Security
What the app can and cannot access
Yielna holds no keys and never takes custody of funds. This page explains what that means in practice and where the remaining risks lie.
What the app never accesses
- A private key, a seed phrase, or any key material
- A signed payload, before or after it is broadcast
- Custody of your funds at any point in a deposit or a withdrawal
- The ability to move funds without a signature from your own wallet
- An order, a trade, or a position on any venue
What the app stores
- Your wallet address, while you are connected
- Your watchlist, in your own browser rather than on a server
- Nothing else that identifies you
A wallet address is public information on the blockchain. It is not a credential and grants no access to funds.
Wallet connection
Wallet connections are handled by Privy, an established wallet infrastructure provider used widely across the industry. The connection dialog you see is Privy's, not Yielna's.
You connect an existing wallet. Yielna does not create wallets, offer embedded wallets, or provide email or social login that would create one. The Privy integration is restricted to external wallet connectors.
A connection is only started by you, in Earn, when you choose to deposit or withdraw. It is never requested when the app loads or on any other page.
Disconnecting clears the session completely; reloading the page afterwards does not reconnect your wallet.
Transaction signing
No transaction is prepared until you have reviewed a quote. The full list of transactions is then shown before anything is sent, including what each one does, which contract it interacts with, and how many signatures are required: two on a layer-2 network, four on Ethereum.
Transactions are sent one at a time, so each signature request matches a step shown on screen. Rejecting a transaction stops the sequence. Confirmed steps remain confirmed, and nothing further is sent without your approval.
All signatures are produced in your wallet. The app receives only the transaction hash and never handles, logs or transmits the signed payload.
Token approvals are included in the list. Each is granted only to the contract that requires it, for the step that requires it, and is shown before you sign.
Where your funds are held
In your wallet and Sky's contracts, never with Yielna or in an account Yielna controls. A deposit moves from your address into Sky's contracts, and the resulting sUSDS is held at your address.
If Yielna shut down, you would still hold your position and could redeem it through Sky or any other compatible interface. Your funds do not depend on Yielna.
Market data connection
Market data is provided through a single read-only connection owned by Yielna. There is no per-user login or authorisation, and the app cannot act on your behalf on Liquid.
The credential itself is read-only. The app has no trading functionality, and requests to open a trade or position are declined.
All users see the same market data, and no portfolio, position or balance is accessible through the connection.
Third-party risks
Smart contract risk. Deposits are held in Sky's contracts. A flaw in those contracts would affect funds regardless of the interface used.
Rate risk. The Sky Savings Rate is set by Sky and can change. The projected annual figure in the app is based on the current rate and is not a commitment.
Peg risk. Stablecoins can lose their peg. USDC, USDS and sUSDS each depend on their issuers.
Routing and bridge risk. A cross-chain deposit or withdrawal uses Osero's routing and, where required, a bridge. These are third-party systems with their own risks.
Data risk. Pool data comes from DeFiLlama and market data from Liquid. Yielna displays it as provided, including any errors in the source.
In the event of a compromise
Non-custodial does not mean risk-free. The possible impact of a compromise is as follows.
A compromise of this website could display false information or links. It could not affect your funds, because this website never connects a wallet.
A compromise of the app could not sign transactions, since signing happens in your wallet. It could, however, request a signature for something other than what is displayed. For this reason, the app shows the full transaction list and sends each step separately. Always verify the request in your wallet before signing, on any site.
The Yielna interface has not been audited. The underlying contracts have their own audits, but the interface has had no third-party review.
Reporting a vulnerability
Please report security issues privately before disclosing them publicly, with a description and steps to reproduce.
What happens step by step during a deposit is on the Earn page; where each number comes from is in the FAQ.
Read next
Browse without a wallet
All pools and market data are available without connecting a wallet. Earn is the only section that requests one.
Open the app