An observation is not an assurance
NOLEAK distinguishes evidence of an onchain signature from proof of private-key compromise. An address with no signature in a checked window is not automatically considered safe.
08 / METHODOLOGYSECURITY MODEL / PUBLIC
Evidence, with
honest limits.
The rules that keep NOLEAK useful without turning security research into false certainty.
+
Every scan has a boundary
Browser scans cover a bounded number of blocks, chosen by the user or near a recent snapshot. Offchain signatures, EIP-712 messages and the history of other chains may not be observable.
A migration is never automatic
The Migration Safety module is a preparatory check on user-selected assets. It does not inventory all assets, replace transaction simulation for every protocol, authorize, sign or broadcast any transaction.
Agents are not authorities
zkAPI may provide privacy between API usage and billing, but not hide prompt contents from the model provider. IMD job acceptance does not certify the security truth of a submitted report.
Privacy is an operational choice
Public addresses reveal activity to RPC providers and researchers. For sensitive audit work, disclose only what is necessary. NEVER paste a seed phrase, private key or recovery code.
Cryptography is still evolving
Potential AI-accelerated attacks are research concerns, not confirmed breaks of ECDSA or ML-DSA. NOLEAK tracks established facts and labels speculative threat models.