Security & controls
What the protocol can do, what it cannot do, and what users should still treat as risk.
DCA Onchain is self-custodial: user funds sit in each user's own strategy account, and only the user can withdraw. The automation can trigger scheduled buys, but it cannot change a user's strategy, redirect assets, or withdraw on a user's behalf. Admins can change protocol configuration, including fees within hard on-chain caps, but they cannot take user balances from strategy accounts.
User guarantees
| Guarantee | How it works | Important limit |
|---|---|---|
| Withdraw anytime | Withdrawals live on the user strategy account and remain available even when batch execution is paused. | Withdrawing closes the strategy permanently. |
| Strategy settings stay fixed | Target asset, amount, frequency, destination wallet, yield setting, and yield adapter are locked after creation. | To change settings, withdraw and create a new strategy. |
| The executor has a narrow role | The executor can only trigger scheduled buys through the batch contract. | If automation is delayed or fails, buys can be delayed. |
| Scheduled pulls are bounded | Each strategy account only releases its configured per-period USDC amount during execution. | Underfunded accounts are skipped or paused depending on the path. |
| Failed output delivery is recoverable | If sending purchased assets to the destination wallet fails, the amount is tracked as pending and can be claimed. | The user must claim pending output manually. |
Admin powers
Protocol ownership is held by a 2-of-3 Safe on Base mainnet. Admin powers are intentionally limited to configuration and emergency controls.
| Admin can | Admin cannot |
|---|---|
| Change protocol fees within hard on-chain caps. | Withdraw funds from a user's strategy account. |
| Change the executor address. | Change an existing user's target asset, amount, frequency, destination, or yield setting. |
| Pause new strategy creation or batch execution. | Block a user from withdrawing their remaining funds. |
| Configure supported assets, swap routes, yield adapters, oracle routes, and treasury address. | Bypass the batch contract's checks during execution. |
| Recover tokens accidentally stranded in contracts that should not hold funds at rest. | Use that recovery path to pull normal user balances from strategy accounts. |
Fee changes
Protocol fees are global settings. If the owner changes a fee, the new value applies to existing strategies going forward. The contracts enforce maximums on-chain:
- Execution fee: capped at 1% of swap output.
- Yield fee: capped at 30% of positive yield earned.
- Referrer share: capped at 50% of the execution fee, never added on top.
Execution protections
During a batch, the contract checks that the submitted totals match, each account's target asset matches the batch asset, and the swap output clears an independent on-chain price floor. If these checks fail, the batch reverts instead of executing at an unsafe price or into the wrong asset.
The batch executor is designed to hold no funds after a batch finishes. User funds live in user strategy accounts, and purchased assets are forwarded to the user's destination wallet or tracked as pending if delivery fails.
Operational risks
Self-custodial does not mean risk-free. Users should understand these dependencies before depositing:
- Smart contracts can still contain bugs.
- Automation can be delayed by GitHub Actions, RPC issues, gas issues, or keeper outages.
- Oracle feeds, Uniswap, Aave, Base, and RPC providers are external dependencies.
- Admin configuration mistakes can pause execution or disable an asset until corrected.
- Market prices can move between quote and execution.
For a more detailed list of centralized dependencies and failure modes, see Trust & failures.
Security review
The contracts were reviewed before mainnet launch, and issues found during that process were resolved in source and covered by regression tests. This review reduces risk, but it is not a guarantee that the protocol is bug-free.