Skip to main content
Security cover: the pixel goat inside a shield, surrounded by price check, 24 h queue, guardian pause and reviewed hooks.
Goat LP is experimental. Use small amounts.
The Goat LP contracts have been through internal security reviews. The app only sends an automation transaction when the code at the contract’s address matches the build pinned in the app.

​
The short version

Your NFT stays in your wallet

Automation works through a permission for one position. Where a contract needs the NFT for a moment, it comes back in the same transaction, or the whole transaction fails.

Smallest possible approvals

Token approvals are for the exact amount. On Uniswap v4 they go through Permit2 and expire after 30 minutes.

Checked before you sign

The app decodes the final transaction and refuses it unless the recipient, minimums, deadline, contract and fee are all as expected.

No upgrades, slow admin

No proxy, no delegatecall. A Cashmere-controlled Safe owns the contracts. Adding a keeper, a pair or a price source waits 24 hours in public. See Contracts.

​
What the app checks before you sign

Pixel goat inside a shield with a green check. Pixel goat inside a shield with a green check. If any rule fails, your wallet never sees the request.
  • Recipient. Every output goes to your connected wallet.
  • Paying with ETH. On a WETH pair the deposit goes straight to Uniswap’s position manager and ends with the refund of unused ETH to your wallet in the same transaction (v3 refundETH, v4 SWEEP). The app refuses any request that would leave ETH or WETH in a contract or send it anywhere but your wallet.
  • Minimums and deadline. Every swap, add and remove has a minimum above zero; deadlines are minutes away.
  • Known contracts. Contract addresses come from the app’s own build, never from the analytics API, and automation code is checked on chain against the pinned version.
  • Fee. A Goat LP fee may go only to the fee address, at exactly the configured rate.
  • Permissions. An automation permission must be for one position, to a Goat automation contract.
  • Simulation. Every action is simulated on chain before it is offered for signing.

​
What you should check

  • The address bar: only app.cashmere.exchange. Cashmere never messages you first.
  • The contract in your wallet: a Uniswap contract, Permit2, Revert Finance’s V3Utils, or a Goat contract listed on Contracts.
  • Approvals: a token approval names the exact amount; a position permission is approve for one position number.
  • Wallet-wide permissions: Goat LP asks for setApprovalForAll in one place only: Allow for all positions, after its own consent screen, to the one address on Contracts. If anything else asks, stop.
  • Never sign a message you do not understand, and never type a seed phrase anywhere.

​
Remove approvals

​
Leave without the app

You do not need Goat LP to get out, unless the pool’s hook or one of its tokens blocks it. Each step is a transaction you sign on the block explorer (Contract, then Write). Check every argument before signing.
1

Remove the permission

On the v3 or v4 position manager, call approve(0x0000000000000000000000000000000000000000, yourPositionId). Without the permission no automation can touch the position.
2

On v4, cancel signed permits

A permit you signed earlier could set the permission again until it is used or expires. Call revokeNonce(nonce) on the v4 position manager. The app’s Stop does this for you.
3

Clear the rule (optional)

Auto-compound: configToken with an all-off setting on the auto-compound contract. Auto-range or auto-exit on v4: clearConfig(yourPositionId) on the Steward; it works even when the contract is paused. On v3: configToken with an all-zero setting on the auto-range or auto-exit contract.
4

Withdraw at Uniswap

On v3, call decreaseLiquidity and then collect to your address. Minimums of 0 accept any price; only use 0 if you accept that. On v4, use Uniswap’s interface or the Withdraw button in Goat LP, which does not depend on the analytics API.
If an NFT were ever stuck in a Goat compound contract, only its owner, the Cashmere-controlled Safe, can move it out with emergencyWithdrawNFT. Contact us below.

​
How Goat LP is watched

Keepers, sentinels (the independent safety monitors) and watchers raise alarms, and every alarm reaches the Cashmere team by e-mail. The team can pause at once through the guardian Safe.
Alarms: Goat keepers, sentinels and watchers send alarms to a forwarder that e-mails the Cashmere team; we are alerted when something needs attention.Alarms: Goat keepers, sentinels and watchers send alarms to a forwarder that e-mails the Cashmere team; we are alerted when something needs attention.

​
Report a vulnerability

Email [email protected] with the contract, the steps to reproduce and the impact. Please do not test against other people’s positions on mainnet, and give us time to fix an issue before sharing details publicly.