Security guide

How Self-Quantum Liquidity is designed to protect you

Self-Quantum Liquidity tries to make the safe path the easy one. These are built in:

The threat map

Wallet hygiene

Everything else in this guide assumes your keys are safe. These habits keep them that way.

• Never share your recovery phrase or private keys. Not with support, not with a site that says it needs to "verify" your wallet, not with friends.
• Never photograph or screenshot them.

• Write the phrase on paper (or metal) and store it offline, somewhere safe. Do not keep it in notes apps, cloud drives or email.
• Prefer a hardware wallet for anything you cannot afford to lose.

• Use a separate wallet for experiments. Fund a fresh account with only what you will risk on a new tool, and keep your savings in a different wallet that never connects to new sites.
• Keep your browser clean. Use a dedicated browser profile with as few extensions as possible, from verified publishers. A malicious extension can read and change what you see.
• Keep software updated: operating system, browser, wallet.
• Protect the accounts around your crypto (email, exchanges) with an authenticator app or a hardware security key rather than SMS.

Approvals

Approvals are the quiet danger of DeFi, because they keep working long after you close the tab.

When you approve a contract, you tell the token: "this address may move up to N of my tokens whenever it likes." The amount stays until you change it.

Exact, not unlimited

Many apps ask for an unlimited approval so you only have to approve once. That is convenient for them and risky for you: if that contract is ever exploited, or you approved a fake contract, an unlimited allowance lets it take everything of that token in your wallet. Self-Quantum Liquidity asks for the exact amount instead.

Review and revoke

1. Open an approval checker: Revoke.cash, or the token approval tool of your network's block explorer (for example Etherscan's Token Approval Checker).
2. Connect (or type) the address you want to review. Viewing is safe; revoking needs a wallet confirmation.
3. Look for approvals marked unlimited, approvals to contracts you do not recognise, and approvals for tokens you no longer use.
4. Revoke them. Each revoke is a small transaction that costs gas.
5. Make it a monthly habit.

import { createPublicClient, http, parseAbi } from "viem";
import { base } from "viem/chains";

const erc20 = parseAbi([
  "function allowance(address owner, address spender) view returns (uint256)",
  "function approve(address spender, uint256 amount) returns (bool)",
]);

const client = createPublicClient({ chain: base, transport: http("https://base-rpc.publicnode.com") });

// how much may the Uniswap v3 position manager still spend of my USDC?
const left = await client.readContract({
  address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", // USDC on Base
  abi: erc20,
  functionName: "allowance",
  args: [OWNER, "0x03a520b32C04BF3bEEf7BEb72E919cf822Ed34f1"],
});

// to revoke, ask your wallet to send approve(spender, 0)
// walletClient.writeContract({ address: USDC, abi: erc20, functionName: "approve", args: [SPENDER, 0n] })

Reading transactions before you sign

Every wallet prompt deserves five seconds of attention. Run this check each time:

• Network: is it the one I meant (name and logo)?
• Request type: is this an approval, a transaction, or a signature?
• Spender or “to” address: does it match what the app showed me?
• Amount: is it the exact amount I expect, not “unlimited” or “max”?
• Value: how much native coin is attached, if any?
• Does the app's summary match what the wallet shows?

• If a prompt says unlimited and you did not expect it, reject it.
• Reject signature requests you cannot read. Opaque hex that you cannot verify is how many wallets get drained.
• With a hardware wallet, verify the details on the device screen, not only on the computer.
• Gas looks wildly high? Stop and ask why before confirming.

Tokens and pools: what to trust

Fake and look-alike tokens

Anyone can create a token with any name, symbol and logo. A look-alike of a popular token is cheap to make, and its pool can show a convincing price. Trust the contract address, not the name.

1. Copy the token address from the project's official website or documentation.
2. Open it on the network's block explorer and check the symbol, the number of holders and how old it is.
3. Paste it into Look up any pair and see which pools exist and how much value sits in them.

Red flags in a pool

MEV, slippage and front-running

When your transaction waits to be included in a block, other people can see it. Bots may insert their own transactions around yours to profit from the price your transaction moves. A typical version is the sandwich: a bot buys before you, you trade at a worse price, and the bot sells right after.

• Keep slippage tight. The slippage setting is the worst price you will accept. 0.5% is a sensible default for liquid pairs; use 0.1% for stablecoin pairs. A high value invites a sandwich.
• Use smaller amounts when learning. The cost of a bad outcome shrinks with the size.
• Consider a protected RPC. Services such as Flashbots Protect and MEV Blocker let you send transactions privately so bots cannot see them first. You set them in your wallet's network settings. Self-Quantum Liquidity does not choose your RPC for you.
• Adding liquidity is less exposed than swapping, but the price you add at still matters: the amounts you deposit depend on the pool price at the moment of execution.
• The deadline helps. Self-Quantum Liquidity sets a 20 minute deadline so a stuck transaction cannot execute at a stale price hours later.

Phishing and social engineering

It is impossible to stop scammers completely, but knowing their patterns makes them far less effective.

Smart contract and protocol risk

Uniswap's core contracts are widely used and, in v3, non-upgradeable, which removes one risk (an admin changing the rules). It does not remove all risk:

• No code is guaranteed bug-free, including well-audited code.
• The token you provide has its own contract, which can be malicious or buggy regardless of Uniswap.
• Hooks (v4) are extra code that a pool can run, written by third parties.
• The network matters. Layer-2 networks add their own risks (sequencers, bridges) and newer networks have had less time to be battle-tested.
• This interface is new and unaudited. Its create flow has been tested on a local fork, not with large sums on mainnet. Treat it as beta.

To reduce the risk, prefer deep, long-lived pools of well-known tokens, keep amounts you can afford to lose, and verify contract addresses on the Networks & contracts page against the official sources.

Launching a pool for a token

If you use the token tab to create a pool, you are taking a different kind of risk than when you join an existing pool.

• You set the price. Anyone can trade against it as soon as the pool exists. If it is too low, bots buy your tokens cheaply within moments, and nothing can undo that.
• Start with a small amount and add more once the pool trades normally.
• Verify the token contract on the explorer. Know the supply, the holders and whether the owner can mint or pause.
• Check the pool after launch on the explorer: tokens, fee tier and price.
• The position NFT controls the liquidity. Keep it in a wallet you control, and think carefully before locking or transferring it.

Safe habits while you hold a position

• Keep some native coin for gas on each network you use, so you can always act (adjust, withdraw, revoke).
• Know your position's NFT number. The position is the NFT: write it down.
• Never approve your position NFT to a marketplace or site you do not fully trust. Whoever controls it controls the liquidity.
• Check on it on a schedule you can keep: a weekly look for a wide range, daily for a tight one. See a monitoring routine.
• Avoid public Wi-Fi and shared computers for anything involving your wallet.
• Review approvals monthly and after any session with a new tool.

If something goes wrong

If you think you have signed something malicious or your wallet may be compromised, act calmly and in this order. Speed matters, but panic causes second mistakes.

1. Stop. Do not sign anything else and do not follow instructions from anyone offering to "help".
2. Use a clean device if you suspect malware. Do not enter your phrase on any website.
3. If only an approval was the problem, revoke it immediately from a wallet that is still safe. Check the approvals of that address and revoke anything suspicious.
4. If the keys may be exposed, create a brand-new wallet with a new recovery phrase and move what you can to it, most valuable first. Attackers often watch compromised wallets with bots, so be quick, and keep native coin available for gas.
5. Withdraw liquidity positions from the compromised wallet if the NFT is still yours, then move the tokens.
6. Tell the platforms involved (exchanges, the app, your wallet provider) so they can warn others, and report phishing sites to your browser and hosting provider.
7. Never pay anyone who promises to recover your funds. They are a second scam.
8. Learn from it. Work out how it happened and fix that link in the chain.

The one-page checklist

Before you start

• I opened Self-Quantum Liquidity from my own bookmark.
• I am using a wallet that holds only what I will risk, ideally with a hardware wallet.
• I verified the token addresses and the pool on the explorer.
• I chose a range and a size I can explain and afford.

While you confirm

• The wallet is on the right network.
• Each approval is for the exact amount shown in the app.
• The spender matches the Uniswap position manager in the summary.
• Slippage is 0.5% or lower for liquid pairs.
• I read every wallet prompt, and I would reject anything unexpected.

After

• I revoked any leftover approval.
• I noted my position's NFT number and the date.
• I set a reminder to check the position.
• I will review all approvals next month.

More: FAQ & troubleshooting · sources. Terms used here are explained in the glossary. A table of what each status means is in Using the app. Stay skeptical

These docs are educational. They are not financial, legal or tax advice. Providing liquidity carries risk, including loss of funds. Self-Quantum Liquidity is new software and has not been audited.