Security risks and 0xZAPS token disclosures.

The contracts and the interface have not been externally audited. They should not be treated as production-cleared for real funds. Depositing funds can result in total loss.

Transactions, approvals, swaps, and deposits cannot be reversed by OpenZaps once they are submitted onchain. Once an execution lands, nothing here can undo it.

A relayer, or any executor eligible to submit a recurring or triggered Zap, may fail, censor, delay, or submit at an unfavorable time inside the signed constraints. If no executor serves an intent, nothing runs. Each automated run also pays a fixed 1% of its measured output as a protocol fee.

Slippage, liquidity, oracle movement, MEV, token volatility, and gas spikes can cause losses.

0xZAPS is an ERC-20. It does not represent equity, revenue, yield, a redemption right, or a guarantee of protocol access. No return is implied.

Users must review wallet prompts, policy fields, amounts and spend limits, recipients, fees, and revocation paths before signing.

A Request a Zap submission stores the name and email you provide, project details, workflow, protocols or assets, trigger, safety limits, timeline, consent record, minimized campaign labels, and only the referring website's origin. OpenZaps derives a non-reversible abuse-control value from the request network address, but keeps it separately from lead records and never stores the raw address.

Authorized operators use this data only to assess the requested workflow, prevent form abuse, and reply about that request. A server-only email delivery provider forwards the submitted details to the designated OpenZaps operator mailbox so new requests can be reviewed promptly. That notification copy is separately processed and retained under the email delivery provider's and operator mailbox's policies; the database expiry below does not automatically delete an already-delivered email. Submission does not join a newsletter, authorize automated outreach, or grant any wallet or signing authority.

OpenZaps uses Vercel Web Analytics to understand which public routes and product actions are useful. Query strings and URL fragments are removed before pageviews are sent, and EVM identifiers in route paths are replaced. Custom events contain at most two coarse labels. A controlled first-touch campaign label may remain in the current tab's session storage; raw campaign text, form contact fields, wallet addresses, transaction hashes, workflows, and project details are not sent as analytics event properties. Vercel receives limited standard request context needed to aggregate these events under its Web Analytics service.

Request-desk database records expire after 180 days. A human-reviewed active design conversation may be renewed only within a fixed one-year maximum, and a closed request expires within 30 days. A daily retention job removes expired database records and short-lived abuse controls. Operators should delete the corresponding mailbox notification when its request is deleted; email-provider service records follow that provider's retention terms.