Updated 30 October 2026
Security
guap never holds your funds and cannot move them without you. Here is exactly what it can do, what it checks, and how to verify it yourself.
In short
- Nobody from guap will ever ask for a recovery phrase, a private key, your Google password or a sign-in code.
- Your wallet's keys are with Dynamic, our wallet provider. Our servers never see them.
- Every transaction is checked against fixed rules before it is signed. Anything outside them is stopped.
- Every purchase and cash out is recorded in a way that shows if anything was changed later.
We never ask for a recovery phrase
Your wallet’s keys are not ours
The wallet is created by Dynamic, our wallet provider, when you sign in with Google. Our servers never see or store its keys and cannot sign anything for you. Your balance is at your own address on the blockchain, where anyone can look it up.
You confirm every move
Before anything is signed, guap shows what it will do: what leaves your wallet, where it goes, and any fee. Nothing goes out until you confirm.
What the wallet will and will not sign
Every transaction is checked against these rules before it is signed, and anything outside them is stopped:
- Token approvals only to Relay, which does conversions and swaps, or to the savings vault, and never unlimited.
- Never an approve-all, and never Permit2.
- Signed messages only for the gas top-up, which authorises one payment of a set amount to Relay, and a token permit to Relay or the vault.
- Apart from sending tokens or coins, no calls to any contract other than Relay's and the vault.
- On Solana, nothing that hands control of your tokens or your account to anyone else.
The contracts involved
We deploy nothing and own nothing. Transactions call public contracts that belong to others:
- 0x8335…02913 is USDC on Base, issued by Circle.
- 0x4cd0…8bc31, 0xccc8…c315be, 0x0729…697f7 and 0x5567…12e58 are Relay, which does conversions and swaps. The last two are its newer version.
- 0xeE8F…44b61 is Gauntlet USDC Prime on Base, the vault your savings go into.
Fees are ordinary transfers to our fee address, shown on the confirmation screen before you sign. No contract we control, and nothing that can be upgraded by us, is in the path.
Where your money goes when you buy or cash out
A cash out is a plain transfer from your wallet to an address our payment partner opens for that one order, and the partner pays your bank. A purchase is a bank transfer to an account the partner opens for that one order, and the partner sends the dollars to your own wallet address, which we take from your account and never from what a page sends us. guap is not a step in either path and never holds the funds.
One exception, also in our terms: if a bank refuses a payout and you paid from a chain that cannot receive the refund, such as Solana, the refund reaches an address we control and we return it by hand.
How we keep the records honest
- Every step of a purchase or cash out is written to a record that cannot be edited or deleted for seven years. A correction is a new entry, never a change.
- Each entry carries a fingerprint of the one before it, so a gap or a changed entry is detected. We check every record daily.
- Our partner's notifications are signed and checked, and we never act on one alone: we ask the partner's own systems what happened before an order moves.
- Limits on buying and cashing out are enforced on our servers, so two orders at the same moment cannot get past them.
Who can change things
Only the people who run guap, signing in with a Google account on our admin list, checked on every request. Every change they make, such as a fee or pausing an account, is recorded with who made it and cannot be removed.
Paying from your own wallet, on the off-ramp
The off-ramp page lets you pay a bank account from a wallet you already have. Paying from Base needs a token approval before the transfer, for the exact amount of that one payout and nothing more:
approve( spender 0xccc88a9d…c315be Relay allowance 10040000 10.04 USDC, not unlimited )
Check it in your wallet before signing. An unlimited approval reads as a very large number or as Unlimited; ours shows the figure on screen. On the off-ramp you sign only the approval and the transfer. If something asks you to sign an opaque message for us there, it is not us.
Reporting something
If you find a vulnerability, or a site pretending to be guap, message @dxFareed on Telegram or see Support. Please give us a chance to fix a vulnerability before telling anyone else.