Independent security review
Ground’s smart contracts completed an independent Quantstamp review in April 2026, followed by a June 2026 fix review. Quantstamp’s final report states that all reported issues were resolved correctly and that the remaining notes are defense-in-depth, consistency, and clarity improvements rather than open vulnerabilities.Quantstamp Final Report
Review period: Apr 6, 2026 - Apr 17, 2026. Final report: Jun 23, 2026.
Audit reports are point-in-time reviews. The Quantstamp report applies to the code, commit, and scope listed in the report.
Key custody model
- Deposit addresses are provisioned and managed by Ground.
- Strategy updates and withdrawals require customer approval through Turnkey.
- Each customer organization has a dedicated Turnkey sub-organization used for approvals.
Wallet type per chain
Ground provides chain-native deposit addresses per supported chain. Treat them as standard addresses for funding and withdrawals. The exact address format follows the chain (for example, EVM vs Solana).Address uniqueness and reuse
- Each wallet receives dedicated deposit addresses per chain.
- Addresses are not reused across customers.
- If you see the same EVM address across multiple EVM chains for a single wallet, that is expected and still scoped to that wallet.
What this means for your integration
- Always send funds to the deposit address returned for the specific wallet and chain.
- Never reuse deposit addresses across wallets.
- Rely on the API or webhooks to reconcile balances and allocations.