{
"badges": [],
"description": "A wallet service with a closed-source hosted frontend that keeps spending keys client-side and gives recipients a fresh stealth Safe account for every payment through reusable ENS names.",
"detailedDescription": "Fluidkey is a wallet service that separates incoming payments across fresh Ethereum addresses while presenting them as one account. Whether requested through an ENS name, the app, or the API, each receiving address is a Safe controlled by a private key that the recipient can derive locally.\n\n### Stealth address generation\n\nUnder Fluidkey's published key model, the client deterministically derives separate viewing and spending keys from a wallet signature combined with a PIN. It shares a derived private viewing node and public spending key with Fluidkey so the service can generate and monitor payment addresses, but keeps the private spending key locally. Fluidkey also offers Privy embedded wallets on the web and device-generated keys on mobile. Recovery of those keys depends on the chosen login and backup method.\n\nFor each payment nonce, the service derives an ephemeral private key and combines it with the recipient's public spending key to generate a one-time signer address. The client can recreate the same ephemeral key and combine its public key with the private spending key to derive the private key controlling that signer. Under this model, only the client can derive the private key needed to sign for a correctly generated address.\n\nThe receiving address is a counterfactually predicted 1/1 Safe whose sole owner is the stealth signer. It can receive funds before the Safe contract is deployed. Its address depends on the Safe factory, singleton, proxy bytecode, owners, threshold, salt nonce, and initialization data. Recovery must reproduce the original parameters, including any auto-earn initialization, rather than just the user's current settings.\n\nThe derivation SDK and standalone recovery client are published. The recovery client can derive exportable stealth signer keys, predict receiving Safes, and deploy them without using the Fluidkey API.\n\nThe production web wallet itself is closed source, has no published reproducible build, and cannot be self-hosted. Users who rely on it must trust the remotely served application to preserve the client-side spending-key boundary. The API, ENS gateway, indexer, and relay are also hosted and closed source, so the complete wallet service cannot be self-hosted.\n\nThe hosted frontend is not required to hold or use spending keys. A locally run client can register and authenticate an account, independently verify service-generated receiving addresses, and recover funds from them. In this setup, the spending key and derived stealth private keys remain local. Fluidkey receives the scoped viewing capability and signed authorizations. Assuming the client verifies the data it signs, bypassing the hosted frontend removes it as a spending-key exfiltration risk.\n\nThis differs from the usual sender-driven ERC-5564 flow. The payer does not derive the address from public recipient metadata and publish an announcement. Fluidkey's service performs the derivation, keeps the address-to-account mapping, and indexes the resulting balances.\n\nWhen a user spends, the service selects one or more stealth Safes and prepares the transactions. The client re-derives the corresponding owner keys and authorizes Safe execution. The hosted client also processes accepted actions returned by the backend, so keeping keys client-side does not replace checking the transaction data supplied by the service.\n\n### ENS resolution\n\nFluidkey provides `username.fkey.eth` and `username.fkey.id` names. Both kinds of name use the same ENS CCIP-Read flow. The `.fkey.id` name also works as a web payment link.\n\nA lookup is redirected to Fluidkey's gateway, which creates a fresh payment address and returns a signed ENS answer. The onchain resolver checks the answer's expiry and signature against its configurable set of signers.\n\nThe signature authenticates the answer as one accepted by Fluidkey, but it is not a proof that the returned address was correctly derived for the named recipient. An external sender cannot independently verify recipient control from the ENS answer alone. The resolver owner can immediately replace the gateway URL and add or remove accepted signers.\n\n### Auto-earn\n\nWhen auto-earn is enabled, receiving Safes are initialized with the Fluidkey Earn module. It allows the module owner and authorized relayers to wrap native tokens when needed and deposit funds into configured ERC-4626 vaults, with the vault shares credited to the same Safe. Anyone can also submit a deposit instruction signed by an authorized relayer. These deposits do not require a new Safe owner signature for each execution.\n\nThe module owner publishes token and vault configurations identified by a hash of their contents. Changing a vault produces a different configuration hash, and selecting a different hash requires a call from the Safe. The owner cannot silently replace the vault set under an already selected hash. Both the module owner and authorized relayers can manage relayer permissions. Users can disable the module through their Safe, but funds already deposited remain exposed to the underlying vaults' losses, liquidity, and withdrawal restrictions.\n\n### Privacy considerations\n\nFluidkey's fresh addresses do not hide the sender, token, amount, or receiving address of an individual payment. They prevent separate receives from automatically accumulating under one reused public address. Later transactions can still link addresses when they consolidate balances, use a recognizable destination, or correlate by timing and amount.\n\nThe hosted service has the viewing capability and address index needed to link an account's stealth addresses and activity. Fluidkey also integrates Houdini Swap for its Hide Trail feature, which routes funds through two centralized exchanges (CEXs) to obscure the public link between the original and final addresses. This adds reliance on the swap service and participating exchanges, including their visibility into the transfers and their ability to delay or block them.",
"links": {
"websites": [
"https://app.fluidkey.com"
],
"documentation": [
"https://docs.fluidkey.com",
"https://docs.fluidkey.com/technical-documentation/technical-walkthrough/",
"https://docs.fluidkey.com/readme/recovery/"
],
"repositories": [
"https://github.com/fluidkey/fluidkey-stealth-account-kit",
"https://github.com/fluidkey/sara",
"https://github.com/fluidkey/fluidkey-earn-module",
"https://github.com/fluidkey/fluidkey-hydrator"
],
"socialMedia": [
"https://x.com/fluidkey"
]
}
}
colors+1-0
null
ecosystemColors+1-0
null
milestones+1-0
null
chainConfig+1-0
null
escrows+1-0
null
bridgeInfo+1-0
null
bridgeRisks+1-0
null
bridgeTechnology+1-0
null
scalingInfo+1-0
null
scalingStage+1-0
null
scalingRisks+1-0
null
scalingDa+1-0
null
scalingTechnology+1-0
null
daLayer+1-0
null
daBridge+1-0
null
customDa+1-0
null
zkCatalogInfo+1-0
null
interopConfig+1-0
null
privacyInfo+45-0
{
"attributes": [
{
"id": "stealthAddresses",
"label": "Stealth addresses",
"description": "Uses fresh, one-time recipient addresses to obscure who controls the receiving address."
},
{
"id": "anyAmount",
"label": "Any amount",
"description": "Deposits and withdrawals can have any size."
},
{
"id": "defi",
"label": "DeFi",
"description": "Interop with DeFi vaults through stealth Safes."
}
],
"exitWindow": {
"value": "Infinite",
"sentiment": "good",
"orderHint": 9007199254740991,
"description": "Under the documented key model, existing stealth balances are held in user-controlled Safes and can be recovered with the published client-side recovery tool and original Safe initialization parameters. Auto-earn positions remain subject to the withdrawal conditions and risks of their underlying vaults.",
"walkawayTest": {
"passed": false,
"reason": "New payment-address generation through the app and ENS, address indexing, transaction construction, and relaying depend on the hosted Fluidkey service."
}
},
"privacy": {
"value": "Admin view key",
"sentiment": "bad",
"description": "Fluidkey holds a private, per-account viewing capability that lets its service derive and link the stealth addresses generated for that account."
},
"reproducibility": {
"value": "Partially reproducible",
"sentiment": "warning",
"description": "The production web wallet is closed source and cannot be self-hosted. The published derivation code and recovery client can nevertheless be used to derive keys, verify service-generated receiving addresses, and recover funds independently. A local client can also register and authenticate through the hosted API. The backend implementations of the API, ENS gateway, indexer, and relay service are not published, so the complete service cannot be reproduced."
},
"riskSummary": "## Funds can be stolen if\n1. a user relies on the hosted wallet and it is malicious or compromised and exfiltrates derived spending keys. The production wallet is closed source and has no published reproducible build, so users cannot inspect its source or verify the code being served.\n2. an accepted ENS signer returns an attacker-controlled payment address for a Fluidkey name. The resolver authenticates the answer but does not prove that the intended recipient controls it.\n3. the hosted service supplies malicious transaction data and the client signs it without independently checking the destination, amount, and calls being authorized.\n \n## Funds can be lost if\n1. a user loses the wallet, PIN, login, or backup needed to recover their private spending keys.\n2. the service and client derive different address data or Safe initialization parameters and a payment is sent to an address that the user cannot recover.\n3. an auto-earn vault loses funds or cannot honor withdrawals, or a service used by Hide Trail fails to return the funds routed through it.\n \n## Privacy can be lost if\n1. Fluidkey, or an attacker who obtains its viewing data, uses the service's viewing capability and index to link an account's stealth addresses and onchain activity.\n2. spending from several stealth addresses together, reusing destinations, or recognizable timing and amounts links otherwise separate payments onchain.\n3. a user relies on Hide Trail and the swap service or participating exchanges use their transfer records to link activity that is obscured from public onchain observers.",
"summaryTrackedItemName": "address",
"tokens": [],
"upgradesAndGovernance": {
"content": "Fluidkey has no public onchain governance process for its hosted wallet, API, indexer, ENS gateway, or relay. These components can change without an onchain notice period. The production wallet is closed source and has no published reproducible build, so users who rely on it cannot inspect its source, verify which client code is deployed, or determine whether an update preserves the client-side spending-key boundary. Users can bypass the hosted frontend with an inspected local client, but this does not reproduce the other hosted components or prevent them from changing.\n\nThe deployed ENS `OffchainResolver` code is immutable, but its owner can immediately replace the gateway URL, add or remove accepted signers, or transfer ownership. An accepted signer can authenticate any offchain ENS answer, including a payment address. The resolver callback verifies only the signature and expiry. It does not verify stealth-address derivation or recipient control. The resolver is owned by a 3/5 Safe.\n\nThese powers affect new address generation and ENS lookups. They do not let the resolver owner or signers spend from an existing, correctly derived stealth Safe because its private owner key remains with the user. Existing balances can be recovered independently with the published recovery client and the original Safe initialization parameters, but the full Fluidkey experience does not remain available if the hosted service disappears.\n\nThe Fluidkey Earn module is separate from the resolver and has immutable code. Its owner is a 2/3 Safe on each tracked chain. Its owner can publish new vault configurations and manage authorized relayers. Relayers can initiate deposits into a Safe's selected configuration and add or remove relayers. Each configuration is identified by a hash of its contents, so adopting a different vault set requires a call from the Safe. Users can disable the module through their Safe. The governance and withdrawal conditions of the underlying vaults remain separate dependencies."
}
}
defiInfo+1-0
null
externalDependencies+1-0
null
tvsInfo+1-0
null
tvsConfig+1-0
null
activityConfig+1-0
null
livenessInfo+1-0
null
livenessConfig+1-0
null
costsInfo+1-0
null
trackedTxsConfig+1-0
null
daTrackingConfig+1-0
null
ecosystemInfo+1-0
null
ecosystemConfig+1-0
null
permissions+445-0
{
"arbitrum": {
"roles": [],
"actors": [
{
"id": "Fluidkey Earn Owner",
"name": "Fluidkey Earn Owner",
"description": "A Multisig with 2/3 threshold. \n* Can interact with FluidkeyEarnModule\n * publish vault configurations, manage authorized relayers, and initiate deposits into the configurations selected by enabled Safes. Changing a Safe's selected configuration hash requires a call from that Safe ",
"accounts": [
{
"address": "arb1:0x9E3eba321427941868cB4123De97DAB145C9e7CD",
"type": "Contract",
"isVerified": true,
"name": "0x9E3e…e7CD",
"url": "https://arbiscan.io/address/0x9E3eba321427941868cB4123De97DAB145C9e7CD"
}
],
"chain": "arbitrum",
"references": [],
"participants": [
{
"address": "arb1:0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614",
"type": "EOA",
"isVerified": true,
"name": "0xB9e7…4614",
"url": "https://arbiscan.io/address/0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614"
},
{
"address": "arb1:0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10",
"type": "EOA",
"isVerified": true,
"name": "0xa13E…3E10",
"url": "https://arbiscan.io/address/0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10"
},
{
"address": "arb1:0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1",
"type": "EOA",
"isVerified": true,
"name": "0x3066…08c1",
"url": "https://arbiscan.io/address/0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1"
}
],
"discoveryDrivenData": true
},
{
"id": "EOA-1",
"name": "EOA 1",
"accounts": [
{
"address": "arb1:0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"type": "EOA",
"isVerified": true,
"name": "0x53d9…151D",
"url": "https://arbiscan.io/address/0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"displayName": "EOA 1"
}
],
"chain": "arbitrum",
"description": "* Can interact with FluidkeyEarnModule\n * initiate deposits from enabled Safes into their selected vault configurations, and add or remove authorized relayers ",
"discoveryDrivenData": true
}
]
},
"base": {
"roles": [],
"actors": [
{
"id": "Fluidkey Earn Owner",
"name": "Fluidkey Earn Owner",
"description": "A Multisig with 2/3 threshold. \n* Can interact with FluidkeyEarnModule\n * publish vault configurations, manage authorized relayers, and initiate deposits into the configurations selected by enabled Safes. Changing a Safe's selected configuration hash requires a call from that Safe ",
"accounts": [
{
"address": "base:0x9E3eba321427941868cB4123De97DAB145C9e7CD",
"type": "Contract",
"isVerified": true,
"name": "0x9E3e…e7CD",
"url": "https://basescan.org/address/0x9E3eba321427941868cB4123De97DAB145C9e7CD"
}
],
"chain": "base",
"references": [],
"participants": [
{
"address": "base:0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614",
"type": "EOA",
"isVerified": true,
"name": "0xB9e7…4614",
"url": "https://basescan.org/address/0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614"
},
{
"address": "base:0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10",
"type": "EOA",
"isVerified": true,
"name": "0xa13E…3E10",
"url": "https://basescan.org/address/0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10"
},
{
"address": "base:0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1",
"type": "EOA",
"isVerified": true,
"name": "0x3066…08c1",
"url": "https://basescan.org/address/0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1"
}
],
"discoveryDrivenData": true
},
{
"id": "EOA-2",
"name": "EOA 2",
"accounts": [
{
"address": "base:0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"type": "EOA",
"isVerified": true,
"name": "0x53d9…151D",
"url": "https://basescan.org/address/0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"displayName": "EOA 2"
}
],
"chain": "base",
"description": "* Can interact with FluidkeyEarnModule\n * initiate deposits from enabled Safes into their selected vault configurations, and add or remove authorized relayers ",
"discoveryDrivenData": true
}
]
},
"ethereum": {
"roles": [],
"actors": [
{
"id": "Fluidkey Earn Owner",
"name": "Fluidkey Earn Owner",
"description": "A Multisig with 2/3 threshold. \n* Can interact with FluidkeyEarnModule\n * publish vault configurations, manage authorized relayers, and initiate deposits into the configurations selected by enabled Safes. Changing a Safe's selected configuration hash requires a call from that Safe ",
"accounts": [
{
"address": "eth:0x9E3eba321427941868cB4123De97DAB145C9e7CD",
"type": "Contract",
"isVerified": true,
"name": "0x9E3e…e7CD",
"url": "https://etherscan.io/address/0x9E3eba321427941868cB4123De97DAB145C9e7CD"
}
],
"chain": "ethereum",
"references": [],
"participants": [
{
"address": "eth:0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614",
"type": "EOA",
"isVerified": true,
"name": "0xB9e7…4614",
"url": "https://etherscan.io/address/0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614"
},
{
"address": "eth:0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10",
"type": "EOA",
"isVerified": true,
"name": "0xa13E…3E10",
"url": "https://etherscan.io/address/0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10"
},
{
"address": "eth:0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1",
"type": "EOA",
"isVerified": true,
"name": "0x3066…08c1",
"url": "https://etherscan.io/address/0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1"
}
],
"discoveryDrivenData": true
},
{
"id": "Fluidkey Resolver Multisig",
"name": "Fluidkey Resolver Multisig",
"description": "A Multisig with 3/5 threshold. \n* Can interact with OffchainResolver\n * change the accepted signers and gateway URL immediately, or transfer resolver ownership ",
"accounts": [
{
"address": "eth:0xdcC34c0da55cEF7AeD38Bb749AD97DAC12A9936C",
"type": "Contract",
"isVerified": true,
"name": "0xdcC3…936C",
"url": "https://etherscan.io/address/0xdcC34c0da55cEF7AeD38Bb749AD97DAC12A9936C"
}
],
"chain": "ethereum",
"references": [],
"participants": [
{
"address": "eth:0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10",
"type": "EOA",
"isVerified": true,
"name": "0xa13E…3E10",
"url": "https://etherscan.io/address/0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10"
},
{
"address": "eth:0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614",
"type": "EOA",
"isVerified": true,
"name": "0xB9e7…4614",
"url": "https://etherscan.io/address/0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614"
},
{
"address": "eth:0x5a655820821bf7af7B23566b34ce0CcBd9c9a37f",
"type": "EOA",
"isVerified": true,
"name": "0x5a65…a37f",
"url": "https://etherscan.io/address/0x5a655820821bf7af7B23566b34ce0CcBd9c9a37f"
},
{
"address": "eth:0x74C19105f358BAb85f8E9FDA9202A1326A714d89",
"type": "EOA",
"isVerified": true,
"name": "0x74C1…4d89",
"url": "https://etherscan.io/address/0x74C19105f358BAb85f8E9FDA9202A1326A714d89"
},
{
"address": "eth:0xFE972D3976F7cc5ba1C9b471D48362B82C6c5fDd",
"type": "EOA",
"isVerified": true,
"name": "0xFE97…5fDd",
"url": "https://etherscan.io/address/0xFE972D3976F7cc5ba1C9b471D48362B82C6c5fDd"
}
],
"discoveryDrivenData": true
},
{
"id": "EOA-4",
"name": "EOA 4",
"accounts": [
{
"address": "eth:0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"type": "EOA",
"isVerified": true,
"name": "0x53d9…151D",
"url": "https://etherscan.io/address/0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"displayName": "EOA 4"
}
],
"chain": "ethereum",
"description": "* Can interact with FluidkeyEarnModule\n * initiate deposits from enabled Safes into their selected vault configurations, and add or remove authorized relayers ",
"discoveryDrivenData": true
},
{
"id": "EOA-3",
"name": "EOA 3",
"accounts": [
{
"address": "eth:0x269fDaBd799179189C98D960C58C3793CcedDB85",
"type": "EOA",
"isVerified": true,
"name": "0x269f…DB85",
"url": "https://etherscan.io/address/0x269fDaBd799179189C98D960C58C3793CcedDB85",
"displayName": "EOA 3"
}
],
"chain": "ethereum",
"description": "* Can interact with OffchainResolver\n * sign arbitrary offchain ENS answers, including payment addresses accepted by the resolver ",
"discoveryDrivenData": true
}
]
},
"gnosis": {
"roles": [],
"actors": [
{
"id": "Fluidkey Earn Owner",
"name": "Fluidkey Earn Owner",
"description": "A Multisig with 2/3 threshold. \n* Can interact with FluidkeyEarnModule\n * publish vault configurations, manage authorized relayers, and initiate deposits into the configurations selected by enabled Safes. Changing a Safe's selected configuration hash requires a call from that Safe ",
"accounts": [
{
"address": "gno:0x9E3eba321427941868cB4123De97DAB145C9e7CD",
"type": "Contract",
"isVerified": true,
"name": "0x9E3e…e7CD",
"url": "https://gnosis.blockscout.com/address/0x9E3eba321427941868cB4123De97DAB145C9e7CD"
}
],
"chain": "gnosis",
"references": [],
"participants": [
{
"address": "gno:0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614",
"type": "EOA",
"isVerified": true,
"name": "0xB9e7…4614",
"url": "https://gnosis.blockscout.com/address/0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614"
},
{
"address": "gno:0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10",
"type": "EOA",
"isVerified": true,
"name": "0xa13E…3E10",
"url": "https://gnosis.blockscout.com/address/0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10"
},
{
"address": "gno:0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1",
"type": "EOA",
"isVerified": true,
"name": "0x3066…08c1",
"url": "https://gnosis.blockscout.com/address/0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1"
}
],
"discoveryDrivenData": true
},
{
"id": "EOA-5",
"name": "EOA 5",
"accounts": [
{
"address": "gno:0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"type": "EOA",
"isVerified": true,
"name": "0x53d9…151D",
"url": "https://gnosis.blockscout.com/address/0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"displayName": "EOA 5"
}
],
"chain": "gnosis",
"description": "* Can interact with FluidkeyEarnModule\n * initiate deposits from enabled Safes into their selected vault configurations, and add or remove authorized relayers ",
"discoveryDrivenData": true
}
]
},
"optimism": {
"roles": [],
"actors": [
{
"id": "Fluidkey Earn Owner",
"name": "Fluidkey Earn Owner",
"description": "A Multisig with 2/3 threshold. \n* Can interact with FluidkeyEarnModule\n * publish vault configurations, manage authorized relayers, and initiate deposits into the configurations selected by enabled Safes. Changing a Safe's selected configuration hash requires a call from that Safe ",
"accounts": [
{
"address": "oeth:0x9E3eba321427941868cB4123De97DAB145C9e7CD",
"type": "Contract",
"isVerified": true,
"name": "0x9E3e…e7CD",
"url": "https://optimistic.etherscan.io/address/0x9E3eba321427941868cB4123De97DAB145C9e7CD"
}
],
"chain": "optimism",
"references": [],
"participants": [
{
"address": "oeth:0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614",
"type": "EOA",
"isVerified": true,
"name": "0xB9e7…4614",
"url": "https://optimistic.etherscan.io/address/0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614"
},
{
"address": "oeth:0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10",
"type": "EOA",
"isVerified": true,
"name": "0xa13E…3E10",
"url": "https://optimistic.etherscan.io/address/0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10"
},
{
"address": "oeth:0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1",
"type": "EOA",
"isVerified": true,
"name": "0x3066…08c1",
"url": "https://optimistic.etherscan.io/address/0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1"
}
],
"discoveryDrivenData": true
},
{
"id": "EOA-7",
"name": "EOA 7",
"accounts": [
{
"address": "oeth:0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"type": "EOA",
"isVerified": true,
"name": "0x53d9…151D",
"url": "https://optimistic.etherscan.io/address/0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"displayName": "EOA 7"
}
],
"chain": "optimism",
"description": "* Can interact with FluidkeyEarnModule\n * initiate deposits from enabled Safes into their selected vault configurations, and add or remove authorized relayers ",
"discoveryDrivenData": true
}
]
},
"polygonpos": {
"roles": [],
"actors": [
{
"id": "Fluidkey Earn Owner",
"name": "Fluidkey Earn Owner",
"description": "A Multisig with 2/3 threshold. \n* Can interact with FluidkeyEarnModule\n * publish vault configurations, manage authorized relayers, and initiate deposits into the configurations selected by enabled Safes. Changing a Safe's selected configuration hash requires a call from that Safe ",
"accounts": [
{
"address": "matic:0x9E3eba321427941868cB4123De97DAB145C9e7CD",
"type": "Contract",
"isVerified": true,
"name": "0x9E3e…e7CD",
"url": "https://polygonscan.com/address/0x9E3eba321427941868cB4123De97DAB145C9e7CD"
}
],
"chain": "polygonpos",
"references": [],
"participants": [
{
"address": "matic:0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614",
"type": "EOA",
"isVerified": true,
"name": "0xB9e7…4614",
"url": "https://polygonscan.com/address/0xB9e7de28c2e6C8F3C29Fc0e061485A34C5864614"
},
{
"address": "matic:0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10",
"type": "EOA",
"isVerified": true,
"name": "0xa13E…3E10",
"url": "https://polygonscan.com/address/0xa13EFDd0d500cB9DA8140842cf624f1D5e273E10"
},
{
"address": "matic:0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1",
"type": "EOA",
"isVerified": true,
"name": "0x3066…08c1",
"url": "https://polygonscan.com/address/0x3066e11cd9a68AbFd2C3798b4617aA44E9Dc08c1"
}
],
"discoveryDrivenData": true
},
{
"id": "EOA-6",
"name": "EOA 6",
"accounts": [
{
"address": "matic:0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"type": "EOA",
"isVerified": true,
"name": "0x53d9…151D",
"url": "https://polygonscan.com/address/0x53d92eCe145696ff27A7d1F8746632C3deBB151D",
"displayName": "EOA 6"
}
],
"chain": "polygonpos",
"description": "* Can interact with FluidkeyEarnModule\n * initiate deposits from enabled Safes into their selected vault configurations, and add or remove authorized relayers ",
"discoveryDrivenData": true
}
]
}
}
contracts+122-0
{
"addresses": {
"arbitrum": [
{
"name": "FluidkeyEarnModule",
"isVerified": true,
"address": "arb1:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "arbitrum",
"description": "Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n* Roles:\n * **authorizedRelayers**: EOA 1\n * **owner**: Fluidkey Earn Owner",
"discoveryDrivenData": true,
"url": "https://arbiscan.io/address/0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9#code"
}
],
"base": [
{
"name": "FluidkeyEarnModule",
"isVerified": true,
"address": "base:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "base",
"description": "Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n* Roles:\n * **authorizedRelayers**: EOA 2\n * **owner**: Fluidkey Earn Owner",
"discoveryDrivenData": true,
"url": "https://basescan.org/address/0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9#code"
}
],
"ethereum": [
{
"name": "FluidkeyEarnModule",
"isVerified": true,
"address": "eth:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n* Roles:\n * **authorizedRelayers**: EOA 4\n * **owner**: Fluidkey Earn Owner",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9#code"
},
{
"name": "OffchainResolver",
"isVerified": true,
"address": "eth:0x9AcF316290AaA62edafdDDaC48B124032C36EB3c",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Immutable ENS CCIP-Read resolver used by Fluidkey. Every query redirects to a configurable gateway and accepts the returned ENS record if it is unexpired and signed by an accepted signer. It does not verify that a returned payment address was derived for the named recipient.\n* Roles:\n * **owner**: Fluidkey Resolver Multisig\n * **signers**: EOA 3",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9AcF316290AaA62edafdDDaC48B124032C36EB3c#code"
}
],
"gnosis": [
{
"name": "FluidkeyEarnModule",
"isVerified": true,
"address": "gno:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "gnosis",
"description": "Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n* Roles:\n * **authorizedRelayers**: EOA 5\n * **owner**: Fluidkey Earn Owner",
"discoveryDrivenData": true,
"url": "https://gnosis.blockscout.com/address/0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9#code"
}
],
"polygonpos": [
{
"name": "FluidkeyEarnModule",
"isVerified": true,
"address": "matic:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "polygonpos",
"description": "Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n* Roles:\n * **authorizedRelayers**: EOA 6\n * **owner**: Fluidkey Earn Owner",
"discoveryDrivenData": true,
"url": "https://polygonscan.com/address/0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9#code"
}
],
"optimism": [
{
"name": "FluidkeyEarnModule",
"isVerified": true,
"address": "oeth:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "optimism",
"description": "Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n* Roles:\n * **authorizedRelayers**: EOA 7\n * **owner**: Fluidkey Earn Owner",
"discoveryDrivenData": true,
"url": "https://optimistic.etherscan.io/address/0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9#code"
}
]
},
"risks": []
}
[
{
"id": "80c21fa4",
"date": "Tue, 08 Sep 2026 08:47:06 GMT",
"timestamp": 1788853601,
"description": "Initial discovery of the Fluidkey ENS resolver, its owner and signers, and the auto-earn module and its permissions on Ethereum, Base, Arbitrum, Optimism, Polygon PoS, and Gnosis.",
"isHighSeverity": false,
"changeCount": 14,
"sections": [
{
"kind": "initial-discovery",
"body": "```diff\n+ Status: CREATED\n contract FluidkeyEarnModule (arb1:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9) [N/A]\n +++ description: Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n```\n\n```diff\n+ Status: CREATED\n contract Fluidkey Earn Owner (arb1:0x9E3eba321427941868cB4123De97DAB145C9e7CD) [GnosisSafe]\n +++ description: None\n```\n\n```diff\n+ Status: CREATED\n contract FluidkeyEarnModule (base:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9) [N/A]\n +++ description: Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n```\n\n```diff\n+ Status: CREATED\n contract Fluidkey Earn Owner (base:0x9E3eba321427941868cB4123De97DAB145C9e7CD) [GnosisSafe]\n +++ description: None\n```\n\n```diff\n+ Status: CREATED\n contract FluidkeyEarnModule (eth:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9) [N/A]\n +++ description: Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n```\n\n```diff\n+ Status: CREATED\n contract OffchainResolver (eth:0x9AcF316290AaA62edafdDDaC48B124032C36EB3c) [N/A]\n +++ description: Immutable ENS CCIP-Read resolver used by Fluidkey. Every query redirects to a configurable gateway and accepts the returned ENS record if it is unexpired and signed by an accepted signer. It does not verify that a returned payment address was derived for the named recipient.\n```\n\n```diff\n+ Status: CREATED\n contract Fluidkey Earn Owner (eth:0x9E3eba321427941868cB4123De97DAB145C9e7CD) [GnosisSafe]\n +++ description: None\n```\n\n```diff\n+ Status: CREATED\n contract Fluidkey Resolver Multisig (eth:0xdcC34c0da55cEF7AeD38Bb749AD97DAC12A9936C) [GnosisSafe]\n +++ description: None\n```\n\n```diff\n+ Status: CREATED\n contract FluidkeyEarnModule (gno:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9) [N/A]\n +++ description: Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n```\n\n```diff\n+ Status: CREATED\n contract Fluidkey Earn Owner (gno:0x9E3eba321427941868cB4123De97DAB145C9e7CD) [GnosisSafe]\n +++ description: None\n```\n\n```diff\n+ Status: CREATED\n contract FluidkeyEarnModule (matic:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9) [N/A]\n +++ description: Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n```\n\n```diff\n+ Status: CREATED\n contract Fluidkey Earn Owner (matic:0x9E3eba321427941868cB4123De97DAB145C9e7CD) [GnosisSafe]\n +++ description: None\n```\n\n```diff\n+ Status: CREATED\n contract FluidkeyEarnModule (oeth:0x3BDb857AFe9b51d8916D80240d2ADe40D4d3f2f9) [N/A]\n +++ description: Safe module used for Fluidkey auto-earn. Authorized relayers can deposit tokens into the vault selected by the Safe's configuration hash, with vault shares credited to that Safe. The module owner publishes configurations, but selecting a different hash requires a call from the Safe.\n```\n\n```diff\n+ Status: CREATED\n contract Fluidkey Earn Owner (oeth:0x9E3eba321427941868cB4123De97DAB145C9e7CD) [GnosisSafe]\n +++ description: None\n```"
}
]
}
]