Safety
Short answer: Stray cannot take your funds. A scan only reads. A claim is a transaction your own wallet sends, limited by checks that run on-chain and in your browser. Here is each of them, in enough detail to check for yourself.
The scan only reads
A scan needs your public address and nothing else. It reads public chain data. There is no wallet connection, no signature and no permission involved, which is why you can scan any address, including ones you do not own.
The claim runs from your wallet
Claims are transactions your own wallet sends. We prepare the list of calls; your wallet shows them, and nothing happens unless you sign. Every call is labeled in plain language, for example "Collect fees from Uniswap V3 #48211" or "Service fee 0.0171 ETH".
One atomic batch
The calls for each chain go into a single atomic batch (EIP-5792). If any step fails or returns less than its minimum, everything reverts. Claims are only offered to wallets that can send the batch as one transaction; there is no step-by-step fallback in which a later failure could leave an earlier step done.
BalanceGuard: the on-chain check
Every batch is wrapped by a small contract called BalanceGuard:
- Before the claims, it records your wallet's balance of what you are about to receive.
- After the claims and any sales, it compares. If your balance did not rise by at least the amount the simulation proved, it reverts, and the whole batch reverts with it.
- Only then does the fee transfer run.
This means the fee can only ever be paid in a transaction in which the money really arrived, in that same transaction. The guard holds no funds; it only reads balances and reverts.
Only known contracts can be called
A claim plan may call two kinds of contract and no others:
- Claim targets: the protocol contracts registered for each kind of finding, such as a position manager or a fee locker.
- Swap routers on a fixed allowlist, used only when you choose to convert tokens, each swap with a minimum output.
Your browser checks every plan against the same lists before your wallet is asked to sign. A plan that calls anything else, pays the fee to any address but ours, or charges anything other than 5% is refused in the browser, before it reaches your wallet.
No approvals to us
We never ask you to approve tokens to our contracts. When you choose to sell a token, the approval goes to the swap router for that sale. When the transaction is done, Stray holds no permission over anything in your wallet.
Re-simulated right before you sign
The full batch is simulated again at the latest block before it is sent to your wallet. If amounts changed, the plan changes with them. If a finding stopped being claimable, it drops out.
What we will never do
- Ask for a seed phrase or private key
- Not in the app, not in support, not by email. Anyone who does is not us.
- Ask you to sign a permission
- No Permit, Permit2 or setApprovalForAll signatures. The only message you sign is a free sign-in.
- Contact you first
- We do not send DMs offering recovery. Offers that arrive unasked are scams.
- Hold your funds
- Claims go from the protocol to your wallet. Nothing passes through an account of ours.
If your wallet is compromised
If someone else controls your keys, they can claim faster than you. Do not use Stray from a compromised wallet; move what you can to a fresh wallet first and contact support.
Checking it yourself
- Open any call in your wallet before you sign: the target is the protocol's contract or the guard, never an unknown address.
- Read the batch on a block explorer afterwards: the guard's check sits between the claims and the fee.
- Scan first, claim later. Nothing about scanning commits you to anything.