Skip to main content

How Your Funds Are Protected

A comprehensive overview of all security measures protecting your assets in LazaiTrader.

Security Layers​

LazaiTrader implements multiple layers of security:

┌─────────────────────────────────────────────────────────────────┐
│                     Layer 5: User Controls                       │
│              (Your registered wallet, your keys)                 │
├─────────────────────────────────────────────────────────────────┤
│                     Layer 4: Telegram Security                   │
│           (2FA, session management, account security)            │
├─────────────────────────────────────────────────────────────────┤
│                     Layer 3: Bot Permissions                     │
│              (Limited to trades, can't redirect)                 │
├─────────────────────────────────────────────────────────────────┤
│                     Layer 2: DEX Whitelist                       │
│              (Only approved exchanges allowed)                   │
├─────────────────────────────────────────────────────────────────┤
│                     Layer 1: Smart Contract                      │
│         (Immutable rules, owner-only withdrawals)                │
└─────────────────────────────────────────────────────────────────┘

Layer 1: Smart Contract Security​

Immutable Owner​

Your EOA is set as the owner at deployment and cannot be changed:

address public immutable owner;  // Your wallet, forever

Withdrawal Restrictions​

All withdrawals go to the owner:

function withdrawAllTokens(address _token) external {
    IERC20(_token).safeTransfer(owner, balance);
    // owner = always your registered wallet
}

Reentrancy Protection​

Prevents attack patterns that drain funds:

contract LazaiTradingWallet is ReentrancyGuard {
    function executeTrade(...) external nonReentrant {
        // Protected from reentrancy attacks
    }
}

Layer 2: DEX Whitelist​

Centralized Control​

Only factory-approved DEXs can be called:

modifier onlyWhitelistedDEX(address dex) {
    require(factory.isDEXWhitelisted(dex), "DEX not whitelisted");
    _;
}

Benefits​

ThreatProtection
Malicious contractsBlocked
Fake DEXsBlocked
Phishing attemptsBlocked

Layer 3: Bot Permission Limits​

What the Bot Can Do​

PermissionDetails
Execute tradesOnly on whitelisted DEXs
Approve tokensOnly for whitelisted DEXs
Initiate withdrawalsOnly to your EOA
Read balancesFor calculations

What the Bot Cannot Do​

RestrictionEnforcement
Withdraw to other addressesSmart contract prevents
Trade on arbitrary contractsWhitelist prevents
Change ownerImmutable variable
Modify whitelistNot authorized

Layer 4: Telegram Security​

Account Protection​

  • Enable 2FA on your Telegram account
  • Use strong password
  • Be aware of phishing

What If Telegram Is Compromised?​

Even with full Telegram access, an attacker:

Can DoCannot Do
View your balancesWithdraw to different address
Delete strategiesAccess your EOA
See trade historyChange registered wallet
Try to withdrawRedirect funds
tip

Key Point: Withdrawals still go to YOUR registered wallet, even if someone else initiates them.

Layer 5: Your Responsibilities​

Protect Your Registered Wallet​

ActionWhy
Backup seed phraseRecovery if device lost
Use hardware walletEnhanced security
Never share private keyOnly you should have it
Verify addressesBefore depositing

Monitor Your Account​

CheckFrequency
BalanceDaily/Weekly
Trade historyWeekly
Unknown transactionsInvestigate immediately

Attack Scenarios & Protections​

Scenario 1: Bot Server Compromised​

Attack: Hacker gains access to LazaiTrader servers.

Protection:

  • Cannot change withdrawal addresses (immutable)
  • Cannot bypass DEX whitelist (contract-enforced)
  • Can only execute trades within normal parameters

Your funds: Safe in SCW, withdrawable to your EOA

Scenario 2: Your Telegram Hacked​

Attack: Someone accesses your Telegram account.

Protection:

  • Withdrawals only go to your registered wallet
  • They'd need your EOA private key to actually receive funds

Your funds: Sent to YOUR wallet, not theirs

Scenario 3: Malicious DEX Added​

Attack: A bad DEX gets whitelisted.

Protection:

  • Rigorous vetting process
  • Quick removal if issues detected
  • Your SCW funds stay in SCW until traded

Your funds: Only at risk during active trades on that DEX

Scenario 4: Smart Contract Bug​

Attack: Vulnerability in SCW contract.

Protection:

  • Standard OpenZeppelin libraries
  • Simple, auditable code
  • No upgradability (less attack surface)

Your funds: Risk depends on bug severity

Emergency Recovery​

If LazaiTrader Goes Offline​

Your funds are still accessible:

  1. Your SCW address - Known and deterministic
  2. Your EOA - Has withdrawal permission
  3. Direct contract call - Bypass the bot entirely

How to Withdraw Directly​

Using any Web3 wallet or block explorer:

  1. Connect your registered wallet
  2. Go to your SCW on block explorer
  3. Call withdrawAllTokens(tokenAddress)
  4. Funds sent to your connected wallet

Required Information​

ItemHow to Find
SCW addressPrevious bot messages, or calculate from EOA
Token addressesBlock explorer, documentation
Your EOAYour wallet

Security Checklist​

Before You Start​

  • Secure Telegram with 2FA
  • Have seed phrase backup for registered wallet
  • Verify you control the wallet address
  • Start with small test deposit

Ongoing​

  • Check balances regularly
  • Review trade notifications
  • Keep Telegram account secure
  • Report suspicious activity

If Something Seems Wrong​

  • Check transaction history on block explorer
  • Verify your wallet is still the owner
  • Contact support with details
  • Consider emergency withdrawal

Trust Summary​

ComponentYou TrustWe Ensure
Smart contractCode is correctUse standard libraries, simple logic
DEX whitelistOnly safe DEXsRigorous vetting
Bot operationNormal behaviorLimited permissions
InfrastructureAvailabilityRedundant systems
Your walletYou control itWe can't access it
tip

Bottom Line: Your funds are as safe as your personal wallet security. LazaiTrader cannot steal your funds - the smart contract makes it impossible.

Further Reading​