Security

Custody, risk, and protection architecture

Stackit.ai is designed to keep BTC and ETH treasury actions inside explicit human-defined rules, with wallet-sovereign custody and automatic LTV protection before positions become fragile.

Last updated June 11, 2026

Security controls

CustodyOperator-owned wallets in both paths. Wallet-sovereign agents keep their own keys; managed treasuries live in a wallet owned by the operator's account. Stackit.ai does not hold private keys.
ExecutionTwo paths: unsigned transactions the operator or agent wallet signs, or delegated automation as a revocable additional signer gated by an on-wallet, deny-all-by-default policy.
ProtocolsBuilt around Aave V3 on Arbitrum and Base, with Privy and Bridge infrastructure.
Live LTV band35-50% target operating range with a 60% recommended ceiling.
Trigger metricHealth Score bands trigger protection: default 1.3 on the lower side and above 3 on the upper repayment side, with tighter operator settings supported.
ProtectionAuto-repay and auto-deleverage target roughly 25% LTV during sharp drawdowns or parking.
DormancyIf an account is quiet for 6 months with a loan open, Stackit.ai rewinds toward roughly 25% LTV and moves it to daily monitoring.
FeesLiquidation protection is always free. Stackit.ai never charges when protection fires.

Custody model

Stackit.ai is wallet-sovereign by default. The treasury rules engine can calculate, preview, and prepare actions, but signing stays with the user, company wallet, or authorized agent wallet. This keeps private keys out of Stackit.ai systems.

Audit status

Stackit.ai is not presenting a completed third-party smart contract audit at this time. The product uses established infrastructure and will publish audit results, scope, and remediation notes as they become available.

Bug bounty and review history

Protection architecture

Protection is triggered by Health Score policy bands. The default protection threshold is Health Score 1.3, the default upper repayment threshold is over 3, and operators can choose tighter bands. Stackit.ai evaluates those bands as prices change, repays the loan using collateral, and targets about 25% LTV. The configured bands are part of the treasury policy and should be queryable by agents. When markets recover, flash loan re-leverage can restore the treasury loop without a multi-step manual unwind.

Permissions

User-approved automation permissions, Privy, revocation, and agent-mode boundaries.

Self-rescue

Recover without the Stackit.ai UI by repaying, withdrawing, or revoking directly.

Tool risk model

Read-only, simulation, transaction-prep, and live-action risk levels.

Risk disclosures

Stackit.ai does not guarantee profits, future performance, or zero liquidations. Crypto markets can fall quickly. Borrowing creates risk. Smart contract, oracle, liquidity, counterparty, regulatory, and execution risks remain. Stackit.ai's protection system is designed to reduce liquidation risk through rules and automation, not to remove all risk.

Read full legal disclosures