Security

Everything KYACCHA asks of your wallet, and the verified code behind it.

Seeing a wallet warning?

Some wallet security scanners currently show an automated warning for kyaccha.com. We believe this is a false positive triggered by how our settlement works (explained below), and a review is underway with the wallet security providers. Nothing about the warning changes what the contracts on this page can or cannot do — that is defined by their verified source code, which anyone can read.

What we ask of your wallet — and when

  • Connecting requests nothing. No approvals, no signatures, no permissions — connecting only shares your public address.
  • Ripping a pack / joining a battle sends a USDG deposit to the verified Intake contract. The amount shown is the amount moved.
  • Selling or listing a card is the only time we request an NFT approval — to the verified SettlementDesk contract, at the moment you sell, never at connect. That approval lets the desk execute the settlement you asked for, one token at a time.
  • We never ask for your seed phrase, private key, or token allowances to any unverified address.

Every contract, verified

All contracts users interact with are source-verified on Arc's explorer. Don't trust this page — read the code:

MirrorCardVerified source ↗
0x95f075bEcc129c1f410D8221fe4855d13Bf20dBB

The ERC-721 that mirrors each physical graded slab 1:1. Minted only against cards held in the Collector Crypt vault.

IntakeVerified source ↗
0xCC432512373985831AaD7A6799a9fe12883b7977

Where your USDG deposit goes when you rip a pack or join a battle. Escrowed per purchase; each deposit can be swept forward or refunded exactly once — never both.

SettlementDeskVerified source ↗
0x9A52FC71339009591b92Ffa81fa8e1bDEaE85244

The only contract you ever grant an NFT approval to. Its verified source shows it can execute single-token settlement transfers requested by an allowlisted operator — no batch operations, no arbitrary calls, no payable functions.

Why a scanner can misread this

When a battle or sale settles, the SettlementDesk moves a mirror NFT out of a wallet that granted it approval. Mechanically, that pattern — approval plus operator-initiated transfer — is also how wallet drainers behave, and automated scanners score the pattern, not the intent. The difference is verifiable: drainers hide behind unverified contracts and take everything; the desk's public source shows it can only settle the specific trades users initiate. Custody during a battle is the product working as designed — cards are locked so nobody can move them mid-game, then transferred to the winner on-chain.

Real settlement, on the public record

Example — the first slab battle, settled end to end in under two minutes:

Questions

Reach us through the Support tab, or on X at @kyaccha_rh. Backed by Collector Crypt; running on Arc.