# Audits

Sail does not currently deploy bespoke, Sail-owned protocol contracts. Our onchain execution is built on **Thirdweb’s ERC-7702 smart account infrastructure** and **ERC-7702 smart session keys**, which have been audited by independent security firms. We rely on these audited, production-grade components and keep Sail’s custom logic offchain (policy, routing, explainability) to minimize onchain attack surface.

#### What we do today

* **Use audited primitives for execution**\
  User accounts are ERC-7702 smart accounts with scoped session keys, implemented using Thirdweb’s audited codebase.
* **Review our integration and configuration**\
  We run internal security reviews focused on:
  * permissions and transaction constraints
  * session key scoping and lifecycle
  * protocol integration safety checks
* **Make permissions explicit at signing time**\
  When you authorize a session key, Sail shows the exact session key you are approving in the UI, including its scope and permissions, so you can verify what you are granting.

#### Audit reports (Thirdweb / ERC-7702 components)

* [0xMacro Security Audit: thirdweb 22 (April 25, 2025)](https://0xmacro.com/library/audits/thirdweb-22?utm_source=chatgpt.com) [0xmacro.com](https://0xmacro.com/library/audits/thirdweb-22)
* [thirdweb A-14 Audit PDF](https://ipfs.io/ipfs/Qmc36VUCuwG2u7kZrqmXmJsH5c8sF7SHySVbPnwVmo3XYX/thirdweb%20A-14%20_%20Macro%20Audits%20_%20The%200xMacro%20Library.pdf)
