What we touch, and what we never touch

The connection itself is handled by Privy, not by Yielna. Privy is an established wallet infrastructure company used widely across this industry, and the connection dialogue you see is theirs. This is worth stating plainly: being asked to connect a wallet by a site you have just met is exactly the shape of a scam, and the honest answer to that suspicion is naming who is actually handling it.

You connect a wallet you already own. Yielna does not create one for you, does not offer an embedded wallet, and has no email or social login that would produce a wallet as a side effect. Privy supports both of those products; Yielna deliberately uses neither, and the integration is restricted to external wallet connectors so the option is not there to switch on by accident.

The connection is only ever started by you, inside Earn, after you have chosen to deposit or withdraw. It does not happen when the app loads and it does not happen on any other page. If you have never opened Earn, the app has never asked your wallet for anything.

Disconnecting is real. It clears the session rather than hiding the UI, so reloading the page afterwards leaves you disconnected.

Nothing is built until you have seen a quote. Once you continue, the deposit becomes a concrete list of transactions, and that list is shown in full before anything is sent: what each transaction does, which contract it touches, and how many signatures to expect. Two on an L2, four on Ethereum.

Each one is then sent on its own, so the signature request in your wallet always corresponds to a step you can see on screen. Rejecting one stops the sequence there. Anything already confirmed stays confirmed, and nothing further is sent without you.

Every signature is produced inside your wallet. The app receives a transaction hash back and nothing else. It never handles the signed payload, and it does not log or transmit one.

Token approvals are part of that visible list. They are granted to the specific contract that needs them, for the step that needs them, and you see the approval before you sign it.

The market intelligence layer runs over one read-only connection that belongs to Yielna, not to you. There is no per-user login, nothing to authorise, and no way for the app to act on your behalf on that venue.

Read-only is a property of the credential, not a promise about the UI. There is no order path in the app, and a request to open a trade or a position is refused outright rather than being unavailable in one place and possible in another.

Because there is a single shared connection, every visitor sees the same market figures, and no portfolio, position or balance belonging to anyone is reachable through it.

Smart contract risk. Your deposit sits in Sky's contracts. A flaw there affects your funds regardless of which interface you used to reach them.

Rate risk. The Sky Savings Rate is set by Sky and can change. The projected annual figure in the app is arithmetic on today's rate, not a commitment.

Peg risk. A stablecoin is stable until it is not. USDC, USDS and sUSDS all carry the assumptions of their issuers.

Routing and bridge risk. A cross-chain deposit or withdrawal passes through Osero's routing and, where required, a bridge. Those are third-party systems with their own failure modes.

Data risk. Pool figures come from DeFiLlama and market figures from Liquid. Yielna presents them faithfully, which also means it inherits whatever they get wrong.

If you find a security problem, please report it before disclosing it publicly. A description and the steps to reproduce it are more useful than anything else.

For how the pieces fit together, the mechanics page covers where each number comes from and what happens step by step during a deposit.