# Security and Trust
> Ozmium's custody model, honest audit status, the full contract disclosure, privacy and crash-report handling, and how to report a vulnerability privately.
Source: https://docs.ozmium.org/company/security/
Keywords: ozmium security, defi interface audit status, contract disclosure base, non-custodial verification, report vulnerability defi
Updated: 2026-07-27
---

This page is written to be checkable. Where a claim can be verified onchain, the verification method
is given instead of an assurance.

## The Custody Model

Ozmium is self-custodial. It never holds, controls, or has access to your funds or keys. Every
deposit, swap, loan, and leveraged position is initiated and signed in your own wallet, which shows
the final confirmation before anything happens.

The falsifiable test:

> If Ozmium ceased to exist right now, every position you hold remains yours and remains manageable
> directly at the underlying protocol.

Ozmium passes because it operates no contract that holds user funds. It reads public state and
produces calldata. Your wallet is the only signer. The chain is the only enforcer.

## What You Can Verify Before Signing

Ozmium builds transactions against a fixed set of third-party contracts, and every one of them is on
a published list. In the app, a **seal** marks each protocol that publishes independent third-party
audits of the contract being called.

That seal is a claim about the destination, not about this interface. The distinction is kept
deliberately, because they are different things and only one of them has been audited by an outside
firm.

The protocols Ozmium routes to - **[Gains Network](https://gains.trade), Morpho, Aave, Uniswap, and [Aerodrome](https://aerodrome.finance)** - each
publish their own audit reports. The Ozmium interface layer has not had a formal third-party audit;
independent review of it is ongoing work. Non-custody limits what that exposure can reach, since the
interface holds nothing and signs nothing, but it is a structural mitigation rather than a substitute
for review.

Every transaction is inspectable in your wallet and on [Basescan](https://basescan.org) before you approve it, which is the
protection that does not depend on trusting anyone's description of anything.

## The Contract Disclosure

Every contract the interface can build a transaction against, on one list, so a user or an auditor
can verify the destinations without reading the source.

A seal in the app marks a protocol that publishes independent third-party audits **of that
contract**. It is never a claim about the Ozmium interface, which is unaudited and says so.

| Contract | Protocol | What Ozmium Asks It to Do | Third-party Audited |
|---|---|---|---|
| Aave V3 Pool | Aave | Supplies, withdraws, borrows, and repays against Aave reserves | Yes |
| [Morpho Blue](https://docs.morpho.org) | Morpho | Lends and borrows on isolated Morpho markets | Yes |
| Gains Network Diamond | Gains Network ([gTrade](https://gains.trade)) | Opens, modifies, and closes leveraged positions | Yes |
| [Permit2](https://docs.uniswap.org/contracts/permit2/overview) | Uniswap | Holds the token allowance a swap spends, under a signature you sign per swap with its own amount and deadline | Yes |
| Aerodrome Router | Aerodrome | Adds and removes liquidity on Aerodrome pools | Yes |
| Uniswap V3 Position Manager | Uniswap | Mints and manages concentrated liquidity positions | Yes |
| USDC | Circle | The settlement token for lending, perps, and most swaps | Yes |
| OZ Token | [Clanker](https://clanker.world) | The project's own ERC-20 on Base, deployed by Clanker v3.1 as a standard token and source-verified onchain | **No** |

**Live addresses for every row are published on the app's own Terms sheet** at
[ozmium.org](https://ozmium.org), where the list is derived directly from the modules that call each
address rather than hand-copied. A hand-copied list is a claim about the code, and claims drift. The
app's list cannot disagree with what the app actually calls.

Verify any address against the protocol's own documentation before you sign.

### On the OZ Token Row

The OZ token is marked **not audited**, deliberately. The Clanker v3.1 contracts are public with
published documentation, but no third-party audit report is published for them.

OZ is **source-verified onchain** - anyone can read the deployed bytecode against the published
source. That is a real and checkable property, and it is a weaker claim than audited. The two are not
shown as the same thing.

### Runtime-Resolved Addresses

Two destinations are chosen at runtime rather than pinned at build time. They are called out rather
than hidden, because "we only ever call contracts we chose" is the interesting claim and these are
its only exceptions:

- **Morpho vaults.** Individual vaults are ERC-4626 contracts published by Morpho and read at
  runtime. Each is shown with its address before you deposit.
- **Swap settlement.** The swap route quotes a settlement contract from the Coinbase Developer
  Platform. The interface refuses to approve any spender other than the pinned Permit2 address.

## Token Address

There is only **one** token for Ozmium. The Base ERC-20 address is:

`0x148313dcdb7a7111ebefa4871f6a7fef34833b07`

If this ever changes, the change will be indicated officially on the app's Terms sheet and here. Any
other address claiming to be OZ is not OZ.

## Operational Wallets

Ozmium holds no user funds, so none of this touches you. For its own accounts, the project separates
wallets by role, keeps value at rest behind a Safe with transaction protections, and does not publish
operational addresses.

That last choice has a cost worth naming: circulating supply and treasury holdings cannot be
independently verified from this page. Total supply and burned supply both can - see
[OZ Token](/token/oz/).

## Data and Privacy

- Ozmium does **not** collect, store, sell, or share personal information.
- No advertising, no behavioral tracking of any kind.
- No account to create and no profile behind one.
- If you sign in with a passkey, the key pair lives on your own device under your control. Ozmium
  never sees it, and deleting it from your device removes it from Ozmium as well.

**Crash reports.** When something breaks, the app sends a diagnostic report so it can be fixed: the
error, the page, the app build, and basic browser details such as viewport and connection type. It
records which **kind** of wallet is connected - whether the browser has an injected provider at all -
and never your wallet address, your balance, or any identifier tied to you. Reports are grouped by
error, not by person, and no profile is built from them.

**Third-party hosts.** Opened inside a host app such as the [Base App](https://base.app/invite/ozbeta/D1H4FT25) or [Farcaster](https://farcaster.xyz/~/code/1914H5), that platform may
record its own basic, aggregated, deidentified usage counts under its own policy. Those platforms and
the protocols listed above are independent of Ozmium.

## Engineering Rules that Are Security Rules

These are enforced in the codebase rather than aspired to:

- **Secrets never in code.** Environment files and platform secret storage only. Never in committed
  files, never in configuration variables intended for public values.
- **Never fabricate.** No fabricated zeros, no invented balances on an RPC failure. Last-good is
  retained and marked. A confident `$0.00` over a broken read is the most dangerous state a finance
  UI can render.
- **Base mainnet only.** One chain, one address set, no bridge introduced by us.
- **Pinned spenders.** The interface refuses to approve any spender other than the addresses it
  chose.

## Reporting a Vulnerability

If you have found a security issue, report it privately first. Do not open a public issue and do not
post it in Discord.

- Email: **hello@ozmium.org** with `SECURITY` in the subject line.
- A `security.txt` is published at
  [ozmium.org/.well-known/security.txt](https://ozmium.org/.well-known/security.txt).

Include what you found, how to reproduce it, and the impact you believe it has. You will get an
acknowledgment. 

Please do not test against other users' funds, do not perform denial-of-service testing, and do not
access data that is not yours. Everything else is fair game.

## FAQ

### Is Ozmium audited?

The underlying protocols Ozmium routes to - Gains Network, Morpho, Aave, Uniswap, and Aerodrome -
publish independent third-party audits of their contracts. The Ozmium interface itself has not
undergone a formal third-party audit. Non-custody is a structural mitigation, not an audit, and the
two are not presented as the same thing.

### Can Ozmium access or move my funds?

No. Ozmium operates no contract that holds user funds, never signs on your behalf, and cannot move
anything you own. Every transaction is signed in your own wallet, which shows the final confirmation.

### What data does Ozmium collect?

None that identifies you. There is no account, no advertising, and no behavioral tracking. Crash
reports carry the error, the page, the app build, and basic browser details, plus which kind of
wallet is connected - never your address, your balance, or any identifier tied to you.

### How do I verify a contract address before signing?

Live addresses are published on the app's own Terms sheet, derived directly from the modules that
call them so the list cannot drift. Cross-check any address against the protocol's own documentation
and inspect the destination in your wallet before approving.

### Is the OZ token contract audited?

No. OZ was deployed by Clanker v3.1 as a standard token and is source-verified onchain, meaning
anyone can read the deployed bytecode against the published source. That is a real property and a
weaker claim than audited, so it is marked as unaudited.

### How do I report a security vulnerability?

Email hello@ozmium.org with `SECURITY` in the subject line, or use the contact in
`ozmium.org/.well-known/security.txt`. Report privately first - do not open a public issue or post it
in Discord.

## What Ozmium Cannot Protect You From

A security page that only lists its own strengths is a marketing page wearing a lab coat, so here is
the other column:

- **Your own signature.** If you approve a malicious transaction from another site, Ozmium cannot
  undo it.
- **Underlying protocol failure.** Every protocol Ozmium routes to is code that can fail.
- **Oracle error.** Bad price data can cause mispriced liquidations in either direction.
- **Market risk.** Liquidation is arithmetic enforced onchain. Nothing in the interface changes it.
- **Phishing.** Verify you are on `ozmium.org`. Ozmium will never ask for a seed phrase.

## Related

- [Terms And Risk](/company/terms/)
- [Wallets And Base](/start/wallets-and-base/)