Supersmooth Security Overview: Self-Custody, Access, and Audits

Supersmooth is self-custodial by construction. See what can fail, who can do what, how the system works, and how to verify each claim yourself.

Supersmooth is self-custodial by construction. This page covers what can fail, who can do what, how the system works, and how to verify each claim yourself.

Summary

• Your keys, your Safe. Every position lives in a Safe you own. Supersmooth has no signing authority over your Safe.
• No admin over your funds. No Supersmooth role can move your assets without your permission, freeze or pause your assets, and you can always exit from the Safe app.
• Changes are visible before they are set in stone. Connectors, fees, signers, and aggregators change only through public timelocks.
• Audits. Core contracts reviewed by Fixed Point Solutions. Download the report.

1. Failure scenarios

What happens to your positions if something breaks, and what each party can do about it.

Scenario	Effect on your positions	What you can do	What Supersmooth does
Front-end goes down	None. Positions live in your Safe, at the protocol.	Operate directly at Aave, Morpho, Spark, or the Safe app.	Status page updates.
Bots go down	Automations pause. Positions unchanged. The protocol still liquidates as normal.	Manage by hand, run the recipe yourself, or close.	Alert you via social channels and on UI, restore, publish a report.
Supersmooth ceases to exist	None. Your Safe and positions do not change.	Everything, without us (excluding automation, one-tx actions, refinance, etc.).	N/A
Integrated protocol is exploited	Your exposure is that protocol’s exposure. No pooled risk; one Safe per position.	Exit that position directly.	Chosen guardians can pause the affected connector.
You lose or leak a key	Same as any Safe: the owner keys are the Safe.	Hardware signer, your own owner setup.	Nothing. We cannot recover or move it, by design.
Bot key is compromised	Bounded to the subscription: fixed recipe, onchain trigger, postchecks. Value leaves only through recipe steps you wrote.	Remove the bot from the allowlist or cancel the subscription.	Rotate keys, revoke everywhere, publish.
Fee signer is compromised	None. It signs discount permits that expire in minutes.	Nothing needed.	Emergency revocation is immediate and voids its permits.
Admin key is compromised	None. Admin cannot touch any Safe. It can change connectors, fees, signer, and aggregators, after a timelock.	Exit before a change lands if you disagree.
Swap executes badly	Bounded by the slippage postcheck; the whole transaction reverts below your minimum.	Tighten the minimum.

2. Access and permissions

Every party in the system, what it can do, and how you verify it.

Party	Can	Cannot	Verify
You (Safe owners)	Everything: owners, module, bots, any transfer.		Safe app: owners and modules.
Supersmooth module	Execute recipes from your Safe through registered connectors.	Run unregistered code. Run a subscription without an allowlisted bot, passing trigger, and passing postchecks.	Module address on your Safe.
Bots (allowlisted per subscription)	Run a subscription’s fixed recipe when its trigger passes. Supply runtime inputs within postcheck bounds. Recover gas from your Safe at a Chainlink-priced rate.	Change rules. Add themselves. Bypass a postcheck. Move value except through recipe steps.	AutomationStore and AutomationLens; recipe steps published by SubscriptionRouter.
Admin (team multisig)	Register connectors, set fee profiles, rotate the signer, change aggregators, all timelocked. Emergency-revoke a signer. Appoint guardians and bots.	Touch any Safe, position, subscription, or allowlist. Block your exit.	Owner functions in the registry, FeeManager, and GuardianRegistry.
Guardians	Pause components. Execute emergency subscriptions.	Move funds. Block the Safe app.	GuardianRegistry.
Fee signer (backend key)	Sign discount permits bound to one Safe and chain; redeemable 10 min, valid 30 min (swaps) or 12 min (spreads).	Move funds. Change fees.	FeeManager permit format.
Underlying protocols	Liquidate at their LLTV, change parameters, pause per their rules.	Anything Supersmooth-specific.	Their docs and governance.

3. Architecture and risk

A position is a Safe you own, with one module enabled, running recipes through connectors into the protocols you already use.

Component	Function	Risk	Control
Safe	Holds all assets and positions. One per position; nothing pooled.	Owner key loss or theft.	Hardware signers. Your owner setup.
Module	Executes recipes from your Safe. Connectors run by delegatecall, inside the Safe.	Module bug. Wrongly registered connector.	Audited. Timelocked registry. Reentrancy locks.
Connectors	One per integration: Aave v3 (and Spark), Morpho Blue, Morpho Vaults v2, Compound v3, Euler v2, Fluid, ERC-4626, Lido, Ethena, Maple, Merkl, Across, CoW, aggregator swaps, flash loans (Balancer, Aave v3, Morpho Blue, ERC-3156).	A connector bug affects every action through it, inside your Safe.	Timelocked registry: changes are visible before they can run. Review before proposal.
Recipes and flash loans	Steps run in one transaction. Loops, refinances, and unwinds borrow, act, and repay in the same block.	Step fails, bad route, or flash loan fee.	Atomic: any failure reverts everything. Postchecks on health, balances, allowances, slippage. Zero-fee provider selected where available.
Triggers and bots	Triggers are onchain: health factor, price, trailing stop, balance, vault risk, spread accrued. An allowlisted bot calls the Executor when one passes.	Late (congestion, outage). Wrong (bad feed). Malicious (compromised bot).	Late: protocol liquidation still applies; set stops with margin. Wrong: health triggers read the protocol; price triggers. Malicious: allowlist, fixed recipe, postchecks.
Fees	Swap fee by route: 30 bps standard, 15 refinance and conversion, 10 loop close, 0 free routes. Borrow spread as a share of interest accrued.	Wrong fee. Compromised signer. Future-dated permit.	Profiles immutable per route, timelocked per connector. Immediate signer revocation, permits expire in minutes.
Underlying protocols	Aave, Morpho, Spark, and the rest hold the markets.	Their contract, oracle, liquidation, governance, and asset risk.	Same on any front-end. Their audits, bounties, and governance. We add none and remove none.

4. Automation

What a rule is: A subscription stored onchain: a fixed recipe, an onchain trigger, and the bots allowed to run it.

How it runs: A bot checks the trigger. When it passes, the bot calls the Executor, which runs the recipe from your Safe and then the postchecks. If any check fails, nothing happened.

What you can inspect: Every execution is a normal transaction, every recipe is published, so you can read what a subscription does before subscribing.

Limits: It cannot fire faster than the chain confirms. It reads a feed that can be wrong. It reduces liquidation risk at the protocol; it does not remove it.

5. Verification

• Keys: Each position is a Safe deployed for you and owned by you. No Supersmooth signing authority. You can check your Safe’s owners.
• Exit: No permission required.
• Code: Reviewed by Fixed Point Solutions, 0 critical bugs found. Download the report.
• Automations: Exactly the subscription’s recipe, when its trigger passes, by an allowlisted bot, only if every postcheck holds. Cannot change the recipe, add a bot, or move value except through recipe steps you wrote.

6. Withdrawal without Supersmooth

If Supersmooth disappeared tomorrow, or you simply left, you can manage your position on the underlying protocol frontend. Supersmooth does not have any user lock-in.

7. Audits and reviews

Fixed Point Solutions, LLC (Kurt Barry).

Main assessment: 0 critical, 0 high, 0 medium, 0 low, 3 gas, 2 informational, all resolved or acknowledged. Download the audit report.

8. Incident response

Direct line to the founders for anything touching your positions: [e-mail].