Security

guap converts USDC into a Nigerian bank payout. It never holds your funds and it cannot move them without a transaction you sign. Here is exactly what it can do, and how to check.

We never ask for a recovery phrase

There is no field for one anywhere, and never will be. Nobody legitimate will ever ask you for a seed phrase, a private key or a password to your wallet. If any site claiming to be us does, it is not us.

Approvals are for one exact amount

Paying from Base needs a token approval before the transfer. Ours is for the exact amount of that single payout and nothing more:

approve(
  spender   0xccc88a9d…c315be   Relay router
  allowance 10040000            10.04 USDC, not unlimited
)

Check it in your wallet before signing. An unlimited approval reads as a very large number or as Unlimited; ours shows the figure on screen. Granting no standing permission is the point.

You only ever sign transactions

No signature request, no message signing, nothing to approve except the two transactions that make the payment: the approval above, and the transfer itself. If something asks you to sign an opaque message on our behalf, it is not us.

The contracts involved

We deploy nothing and own nothing. Every transaction calls public contracts belonging to other people:

• 0x8335…02913 is USDC on Base, issued by Circle
• 0xccc8…c315be is the Relay router, which does the conversion

There is no upgradeable contract we control and no address in the path that can change after you sign.

Where your money goes

From your wallet, to the router, to a single-use deposit address issued by our settlement provider, to your bank. We are not a step in that path and never hold the funds.

One exception, and it is in our terms too: if a bank rejects a payout, the refund can only be sent to an address on Base. If you paid from a chain that cannot receive it, that refund reaches an address we control and we return it by hand.

Reporting something

If you find a vulnerability, or a site impersonating this one, message @dxFareed on Telegram. We would rather hear it early and awkwardly than late.