Security at a glance
This is the short version. The longer pages are linked at the bottom.
How your collateral is protected
Section titled “How your collateral is protected”Helva offers non-custodial collateral management. You deposit into your own Anvil vault. Helva does not hold the coins.
A Letter of Credit caps what can be converted. Only enough collateral to produce the defined credit amount is converted. Unused collateral returns to you in the same transaction, in the original asset.
The vault and the Letter of Credit run on Anvil, a third-party protocol, audited by OpenZeppelin and Trail of Bits. See The Anvil protocol. That audit statement is about Anvil, not a claim that Helva itself is audited.
Fiat clearing and credit-asset settlement are separate custodial services. The coins stay in your vault.
How Helva secures its own operations
Section titled “How Helva secures its own operations”The Letter of Credit names a beneficiary. That beneficiary is a dedicated on-chain contract, Anvil’s LOCBeneficiary, operated by Helva.
The contract’s roles are narrow. Routine redemption cannot choose where the funds go. Redemptions can only land in Helva’s own Safe. The contract enforces that destination.
Policy changes, upgrades, and any movement of funds out of that Safe require two people. Those actions go through a Safe multisig. The admin Safe is 2-of-3. The redemption Safe, which receives redemptions, is 2-of-2 for funds leaving it.
All of those keys are on hardware wallets, generated on the device. The three wallets involved in administration and recovery (the 2-of-3 admin Safe’s keys) are backed up in three different locations in Switzerland.
Details, including what a single operator can and cannot do, are on Operational security.
What you should verify
Section titled “What you should verify”Before you approve a token, deposit, sign an allowance, or create a Letter of Credit, compare the wallet prompt with the published addresses and with your loan contract. The checklist is Verify your transactions.
That page is hosted separately from the app. If the app were compromised, it could show a wrong address. Use the list there as a second source.
Trust assumptions that remain
Section titled “Trust assumptions that remain”These are real. Design does not remove them.
- Anvil. Anvil’s owner can change the price oracle and the contracts. Helva does not control Anvil. Helva monitors those changes. See Risks & mitigations.
- Pyth. Letter of Credit prices come from the Pyth oracle. A stale price can delay a redemption until a fresh update is supplied.
- The beneficiary contract is upgradeable. Only the 2-of-3 admin Safe can upgrade it. The published address does not change. Upgrades are monitored and announced below.
The lender guarantee is bounded. It is not unlimited coverage. See Risks & mitigations.
Changes are announced
Section titled “Changes are announced”The published beneficiary address never changes. If Helva changes an owner or a role on that contract, the change is announced in the changelog on this page.
Changelog
Section titled “Changelog”No changes since launch.