Security model

Cooket separates user signing, contract execution, and indexed presentation.

Boundary	Security assumption and risk
External wallet	User verifies origin, chain, account, target, value, approval, and minimum output
Web application	Builds and simulates requests, but browser code and dependencies can fail or be compromised
Smart contracts	Enforce protocol rules; bugs, dependency interactions, and economic assumptions remain risks
Protocol Safe	Controls contract ownership/treasury roles recorded by the manifest; signer security and decisions are trusted
Uniswap V3	Adds external factory, pool, position-manager, router, and quoter dependencies
RPC/WSS	May be unavailable, delayed, rate-limited, or inconsistent
Indexer/API	Can lag or be incomplete and is not authoritative for wallet balances or settlement
Metadata/tokens	Creator-supplied content and permissionless assets can be malicious or worthless

The repository contains unit, invariant, integration, and deployment-configuration tests. The deployment manifests mark source verification as complete. Neither fact is equivalent to an independent security audit or a guarantee of safety. Financial and identity boundaries fail closed where required: unsupported chains, missing write configuration, mismatched signers, invalid canonical relationships, unsafe V3 pools, insufficient allowances, and inconsistent accounting stop the relevant path.

Overview

Protocol

Using Cooket

Developers

API Reference

Security

Reference

Security model