Overview: Self-Custody, Access, and Audits > Supersmooth is self-custodial by construction. See what can fail, who can do what, how the system works, and how to verify each claim yourself. Supersmooth is self-custodial by construction. This page covers what can fail, who can do what, how the system works, and how to verify each claim yourself. ## Summary * **Your keys, your Safe.** Every position lives in a Safe you own. Supersmooth has no signing authority over your Safe. * **No admin over your funds.** No Supersmooth role can move your assets without your permission, freeze or pause your assets, and you can always exit from the Safe app. * **Changes are visible before they are set in stone.** Connectors, fees, signers, and aggregators change only through public timelocks. * **Audits.** Core contracts reviewed by Fixed Point Solutions. [Download the report](https://drive.google.com/uc?export=download\&id=1oNWXyCd8eCAIpWo9mLZ9JEoCFTGq8Z3W). ## 1. Failure scenarios What happens to your positions if something breaks, and what each party can do about it. | Scenario | Effect on your positions | What you can do | What Supersmooth does | | - | - | - | - | | Front-end goes down | None. Positions live in your Safe, at the protocol. | Operate directly at Aave, Morpho, Spark, or the Safe app. | Status page updates. | | Bots go down | Automations pause. Positions unchanged. The protocol still liquidates as normal. | Manage by hand, run the recipe yourself, or close. | Alert you via social channels and on UI, restore, publish a report. | | Supersmooth ceases to exist | None. Your Safe and positions do not change. | Everything, without us (excluding automation, one-tx actions, refinance, etc.). | N/A | | Integrated protocol is exploited | Your exposure is that protocol's exposure. No pooled risk; one Safe per position. | Exit that position directly. | Chosen guardians can pause the affected connector. | | You lose or leak a key | Same as any Safe: the owner keys are the Safe. | Hardware signer, your own owner setup. | Nothing. We cannot recover or move it, by design. | | Bot key is compromised | Bounded to the subscription: fixed recipe, onchain trigger, postchecks. Value leaves only through recipe steps you wrote. | Remove the bot from the allowlist or cancel the subscription. | Rotate keys, revoke everywhere, publish. | | Fee signer is compromised | None. It signs discount permits that expire in minutes. | Nothing needed. | Emergency revocation is immediate and voids its permits. | | Admin key is compromised | None. Admin cannot touch any Safe. It can change connectors, fees, signer, and aggregators, after a timelock. | Exit before a change lands if you disagree. | | | Swap executes badly | Bounded by the slippage postcheck; the whole transaction reverts below your minimum. | Tighten the minimum. | | ## 2. Access and permissions Every party in the system, what it can do, and how you verify it. | Party | Can | Cannot | Verify | | - | - | - | - | | You (Safe owners) | Everything: owners, module, bots, any transfer. | | Safe app: owners and modules. | | Supersmooth module | Execute recipes from your Safe through registered connectors. | Run unregistered code. Run a subscription without an allowlisted bot, passing trigger, and passing postchecks. | Module address on your Safe. | | Bots (allowlisted per subscription) | Run a subscription's fixed recipe when its trigger passes. Supply runtime inputs within postcheck bounds. Recover gas from your Safe at a Chainlink-priced rate. | Change rules. Add themselves. Bypass a postcheck. Move value except through recipe steps. | AutomationStore and AutomationLens; recipe steps published by SubscriptionRouter. | | Admin (team multisig) | Register connectors, set fee profiles, rotate the signer, change aggregators, all timelocked. Emergency-revoke a signer. Appoint guardians and bots. | Touch any Safe, position, subscription, or allowlist. Block your exit. | Owner functions in the registry, FeeManager, and GuardianRegistry. | | Guardians | Pause components. Execute emergency subscriptions. | Move funds. Block the Safe app. | GuardianRegistry. | | Fee signer (backend key) | Sign discount permits bound to one Safe and chain; redeemable 10 min, valid 30 min (swaps) or 12 min (spreads). | Move funds. Change fees. | FeeManager permit format. | | Underlying protocols | Liquidate at their LLTV, change parameters, pause per their rules. | Anything Supersmooth-specific. | Their docs and governance. | ## 3. Architecture and risk A position is a Safe you own, with one module enabled, running recipes through connectors into the protocols you already use. | Component | Function | Risk | Control | | - | - | - | - | | Safe | Holds all assets and positions. One per position; nothing pooled. | Owner key loss or theft. | Hardware signers. Your owner setup. | | Module | Executes recipes from your Safe. Connectors run by delegatecall, inside the Safe. | Module bug. Wrongly registered connector. | Audited. Timelocked registry. Reentrancy locks. | | Connectors | One per integration: Aave v3 (and Spark), Morpho Blue, Morpho Vaults v2, Compound v3, Euler v2, Fluid, ERC-4626, Lido, Ethena, Maple, Merkl, Across, CoW, aggregator swaps, flash loans (Balancer, Aave v3, Morpho Blue, ERC-3156). | A connector bug affects every action through it, inside your Safe. | Timelocked registry: changes are visible before they can run. Review before proposal. | | Recipes and flash loans | Steps run in one transaction. Loops, refinances, and unwinds borrow, act, and repay in the same block. | Step fails, bad route, or flash loan fee. | Atomic: any failure reverts everything. Postchecks on health, balances, allowances, slippage. Zero-fee provider selected where available. | | Triggers and bots | Triggers are onchain: health factor, price, trailing stop, balance, vault risk, spread accrued. An allowlisted bot calls the Executor when one passes. | Late (congestion, outage). Wrong (bad feed). Malicious (compromised bot). | Late: protocol liquidation still applies; set stops with margin. Wrong: health triggers read the protocol; price triggers. Malicious: allowlist, fixed recipe, postchecks. | | Fees | Swap fee by route: 30 bps standard, 15 refinance and conversion, 10 loop close, 0 free routes. Borrow spread as a share of interest accrued. | Wrong fee. Compromised signer. Future-dated permit. | Profiles immutable per route, timelocked per connector. Immediate signer revocation, permits expire in minutes. | | Underlying protocols | Aave, Morpho, Spark, and the rest hold the markets. | Their contract, oracle, liquidation, governance, and asset risk. | Same on any front-end. Their audits, bounties, and governance. We add none and remove none. | ## 4. Automation **What a rule is:** A subscription stored onchain: a fixed recipe, an onchain trigger, and the bots allowed to run it. **How it runs:** A bot checks the trigger. When it passes, the bot calls the Executor, which runs the recipe from your Safe and then the postchecks. If any check fails, nothing happened. **What you can inspect:** Every execution is a normal transaction, every recipe is published, so you can read what a subscription does before subscribing. **Limits:** It cannot fire faster than the chain confirms. It reads a feed that can be wrong. It reduces liquidation risk at the protocol; it does not remove it. ## 5. Verification * **Keys:** Each position is a Safe deployed for you and owned by you. No Supersmooth signing authority. You can check your Safe's owners. * **Exit:** No permission required. * **Code:** Reviewed by Fixed Point Solutions, 0 critical bugs found. [Download the report](https://drive.google.com/uc?export=download\&id=1oNWXyCd8eCAIpWo9mLZ9JEoCFTGq8Z3W). * **Automations:** Exactly the subscription's recipe, when its trigger passes, by an allowlisted bot, only if every postcheck holds. Cannot change the recipe, add a bot, or move value except through recipe steps you wrote. ## 6. Withdrawal without Supersmooth If Supersmooth disappeared tomorrow, or you simply left, you can manage your position on the underlying protocol frontend. Supersmooth does not have any user lock-in. ## 7. Audits and reviews Fixed Point Solutions, LLC (Kurt Barry). Main assessment: 0 critical, 0 high, 0 medium, 0 low, 3 gas, 2 informational, all resolved or acknowledged. [Download the audit report](https://drive.google.com/uc?export=download\&id=1oNWXyCd8eCAIpWo9mLZ9JEoCFTGq8Z3W). ## 8. Incident response Direct line to the founders for anything touching your positions: [support@supersmooth.fi](mailto:support@supersmooth.fi). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.