Security
Akashi's non-custodial model, release controls, and how to report a security issue.
Non-custodial by design
Your funds never pass through Akashi, and Akashi cannot move them. Deposits go from your wallet directly to the venue you chose. Akashi holds no balances and no key that can spend from your wallet.
The backend only ever assembles unsigned transaction instructions. Your wallet reviews, signs and submits them. The backend has no code path through which it can sign anything. Connecting a wallet is a read-only action.
The one Akashi-run service that does sign is the Invest vault executor: a separate process with its own key, whose authority the vault program bounds on-chain (see Invest vaults below). It never touches Discover deposits.
If Akashi were unavailable tomorrow, your positions would be unaffected and withdrawable directly from the venues holding them.
Controls on every change
- Security review before release, with particular attention to the boundary above.
- Automated secret scanning of every pull request's commits, run before a maintainer merges.
- Automated test suite for every area a pull request touches, run before a maintainer merges.
- Transaction rehearsals: an end-to-end suite builds and simulates real transactions against live protocols.
Protocol risk and interface risk are separate
A risk grade is a statement about the protocol holding your deposit. It says nothing about the interface you read it on, and the two should be assessed separately.
Invest vaults
The vault program never accepts a price or NAV from a signer. The executor can only move USDC between a vault's idle balance and its approved legs, within the caps and bands the program enforces; it cannot withdraw funds from the vault or change who may. The program is a devnet preview.
Reporting a security issue
Email security@akashi.finance (also published in security.txt). Include enough detail to reproduce the issue, and allow time for a fix before disclosing publicly.
For anything else, write to support@akashi.finance or use the feedback form.