Trust & Security

Akashi has two products. Akashi Invest is a set of USDC vaults on Solana: you deposit into an on-chain vault program and hold Senior or Junior shares, and Junior takes losses first. Akashi Discovery compares Solana stablecoin yields and lets you deposit directly into the venue you pick. Both ask you to sign transactions that move real money, but your money follows a different path in each. This page explains both paths, the checks that run on every change, and how to reach us about a security issue.

1. Your wallet signs, our servers do not

In both products Akashi’s servers hold no private keys and cannot sign for you. The backend only reads data and builds unsigned transactions. Your wallet shows them to you, you sign, and your wallet submits them. Connecting a wallet spends nothing. A request to sign a login message is not a transaction, and we never need your recovery phrase or private key.

2. Akashi Discovery: straight to the venue

A Discovery deposit goes from your wallet directly to the venue you chose. Akashi holds no balance and has no authority over the position. If Akashi were unavailable tomorrow, your position would be unaffected and you could withdraw it on the venue’s own interface. More on how this works.

3. Akashi Invest: an on-chain vault

A vault deposit goes into the Akashi vault program, and your wallet receives Senior or Junior share tokens. The program keeps the vault’s accounts and checks every instruction against the vault’s rules: coverage limits, withdrawal delays, position caps and valuation freshness. It never takes a price or a value from whoever signs the instruction. Each vault has separate roles with limited powers:

• Admin. Configures the vault. Once a vault is live, changes that allow more risk must be queued and wait an on-chain delay before they take effect, so holders get notice.
• Executor. A separate service with its own key, never the Akashi backend. It moves USDC between the vault and approved protocols, within caps and slippage limits the program enforces. It cannot send money anywhere else.
• Guardian. Can act at once in a problem: pause funding, lower limits, suspend a protocol or remove the executor. It cannot unpause or raise a limit.
• Upgrade authority.The program can be upgraded, and that authority is separate from the vault’s roles.

If the site disappears, the vault and your shares stay on-chain, and any interface can submit valid instructions. No interface can bypass the vault’s coverage, liquidity or pause rules, and shares are a claim on the vault, not direct ownership of each underlying position. The documentation covers who controls what and the full governance and permissions.

4. Checks on every change

• Review before release.Changes are reviewed with particular attention to the boundaries above: nothing server-side can reach a private key or sign, and the vault program’s rules hold.
• Tests and secret scanning. The test suite and a scan for credentials and keys run on a change before it is merged.
• Vault program tests. Integration tests cover each instruction and its limits, and scenario tests replay faults such as protocol outages, bad price data, losses and adapter failures, including against snapshots of mainnet protocols.
• Transaction rehearsals. An end-to-end suite builds and simulates real Discovery transactions against live protocols, so integration breakage surfaces before a user meets it.

Tests and reviews cover particular code and scenarios. They do not prove that a loss cannot happen, and this page does not claim an independent audit.

5. Protocol risk and interface risk are separate

Risk grades on this site take a venue’s own security history into account, so an opportunity can carry a strong grade on a well-established protocol. That is a statement about the protocol holding the money. It is a different question from the interface you are reading it on, and from the vault program that sits between you and the protocols in Akashi Invest. Akashi does not present a venue’s standing as its own.

6. Reporting a security issue

Email security@akashi.finance, the address published in our security.txt. This covers the website, the backend, the vault program and its adapters, and the executor. Please include enough detail to reproduce the issue, and allow us time to ship a fix before disclosing publicly. Reports are read and taken seriously.

7. Other questions

For anything not security-sensitive, such as questions, data corrections or feature requests, write to contact@akashi.finance or use the feedback form.

8. Scope: what Akashi does and does not do

• Akashi’s servers never hold your private keys and never sign for you.
• In Discovery, Akashi never takes custody. In Invest, your deposit is held by the vault program under the rules above, not by Akashi’s servers.
• It reports rates, it does not set or guarantee them. A displayed rate is the venue’s rate at the time it was read; see data sources. A vault’s Senior and Junior rates are expected, not promised.
• A risk grade is Akashi’s own assessment, published with its reasoning and its limits in the methodology. It is not investment advice.
• DeFi carries smart-contract, peg and market risk that no interface can remove. In a vault, Junior absorbs losses first, and Senior can still lose money if a loss exceeds Junior’s capital. Those risks remain yours.