How custody works
Who controls my funds?
Who controls my funds?
Your USDC and positions sit in your own self-custodial embedded Solana wallet, set up when you sign up. The Kash web app is a non-custodial interface: ZeroID never holds custody of user funds and doesn’t pool them. Trades and redemptions move USDC directly between your self-custodial wallet and the on-chain market. You can export your self-custodial wallet’s private key at any time.
What can the Kash web app do with my self-custodial wallet?
What can the Kash web app do with my self-custodial wallet?
When you sign in, the Approve Kash step asks you to give the Kash app permission to connect your self-custodial wallet to the Kash protocol so that your transactions can be submitted to the protocol, without a signing prompt each time. Withdrawals to outside addresses are confirmed by you in the web app, and transfers to other Kash web app users are sent only when you send them.
Is there a seed phrase? How does recovery work?
Is there a seed phrase? How does recovery work?
There’s no seed phrase. Access is tied to your sign-in methods, and you can add a recovery email or passkey in Settings → Account → Recovery methods. For an independent backup, export your private key from Settings → Account → Wallet backup.
How are markets secured?
How are markets secured?
Markets live on the Kash protocol, a decentralized, permissionless protocol on Solana that anyone can use directly, so every trade and settlement is recorded on-chain. Outcomes are determined by Kash’s automated resolution system from each market’s published sources and rules, and go through a dispute window before they settle.
Account security best practices
How do I secure my Kash web app account?
How do I secure my Kash web app account?
- Turn on two-factor authentication with your sign-in provider (X, Google, Telegram, Discord or your email account)
- Add a recovery email or passkey, and link more than one sign-in method
- Only sign in at app.kash.bot
- Never share login codes or your exported private key
What happens if I lose my device?
What happens if I lose my device?
Your self-custodial wallet isn’t stored only on your device. Sign in on a new device with any linked method. Then secure the lost device’s accounts (email, X, Google) with your provider.
Common security concerns
How do I spot phishing?
How do I spot phishing?
- The Kash web app is only at app.kash.bot, and the docs at docs.kash.bot
- ZeroID will never DM you asking for your private key, a login code or a “verification” deposit
- Kash has not launched a token. Any “KASH” presale or airdrop is a scam
- The official X accounts are @kash_bot and @kash_bot_trade
Who can use the Kash web app?
Who can use the Kash web app?
Availability, eligibility and any verification requirements are set out in the Terms of Use. See also Legal.
Reporting security issues
How do I report a vulnerability?
How do I report a vulnerability?
Report it privately from the info button in the web app → Feedback → Report a bug, starting with “Security report”, not in a public channel. Include what you found, how to reproduce it and its impact. Please don’t disclose it publicly until we’ve had a chance to fix it, test only against your own account, and never against other users’ funds or data.
Account
Account and recovery
Support
Get help