Keys local vs protocol risk
Non-custodial means GaurdWallet does not hold your funds on a corporate ledger. You sign transactions with keys derived from a seed phrase generated on your device. A compromised aggregator cannot “withdraw to their account” without a valid signature — but they can suggest malicious routes if you use a fake app, and smart contracts can behave badly if you approve the wrong spender.
Protocol risk includes: buggy DEX pools, bridge hacks, oracle failures, and malicious tokens that block sells. Self-custody removes exchange custody risk; it does not remove DeFi smart-contract risk. Read routes before signing.
Insurance funds and support tickets exist on custodial platforms — self-custody trades that for control. The swap safety question becomes: “Do I understand what I am signing?”
Hardware wallets and multi-sig are optional layers above software wallets. GaurdWallet users still must read approvals and network fields — better signing hardware does not fix wrong-chain bridges.
What non-custodial swapping means in Exchange v0.2.1
Exchange quotes pass through GaurdWallet proxies; execution happens on-chain from your wallet. LI.FI routes EVM swaps and EVM↔EVM bridges. Jupiter routes Solana same-chain swaps. Bitcoin, Litecoin, and TRON bridges are not in this release — do not trust any site claiming otherwise using our name.
Compare with custodial swapping: a centralized exchange matches orders in internal databases. You trust their solvency and withdrawal policies. Non-custodial swapping keeps assets in your addresses but exposes you to transaction-level mistakes — wrong network, unlimited approval, or signing blind hex.
Exact approvals and allowance risk
Many wallets default to unlimited ERC-20 approvals for convenience. GaurdWallet defaults to exact-amount approvals for the swap or bridge you are performing. That limits how much a compromised router could pull later — at the cost of an extra approve transaction next time.
Still verify the spender address in your wallet’s confirmation screen matches the router shown in Exchange. Phishing sites trick users into approving a drainer. Deep dive: ERC-20 token approvals.
After a successful swap, your allowance may return to zero with exact approvals — that is expected. Next swap triggers a fresh approve transaction, which costs gas but limits exposure.
If you ever used unlimited approvals in other wallets, revoke with reputable tools — GaurdWallet cannot retroactively fix allowances you granted elsewhere.
Phishing and fake Exchange sites
Attackers clone wallet UIs and ask for seed phrases “to connect Exchange.” Real GaurdWallet unlock happens locally; we do not ask for seeds on blog pages, Discord DMs, or support tickets. Bookmark https://gaurdwallet.com/app/#/exchange and verify the domain.
Phishing also uses fake token lists and typosquat domains. If a swap promises impossible returns, it is not an aggregator feature — it is social engineering.
Browser bookmarks should use HTTPS and the exact domain. Search ads sometimes promote lookalike wallets with one letter changed.
Malware and browser extensions
Clipboard hijackers replace recipient addresses. Screen scrapers capture seed backups. Extension wallets share the same threat model as GaurdWallet’s browser build — see are browser extension wallets safe? Keep OS patches current; do not store seeds in cloud notes.
Separate browser profiles for DeFi vs general browsing reduces extension cross-talk. Treat swap sessions like online banking — one focused window, no random downloads running in the background.
Unaudited wallet honesty
GaurdWallet is independent, provided as-is, and not audited to the standard of large custodial exchanges. We integrate mature aggregators, but integration bugs are possible. Start with small test amounts on networks you understand. Report issues to [email protected].
Non-custodial honesty also means we do not promise “100% safe swaps.” We promise: keys stay local, quotes come from named third parties, and you see what you sign when the UI can decode it.
Compare open-source claims realistically: read the license and threat model rather than marketing badges. Security is process plus user behavior, not a single audit PDF.
Never share your seed phrase
No legitimate swap support flow requires your twelve or twenty-four words. Anyone asking — chat bot, “validator,” “bridge support” — is stealing. Recovery phrase compromise bypasses every approval safeguard because they can sign anything.
If you suspect exposure, migrate funds to a new seed in a clean environment; revoking approvals is not enough once keys leak.
Photos of seed cards, cloud backups, and password-manager notes synced online are all failure modes. Paper and metal beats convenience for savings you cannot afford to lose.
Pre-sign checklist
- Domain is gaurdwallet.com; path is
/app/#/exchange. - From/To networks and token symbols match intent.
- Minimum received aligns with slippage; refresh if quote expired.
- Route tools are recognizable; bridge waits do not get duplicated.
- Approval amount is exact, not unlimited, unless you consciously chose otherwise elsewhere.
When teaching someone their first swap, walk through this list aloud — muscle memory beats reading blogs mid-transaction.
Bridge-specific steps: bridge security checklist.
Smart contracts you are trusting
Each swap or bridge signs calls to contracts you may never read. Aggregators reduce how many you pick manually, but the route still names them. Unknown router addresses on Etherscan with no history deserve skepticism. Prefer well-known tools surfaced consistently in LI.FI or Jupiter graphs.
GaurdWallet surfaces route tool names when the API provides them — use that string as a starting point for research, not proof of safety.
Wrong-network sends vs swapping
Non-custodial safety does not stop you from bridging to a network your recipient does not accept. Double-check destination chain IDs in the confirmation screen. Wrong-network losses are user mistakes, not custodial theft — still irreversible.
Simulation and decoding
Before signing, read what the wallet can show: spender, amount, and contract target. GaurdWallet aims to surface human-readable fields when decoders exist. Unknown contracts are a yellow flag — slow down and compare against a fresh quote from Exchange.
Simulation does not predict future bridge completion — only the immediate transaction you are about to send.
If something feels wrong after signing
Collect transaction hashes from block explorers. Revoke suspicious ERC-20 approvals if a malicious spender received allowance. Move remaining funds to a fresh seed only if you believe keys compromised — not for ordinary failed swaps.
GaurdWallet cannot reverse on-chain transactions. Aggregator support channels may help trace bridge status, but they cannot override your signature.
Keep a personal policy: first bridge on a new chain uses minimum size until you trust the status UI and timing.
FAQ
Is LI.FI custody? No — it routes; you sign.
Are Solana swaps safer than EVM? Different attack surface, not strictly safer.
Does non-custodial mean no KYC? Wallet creation has no KYC; on-ramps you use separately might.
Should I use a hardware wallet? Optional extra layer for signing; GaurdWallet web/extension still requires you to verify what you approve on screen.
Are testnet swaps “safe practice”? Good for flow, but testnet tokens have no value — mainnet habits (checking networks) still matter.
Who is liable if a bridge gets hacked? On-chain participants bear losses per protocol terms; GaurdWallet does not insure third-party routes.