Skip to main content
Security cover: the pixel goat inside a shield, surrounded by price check, 24 h queue, guardian pause and reviewed hooks.
Goat LP is experimental. Use small amounts.
The Goat LP contracts have been through internal security reviews. The app only sends an automation transaction when the code at the contract’s address matches the build pinned in the app.

​
The short version

Your NFT stays in your wallet

Automation works through a permission for one position. Where a contract needs the NFT for a moment, it comes back in the same transaction, or the whole transaction fails.

Smallest possible approvals

Token approvals are for the exact amount. On Uniswap v4 they go through Permit2 and expire after 30 minutes. A token that already gives Permit2 a permanent allowance skips that approval step; the allowance to Uniswap is still exact and lasts 30 minutes.

Checked before you sign

The app decodes the final transaction and refuses it unless the recipient, minimums, deadline, contract and fee are all as expected.

No upgrades, slow admin

No proxy, no delegatecall. A Cashmere-controlled Safe owns the contracts. Adding a keeper, a pair or a price source waits 24 hours in public. See Contracts.

​
What the app checks before you sign

Pixel goat inside a shield with a green check. Pixel goat inside a shield with a green check. If any rule fails, your wallet never sees the request.
  • Recipient. Every output goes to your connected wallet.
  • Paying with ETH. On a WETH pair the deposit goes straight to Uniswap’s position manager and ends with the refund of unused ETH to your wallet in the same transaction (v3 refundETH, v4 SWEEP). The app refuses any request that would leave ETH or WETH in a contract or send it anywhere but your wallet.
  • Minimums and deadline. Every swap, add and remove has a minimum above zero; deadlines are minutes away.
  • Known contracts. Contract addresses come from the app’s own build, never from the analytics API, and automation code is checked on chain against the pinned version.
  • Fee. A Goat LP fee may go only to the fee address, at exactly the configured rate.
  • Permissions. An automation permission must be for one position, to a Goat automation contract. The two exceptions are the permissions for all positions of auto-range that keeps running and of auto-exit, each after its own consent screen, to the addresses on Contracts.
  • Simulation. Every action is simulated on chain before it is offered for signing.

​
What you should check

  • The address bar: only app.cashmere.exchange. Cashmere never messages you first.
  • The contract in your wallet: a Uniswap contract, Permit2, Revert Finance’s V3Utils, or a Goat contract listed on Contracts.
  • Approvals: a token approval names the exact amount; a position permission is approve for one position number.
  • Permissions for all positions: Goat LP asks for setApprovalForAll in two flows only, each after its own consent screen: Allow for all positions for auto-range that keeps running (to Goat AutoRange on v3, the Goat engine on v4) and auto-exit for all positions (to Goat AutoExit on v3, the same Goat engine on v4). Auto-compound always uses a permission for one position. If anything else asks, or names another address, stop.
  • Never sign a message you do not understand, and never type a seed phrase anywhere.
What you sign. The only message Goat LP asks you to sign is for v4 auto-compound. Each one is a typed message (EIP-712) of the Uniswap v4 position manager (“Uniswap v4 Positions NFT”, chain 4663). It has four fields:
  • spender: GoatAutoCompoundV4, the address on Contracts
  • tokenId: your position number
  • nonce: a number that lets the message be used only once
  • deadline: the end date you picked, at most 90 days away
If your wallet shows another spender, another position number or an end date more than 90 days away, do not sign.

​
Remove approvals

​
Leave without the app

You do not need Goat LP to get out, unless the pool’s hook or one of its tokens blocks it. Each step is a transaction you sign on the block explorer (Contract, then Write). Check every argument before signing.
1

Remove the permission

On the v3 or v4 position manager, call approve(0x0000000000000000000000000000000000000000, yourPositionId). Without the permission no automation can touch the position.
2

On v4, cancel signed messages

A signed message you gave for v4 auto-compound could set the permission again until it is used or its end date passes. Call revokeNonce(nonce) on the v4 position manager for each unused one. The app’s Stop does this for you.
3

Clear the rule (optional)

Auto-compound: configToken with an all-off setting on the auto-compound contract. Auto-range or auto-exit on v4: clearConfig(yourPositionId) on the Steward; it works even when the contract is paused. On v3: configToken with an all-zero setting on the auto-range or auto-exit contract.
4

Withdraw at Uniswap

On v3, call decreaseLiquidity and then collect to your address. Minimums of 0 accept any price; only use 0 if you accept that. On v4, use Uniswap’s interface or the Withdraw button in Goat LP, which does not depend on the analytics API.
If an NFT were ever stuck in a Goat compound contract, only its owner, the Cashmere-controlled Safe, can move it out with emergencyWithdrawNFT. Contact us below.

​
How Goat LP is watched

Keepers, sentinels (the independent monitors) and watchers raise alarms, and every alarm reaches the Cashmere team by e-mail. The team can pause at once through the guardian Safe.
Alarms: Goat keepers, sentinels and watchers send alarms to a forwarder that e-mails the Cashmere team; we are alerted when something needs attention.Alarms: Goat keepers, sentinels and watchers send alarms to a forwarder that e-mails the Cashmere team; we are alerted when something needs attention.

​
Report a vulnerability

Email [email protected] with the contract, the steps to reproduce and the impact. Please do not test against other people’s positions on mainnet, and give us time to fix an issue before sharing details publicly.