DocsSafety

Safety

What the Cleave app checks for you, and what you should check yourself.

Every step is test-run

Before your wallet opens, the app runs each step of the trade against the current chain state. If one would fail, Review says This transaction would fail. and nothing is sent. Network cost in Review comes from the same run.

The app also checks each transaction against the quote you reviewed. If they do not match, it stops and asks for a new quote.

Approvals and permits

  • Approvals are sized to this trade. Cleave never asks for an unlimited allowance.
  • A token that takes its own transfer fee is approved for a little more: the measured amount plus a 0.5 % margin, at most twice the amount. The quote states it.
  • Tokens that need it get a separate Reset approval step first.
  • If your wallet already gave a token a Permit2 allowance, Review may ask for a signature instead of an approval. That signature covers this trade only. Cleave never asks you to approve Permit2 itself.
  • Activity lists the approvals Cleave uses on each network. Revoke removes one.

Checks on recipients

When you send to an address other than your own:

  • .eth names are looked up, and Review shows the address they point to. If the name changes before you send, Review asks again.
  • A mistyped checksum is caught.
  • Cleave's own contracts are refused as recipients.
  • A known token contract gets a warning: it is not a wallet.
  • Any other contract gets a note to check it can receive the token; a recognised multisig is named as one.
  • Between chains, a contract that does not exist on the destination stops the send until you confirm you control that address there.

Review shows the full recipient address with a warning whenever it is not your connected wallet.

Checks on tokens

  • Tokens not on our list need an import and show their address.
  • A token with the same name as a listed one gets a warning.
  • Tokens flagged as risky say so in the picker.
  • A token that charges its own transfer fee is marked before you swap.

Records you can rebuild

Every swap and transfer is saved on this device before it is sent, and Activity can rebuild it from the chain on any device. See Activity.

Smart accounts and multisigs

  • Some smart-account wallets: their own safety check fails when you spend nearly all of a balance. Leave a little for fees, then try again.
  • When your wallet needs other signers to confirm, Cleave waits for them and tracks the transaction once it runs.

What to check yourself

  • Check that the address bar shows cleave.fi.
  • Read the recipient and the amounts in Review before you sign.
  • Never share your seed phrase or private keys. Cleave never asks for them.
  • Cleave's contract addresses for each network are listed in the API docs, under Contract addresses.