Security Best Practices#
Most of Ava's safety is built into the design. This page is the operator-side checklist — the handful of habits that matter.
The 6-line checklist#
- Verify the bot. The official Ava Guardian handle is the one linked from
avaprotocol.org. Don't trust a bot found via search — search results are easy to spoof. When in doubt, start from the website.
- Read the permission before you sign it. When you turn on Auto mode, the permission card shows what it covers, any spending limit, and when it expires. The standard permission has no spending limit and lasts 365 days; it should match what Ava said in chat.
- Fund only what Auto needs. Auto can only use what's in your Ava smart wallet, so that balance is your ceiling. Keep it to what you're comfortable letting Auto use. If you want tighter control, turn off the standard permission on Wallets and choose narrower permissions with a spending limit on the token you choose and a shorter expiry. Neither caps losses on your DeFi positions.
- Read before you sign, don't autopilot it. In Manual mode, each signature is a decision. Check the amount and what the transaction does before you sign.
- Stop Auto mode if anything feels wrong. Turn off its permissions and pause its jobs, then withdraw what's free in your Ava smart wallet; investigate afterward.
- Never sign a wallet upgrade for Ava. Ava doesn't upgrade your existing wallet today — Auto runs from a separate Ava smart wallet. An EIP-7702 upgrade to an unknown contract is a known way to get drained, so treat any link or DM asking you to "upgrade your wallet for Ava" as a scam.
What Ava will never ask for#
- A seed phrase or private key.
- Your wallet password.
- A signature in your wallet that you didn't initiate from a known surface (Telegram chat or
app.avaprotocol.org).
- An "emergency" deposit to "secure" your funds.
- Anything urgent that requires you to act in the next 60 seconds without verifying.
If someone in Telegram (DMing you, posing as "Ava support", impersonating a team member) asks for any of the above: it isn't us. Block, report, and don't act. Real support never operates via DM and never asks for keys.
How to verify a transaction Ava proposes#
Before tapping confirm:
- The
to: address is the protocol contract you expect (e.g. the Aave Pool). If your wallet shows an address you don't recognize, refuse.
- The amount matches what the chat said ("supplying 300 USDC").
- The action matches what you asked for: a repay should read as a repay, not a borrow or a withdraw.
If the in-chat numbers and the on-chain transaction look out of sync, refuse. Ask Ava for the transaction hash and explorer link, and verify yourself.
Multi-wallet hygiene#
- Don't use a single wallet for everything. Ava works fine with a dedicated "DeFi positions" wallet that's separate from your main holding wallet — and that's a better setup for blast radius if anything goes wrong anywhere.
- Cold storage stays cold. Don't upgrade a wallet you treat as cold storage, or use it to fund Auto. Fund your Ava smart wallet with only what you'd be okay actively managing.
Phishing patterns to watch for#
- Fake Telegram bots with similar handles. The real one is linked from this site.
- Fake "Ava Studio" sites with one-letter-off domains. The real one is
app.avaprotocol.org. Bookmark it.
- Fake support DMs. Ava team members do not DM you first about your wallet.
- Fake "claim your airdrop" prompts. Ava does not airdrop tokens.
When in doubt#
Stop. If the doubt involves Auto mode, turn off your Ava smart wallet's permissions, then withdraw what's free in it. Then verify slowly. Time pressure is the #1 lever scammers use; the design of Ava — Auto only ever uses what you funded, under a permission you signed, enforced on-chain — gives you the luxury of taking your time.