Security
Verify the site, understand every approval, and report anything unexpected.
Official site
The production app is https://boringcapital.xyz. Check the address before connecting a wallet or using a passkey.
The app never asks for a seed phrase, private key, wallet password, recovery code, or software download. Approvals happen in your wallet or browser passkey prompt.
What each action means
- Connect wallet
- Shares a public wallet address. Connecting alone does not move funds.
- Login signature
- Proves wallet ownership and creates a 7-day app session. The message says it cannot authorize a transaction or move funds.
- App passkey
- Creates an identity scoped to this site. Its private key remains in your device or passkey provider. The app has no passkey recovery flow.
- Action signature
- Authorizes the displayed swap, deposit, rebalance, withdrawal, or close action. Review assets, amounts, recipient, fees, and expiry.
- On-chain transaction
- Can move funds or change contract state and cannot generally be reversed. Verify the network, receiver, method, amount, deposit, and gas in your wallet.
Providers and reports
Wallet software, chain RPCs, and NEAR Intents/1Click are independent third-party services. Their prompts and availability are outside this app’s control.
Report suspicious behavior privately to gm@pysr.xyz. Include the URL, wallet, time, screenshot, and the exact message or transaction shown.