Mo'Stash is non-custodial by design. We never have server-side access to your funds, and your private keys never leave your device.
Private keys are stored with expo-secure-store — Keychain on iOS, Keystore on Android. They are never transmitted or backed up to our servers.
Mo'Stash has zero custodial access. Every transaction is signed locally on your phone. We literally cannot move your assets.
We only integrate independently audited protocols — Aave, Lido, Morpho — and document every third-party contract we touch.
A public bug bounty rewards researchers who find and report vulnerabilities. Disclosure policy published below.
Published on Immunefi at launch. Rewards scale with severity.
Private key leak or remote fund extraction.
Funds accessible by a third party.
Sensitive user data exposed.
Public security page + full key-storage documentation.
Immunefi bug bounty live + wallet-core open sourced on GitHub.
First third-party audit (Cure53 / Hacken) with public report.
Annual audits + expanded bug bounty program.
Non-custodial. Auditable. Transparent. Join the waitlist and we'll email you at launch.