Security

Last updated: 11 November 2026

KemLock is a self-custody wallet for Base, Ethereum and Arbitrum One, with a post-quantum private balance on Base and Ethereum, built by Kotav Labs. It is beta software and it has not had an independent security audit yet. The pools are capped.

If you find a security problem, please tell us privately before you tell anyone else. This page says how, what we do with your report, and what you may test.

How to report

• Write to security@kemlock.com.
• Do not report a security problem in public: not on Discord, not on X, not anywhere else.
• We have no encrypted channel. If your report holds a working attack on users' funds, first send a short message that says only which part is affected and how serious you think it is. We will agree with you how to send the rest.
• You may write in English or Portuguese.

What to include

• The part affected (web wallet, Chrome extension, Android app, relayer or pool contract), the network (Base, Ethereum or Arbitrum One), and the version or the date and time of your test.
• What an attacker gains, and what they need to start with.
• Steps to reproduce, as short as they can be. A proof of concept helps, such as a script or a test against a local fork of the network.
• The transaction hashes and addresses you used, so that we can tell your test from an attack.
• How you would like to be credited, or that you prefer not to be.

Please never send a recovery phrase, a password or a private key, yours or anyone's. We never ask for them.

What we do

• We confirm that we received your report within 3 business days.
• Within 10 business days we tell you whether we could reproduce it and how serious we think it is.
• We keep you informed while we work on a fix. When we do not consider something a security problem, we say so plainly, and why.
• Coordinated disclosure: please keep the details private until the fix is deployed, and for at most 90 days from your report unless we agree otherwise.
• If you want, we credit you by the name you choose when we publish the fix.
• There is no bug bounty today.

In scope

Web wallet

kemlock.com: the wallet at /app, the private area at /private, and the paths it serves on the same origin

Chrome extension

KemLock in the Chrome Web Store, the current version

Android app

KemLock Wallet on Google Play, the current version

Relayers

relayer.kemlock.com (Base) and relayer-eth.kemlock.com (Ethereum)

Pool contract on Base

0x3D9445719Cc49614D3F88073a1F267289D4d5Ad1, with the verifier and swap adapter it uses

Pool contract on Ethereum

0x2AE274a743453561960b2612C127d071aC7A634e, with the verifier and swap adapter it uses

Examples of what we want to hear about:

• loss or freezing of funds held by a pool contract, or a proof accepted that should not be;
• theft of a recovery phrase or of signing authority from the wallet, the extension or the app;
• the wallet signing something other than what its review showed;
• a way to drain a relayer or make it pay for other people's transactions;
• a way to link a user's private notes to each other or to their public address, beyond what the product says is public;
• a site or app that reads an account, or gets a signature, without the user's approval;
• a way to read a wallet's cloud copy without its password or its account.

Out of scope

• Other people's software and services: LI.FI, Uniswap, WalletConnect, Google, Apple, the RPC providers, the block explorers, the stores. Tell their owners. A problem in how KemLock uses them is in scope.
• Attacks that need a device that is already compromised (malware, a hostile browser extension with access to every page, a rooted phone), or physical access to an unlocked wallet beyond what the wallet says it protects.
• Social engineering of users or of Kotav Labs, and phishing sites that only copy our look.
• Denial of service by volume, and any test that slows down a relayer or the site for other users. A design flaw that lets one cheap request block everyone is in scope: describe it, do not run it.
• Output of automated scanners, and missing headers or best practices, with no shown effect.
• Anything on kotavlabs.com or other Kotav Labs systems that the wallet does not use.
• The price of a swap, the size of a fee or the choice of a route, unless the wallet showed something other than what it signed.

Rules for testing

• Use your own wallets and small amounts of your own. Prefer a local fork of the network.
• Never access, move, freeze or reveal funds or data that are not yours. If you reach them by accident, stop and tell us.
• Do not run an attack on the live service that could cost other users money or privacy, even to prove it works. Describe it instead.
• Do not keep data you did not need, and delete what you kept once the case is closed.

Contact

• Security reports: security@kemlock.com
• Everything else: support@kemlock.com
• kemlock.com · X · Discord

Nobody from KemLock will ask for your recovery phrase, your password or a payment to handle a report.

This page is also published as security.txt.