> For the complete documentation index, see [llms.txt](https://docs.chestfi.cash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.chestfi.cash/protocol/security.md).

# Security

ChestFi prioritizes security first: on-chain verification, automatic contract verification, and transparent proof systems. Every operation is verifiable on the Robinhood Chain explorer.

### Architecture

**ChestFi is non-custodial.** The Web App is an interface to smart contracts. It never holds your private keys, never takes custody of your assets, and cannot move funds on your behalf. Every state-changing action requires a signature from your wallet.

When you lock tokens, they move into a locker contract governed by a timestamp — not into a ChestFi wallet. When the timestamp passes, you withdraw. No ChestFi employee can accelerate, delay, or prevent that.

### Verification

| Guarantee                              | How to check                                                                                                                   |
| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| Deployed token source is verified      | Open your token on [robinhoodchain.blockscout.com](https://robinhoodchain.blockscout.com) → **Contract** tab → green checkmark |
| A lock exists and holds what it claims | Open the proof link from **My Locks**, or read the locker contract directly on the explorer                                    |
| A burn happened                        | Look up the dead address `0x...dEaD` balance for your token                                                                    |
| The token has no hidden mint function  | Read the verified source on the explorer                                                                                       |

**Never take a screenshot as proof.** Screenshots are trivially faked. Transaction hashes and explorer links are not.

### Known limitations

An honest security page states what a tool cannot do.

* **ChestFi does not audit the tokens you interact with.** You can lock or burn any ERC-20, including malicious ones. A lock proves tokens are escrowed; it says nothing about whether the token contract itself is safe.
* **Fee-on-transfer, tax, and rebasing tokens are incompatible with the locker.** Locking one can permanently strand the tokens. See Token Locker.
* **Locks are irreversible.** There is no admin override, no emergency unlock, and no recovery process for a wrong unlock date.
* **Burns are irreversible.** There is no recovery from the dead address, ever.
* **A wrong address is a lost transaction.** Blockchains do not validate that a recipient exists or is intended.

### Protecting yourself

**Domains.** The only official domains are:

```
chestfi.cash
app.chestfi.cash
docs.chestfi.cash
```

Bookmark them. Type them, don't click them from search ads or DMs. Verify the URL bar before every signature.

**Phishing.** ChestFi will never ask for your seed phrase or private key, never DM you first, and never ask you to "validate," "sync," "migrate," or "restore" your wallet.

**Approvals.** Locking and burning require ERC-20 approvals. Approve only the amount you intend to use — avoid unlimited approvals where your wallet gives you the choice. Periodically revoke stale approvals using a token-approval manager.

**Test first.** Before deploying anything of value, run the entire flow on Robinhood Chain testnet (Chain ID `46630`). Testnet ETH is free from the faucet. A mistake there costs nothing; the same mistake on mainnet is permanent.

**Use a fresh wallet for deployments.** If a project wallet is ever compromised, the blast radius should not include your personal holdings.

### Reporting a vulnerability

Found a bug in ChestFi's contracts or interface? Report it privately via [@ChestFiCash](https://x.com/ChestFiCash) rather than disclosing publicly, and give the team a reasonable window to respond before publishing.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.chestfi.cash/protocol/security.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.