Cryptography and audited contracts are table stakes. The losses that actually happen come from operations: a compromised dashboard, an overbroad keeper, a signer tricked into approving the wrong call. Zodiac makes the operational layer enforceable: every policy a rule the chain checks before funds can move, not a procedure a human is trusted to follow.
Keys get split and contracts get audited, yet funds still leave. The controls that govern day-to-day operations live in a document people are trusted to follow, and an attacker only has to compromise one interface or fool one signer.
Zodiac turns operational policy into bytecode the chain enforces. Nothing to skip, bypass, or socially engineer.
If your security now rests on the chain enforcing that policy, the obvious question is whether the enforcement itself holds. The rest of this page answers it.
A vendor policy engine is a closed system you have to trust to secure its own infrastructure, stay up under load, and keep enforcing in the volatile market conditions where you most need to transact. That is a single point of failure you do not control. Zodiac’s policy engine is open and runs onchain, so as long as the chain you are transacting on is live, your enforcement is live with it. No closed infrastructure to depend on, and no vendor lock-in.
The layers fail independently. A stolen signer key is stopped by the multisig threshold, and a tricked signer or a compromised interface is stopped by the onchain policy above it. Signing stays standard, so each signer can sit behind a hardware wallet or HSM. No other policy engine composes with your existing key custody this way.
Every layer above the chain can be subverted. A host can lie, a dashboard can be swapped, a hardware attestation can be forged. The chain cannot. The policy is part of the transaction itself: the account checks every call against its rules as it executes, and anything that breaks a rule simply reverts. Whatever was compromised upstream, the chain still decides the outcome.
Zodiac extends Safe, inheriting the security perimeter that Safe has built over seven years of production deployment, audited by the firms institutional buyers already know.
Safe accounts hold the majority of institutional onchain value. The custody perimeter is the same one your peers already trust.
Safe is audited by Ackee, Runtime Verification, OpenZeppelin, Certora, and others. Reports are public.
Zodiac modules are used in production by the Safe team and recognized across the wider Safe ecosystem.
See safe.global/security for the Safe team’s security posture. Everything there applies to your Zodiac deployment by construction.
Independent firms have reviewed the Zodiac modules that enforce policy on top of the stack.
For the full list of module reports, contact security@zodiac.eco.
You trust the chain to execute correctly. You trust audited Safe contracts. You trust the audited Zodiac modules you’ve deployed. Our interface sits in the path you normally use, but it is not a required dependency: if it goes down you can sign through another interface or execute against the contracts directly, and the onchain policy enforces the same rules either way.
Only what that signer’s role permits. They cannot drain funds outside the role, grant themselves new permissions, or modify the policy structure without separate authorization.
Nothing to your funds. Our app, our SDK, and our extension help you build policies, but the deployed contracts execute on the chain without our involvement.
Bugs in the underlying protocols you’re interacting with. Oracle manipulation. Bugs in custom logic you deploy. The chain re-org or consensus failure. We bound damage from compromised authority; we do not replace audits of the contracts you call.
We’ll demo the full stack against your specific operating model and risk requirements.
