> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cooket.fun/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> Cooket trust boundaries and repository-proven controls.

Cooket separates user signing, contract execution, and indexed presentation.

| Boundary        | Security assumption and risk                                                                                   |
| --------------- | -------------------------------------------------------------------------------------------------------------- |
| External wallet | User verifies origin, chain, account, target, value, approval, and minimum output                              |
| Web application | Builds and simulates requests, but browser code and dependencies can fail or be compromised                    |
| Smart contracts | Enforce protocol rules; bugs, dependency interactions, and economic assumptions remain risks                   |
| Protocol Safe   | Controls contract ownership/treasury roles recorded by the manifest; signer security and decisions are trusted |
| Uniswap V3      | Adds external factory, pool, position-manager, router, and quoter dependencies                                 |
| RPC/WSS         | May be unavailable, delayed, rate-limited, or inconsistent                                                     |
| Indexer/API     | Can lag or be incomplete and is not authoritative for wallet balances or settlement                            |
| Metadata/tokens | Creator-supplied content and permissionless assets can be malicious or worthless                               |

The repository contains unit, invariant, integration, and deployment-configuration tests. The deployment manifests mark source verification as complete. Neither fact is equivalent to an independent security audit or a guarantee of safety.

Financial and identity boundaries fail closed where required: unsupported chains, missing write configuration, mismatched signers, invalid canonical relationships, unsafe V3 pools, insufficient allowances, and inconsistent accounting stop the relevant path.