LYMO WALLET

Security starts with boundaries.

Keeping customer wallet keys separate from company infrastructure is a permanent architectural rule—not a claim that any system is risk-free.

Development status · Mainnet Send remains disabled. This website explains the current design and supported registry; it is not a production launch or an invitation to fund a test wallet.

Customer keys stay on the device

The Android app uses Flutter for the interface and native/Rust boundaries for protected key handling, transaction verification and signing. Wallet and local transaction metadata have device-side protection. A website, RPC provider or Lymo server must not receive a customer seed phrase or private key.

Device authentication and encryption reduce risk but cannot guarantee safety on a compromised device. Keep your operating system current and protect your recovery information.

Company keys are not wallet keys

Google Cloud KMS holds purpose-separated company authorization keys for fee policy, Send controls and EVM quote authorization. The EVM quote authorization key uses HSM protection; other approved authorization keys use Cloud KMS software protection. This does not mean customer wallets are stored in a company HSM.

The separate Fly.io issuer is designed to renew qualified controls automatically. These signatures cannot substitute for the customer’s device signature. Company permissions and runtime identity are constrained separately from wallet ownership.

Verify before signing

Lymo checks transaction identity, destination, network, amount, fee/debit limits, quote expiry and supported transaction structure. EVM router authorization binds the quote to its intended chain, contract and transaction. A changed or stale transaction requires rejection or a new confirmed quote.

RPC responses are treated as untrusted input. TLS alone does not prove that a reported balance or receipt is correct. Contradictory, incomplete or stale evidence must not be presented as a verified successful transaction.

What these controls cannot promise

Blockchains can reorganize or fail, providers can be unavailable, software can contain defects, and token issuers can freeze or restrict some tokens. Lymo cannot reverse an on-chain transaction or guarantee the value or recoverability of an asset.

Public-testnet qualification and internal security tests are not an independent external audit. Production execution remains disabled while readiness work continues. We do not claim regulatory approval, deposit insurance or guaranteed availability.

If something looks wrong

Stop before signing. Compare the full destination on a trusted source and check the network. Never “verify” a wallet by sharing its recovery phrase or sending funds to support.

Report a suspected issue to lymo.app1@gmail.com. Start with a brief description and the app version. Do not include credentials, recovery material, full wallet screenshots or sensitive transaction details in the first email; ask for an appropriate way to share further evidence.