Skip to main content
This page describes how control is distributed between you and Ground when using Portfolio Wallets.

​
Independent security review

Ground has completed three independent Quantstamp reviews covering its EVM and Solana contracts, USTB vault upgrade, and Centrifuge JAAA vault and Aave adapter. Ground publishes the original EVM and Solana report and sanitized, Ground-authored public summaries of the two later reviews.

EVM and Solana Contracts

Review period: Apr 6, 2026 - Apr 17, 2026. Final report: Jun 23, 2026.

USTB Vault Upgrade - Public Summary

Ground-authored summary. Review period: Jun 18, 2026 - Jun 19, 2026. Findings: 4 fixed, 1 acknowledged.

Centrifuge JAAA Vault and Aave Adapter - Public Summary

Ground-authored summary. Review date: Jul 3, 2026. Findings: 2 fixed, 1 mitigated.
Security reviews are point-in-time assessments. The two public summaries intentionally omit sensitive implementation and operational details. They are prepared and published by Ground, are not original Quantstamp reports, and apply only to the scope and review dates stated in each summary.
See Contract Addresses for current production deployment references.

​
Key custody model

  • Deposit addresses are provisioned and managed by Ground.
  • Withdrawals may require customer approval, depending on the organization’s approval policy.
  • Strategy updates are API-authenticated requests. They save target allocations immediately; later rebalance execution is Ground-signed under policy.
  • Each customer organization has a dedicated custody sub-organization used for wallet signing policy and approvals.

​
Wallet type per chain

Ground provides chain-native deposit addresses per supported chain. Treat them as standard addresses for funding and withdrawals. The exact address format follows the chain (for example, EVM vs Solana).

​
Address uniqueness and reuse

  • Each wallet receives dedicated deposit addresses per chain.
  • Addresses are not reused across customers.
  • If you see the same EVM address across multiple EVM chains for a single wallet, that is expected and still scoped to that wallet.

​
What this means for your integration

  • Always send funds to the deposit address returned for the specific wallet and chain.
  • Never reuse deposit addresses across wallets.
  • Rely on the API or webhooks to reconcile balances and allocations.