Security

Security

Pool Party is a self-custodial DeFi platform on Base. Your funds stay in your own wallet until you deposit them into a strategy smart contract, and every deposit, position, and withdrawal is on-chain and publicly verifiable. This page states plainly what that protects you from, what it does not, and how to verify things for yourself.

Self-custodial by design

Pool Party never takes custody of your assets. There is no deposit account, no internal balance, and no employee who can move, freeze, or seize your funds. You connect your own wallet, you sign every transaction, and positions are held by smart contracts you interact with directly. If pool-party.xyz went offline tomorrow, your positions would remain yours on-chain.

What self-custody does not remove

Self-custody removes counterparty custody risk. It does not remove smart contract risk (code can have bugs), market risk (token prices move, impermanent loss is real), or key risk (whoever holds your seed phrase holds your funds). Honest security means naming all three, not promising they are gone.

Contracts

Pool Party's contract on Base, verifiable on BaseScan (check the verified source, holders, and transaction history before depositing):

• Base: 0xd6f2f4b4638f8783e2b7697454c6bf292f25b54f

Admin and upgrades: contract administration is held by a multisig, and upgrades pass through a 4-day timelock, so any change is visible on-chain before it takes effect.

Current status (what is not yet published)

We would rather state gaps plainly than imply coverage we cannot link. As of today:

• No third-party audit report is published on this page yet.
• A formal, hosted bug bounty program is not live yet (see bug bounty).

Each item will appear here, with links, as it becomes available. Until then, verify everything yourself on BaseScan and size your positions accordingly.

Audits

Our policy is simple: we only badge an audit we can link. Each published audit report will be listed on this page with the auditor's name, the report date, a link to the full report, and the audited contract addresses with BaseScan links. If a report is not listed here yet, do not assume coverage. Treat that as the current state and size your positions accordingly.

Admin keys and upgrades

Who can upgrade a contract matters as much as the audit. As noted above, administration is held by a multisig and upgrades pass through a 4-day timelock, so a change is visible on-chain before it can take effect. You can verify the admin configuration and any pending changes directly on BaseScan.

How to verify for yourself

• Check the contract on BaseScan before depositing: verified source code, holders, and transaction history are public.
• Only use the app at app.pool-party.xyz, reached from pool-party.xyz. Bookmark it. Phishing clones of DeFi apps are common.
• No one from Pool Party will ever ask for your seed phrase or private key, in DMs or anywhere else. Anyone who does is a scammer.
• Read the risk disclaimer before committing funds.

Report a vulnerability

If you believe you have found a security issue, report it privately. Reach the team through GitHub or the moderators in our Discord. Please do not disclose publicly before we have had a chance to respond.