Updated Oct 30, 2026

Wallet security

Your USDC sits in an account ULTRAMINT cannot move money from. This page lists every safeguard that stops someone draining it or placing Buys you did not want, and says plainly what no safeguard can stop.

Your account is yours

You sign in with your email or your Google account. Signing in creates your own signing key, and that key is the only owner of your ULTRAMINT account: a smart account (a Safe) on Base that holds your USDC. ULTRAMINT holds no key to it and cannot move your money.

Your key is held by Turnkey, our key provider, in a Turnkey account with two co-owners: you and an ULTRAMINT co-signer.

You sign alone. Your signatures never wait for ULTRAMINT.
ULTRAMINT alone can never sign with your key, export it or change your email.
Removing a sign-in method, changing your email or exporting your key needs both of you: you, after an emailed code, and ULTRAMINT.

There is no password to set and no separate wallet to install or connect.

Only readable requests, never raw transactions

Your account refuses every direct transaction. This is built into the account from the moment it is created. It is permanent: no setting, key or request can switch it off, not even one you sign yourself.

The only things your account will do are specific requests it can read: a Buy, a withdrawal, adding or removing a withdrawal address, changing your limits, approving or revoking a device, and ULTRAMINT actions such as creating a market. Before you approve one, ULTRAMINT shows what it does in plain words. For a Buy that is the market, the outcome you are buying, the most you will pay and who resolves the market.

Every request expires within minutes of being prepared and can be used only once. An expired or already used request moves no money.

With email, Turnkey sends you a one-time code and checks it. With Google, Turnkey checks your Google sign-in with Google. ULTRAMINT does not issue the sign-in that Turnkey trusts, so our servers cannot sign in as you. A breach of ULTRAMINT's servers, database or keys cannot produce a signature for you.

No silent signing

Your key signs only inside a sign-in you made yourself. Every signature goes through ULTRAMINT's approval screen, which shows the request in plain words, and nothing is signed until you press Approve. Before a signature is used, ULTRAMINT checks it names exactly the request you approved, for this network and this account, and refuses it otherwise.

You can always leave without us

Your key can always do these on Base without ULTRAMINT, whatever ULTRAMINT does:

withdraw to a withdrawal address already on your list;
remove a withdrawal address;
revoke a device key.

You can also export your key, with ULTRAMINT's co-approval and an emailed code. Anyone who gets an exported key can sign as you, so keep it as safe as your email.

A code before the sensitive steps

In ULTRAMINT, every withdrawal and every new withdrawal address needs an emailed code, on top of your approval. Turnkey sends the code and checks it; we pass on what you type only in a form we cannot read. Someone who gets into your signed-in browser still cannot withdraw or add an address of theirs without your mailbox. The code works once, for that one step, and expires in 5 minutes.

The same goes for approving a new device, changing your Buy limits and proposing a new owner key. Right after you sign in with an email code, that sign-in counts for the first device you approve, once, within 10 minutes.

Passkeys

Where we offer them, you can add a passkey on your Security page. A passkey is a key your phone or computer keeps, unlocked with your face, fingerprint or device PIN.

What it does: you can sign in with it, without waiting for a code. That is all it does for now: it does not protect you if someone gets into your mailbox.
What it does not replace: the emailed code. A sensitive step always needs the code, passkey or not.
How to remove it: on your Security page. Removing a passkey needs an emailed code, and ULTRAMINT approves it as the second key holder, so a stolen session cannot remove it. We email you when it is removed.

You can link Google on your Security page, but only the Google account for your own email address. Linking needs an emailed code, and ULTRAMINT approves it as the second key holder. A Google sign-in never joins an account by itself just because the email matches. Unlinking works the same way, with a code, and we email you after either one.

Quick Buys on your devices

So that small Buys don't need an approval every time, you can approve a device once. That device gets its own key, which can sign Buys for you, but only:

up to your per-Buy limit, $100 by default;
within your daily limit over a rolling 24 hours, $500 by default;
on ULTRAMINT markets resolved by the protocol, never on a market its creator resolves.

Your account checks each of these itself and refuses a quick Buy that breaks any of them. Your limits cover all your devices together.

A device key can only Buy. It cannot withdraw, send money anywhere, add a withdrawal address, change your limits or give anyone permission to spend your USDC.

Changing a limit needs your signature, and neither limit can go above the maximum ULTRAMINT's policy allows. The defaults and the maximum are set by policy and can change. A device approval expires on its own, and you can revoke any device at any time on your Security page. See Your spending limits and How Buys are approved.

Only ULTRAMINT can submit a Buy

Your account accepts a Buy only when ULTRAMINT submits it, and ULTRAMINT submits Buys only for markets listed on ULTRAMINT. A Buy you are tricked into signing for a market outside ULTRAMINT cannot reach your account: ULTRAMINT will not submit it, and your account refuses it from anyone else.

ULTRAMINT also limits how far the price may move against you on any Buy from your account: at most 5%, whatever a page or device asks for. That stops a stolen device key from buying at a deliberately bad price. The max price move you choose is explained in Buying a position.

Withdrawals go only to your addresses

Money can leave your account only to a withdrawal address you added. Your account enforces this itself.

A new address waits through a cooling-off period, currently 24 hours and set by policy, before money can go to it.
ULTRAMINT warns you every time an address is added: in your notifications, and by email when your account has an email address on file.
You can remove an address at any time, including while it is still waiting, and it stops working straight away.
Every withdrawal needs your signature and an emailed code. A device key can never withdraw.

See Withdrawal addresses and the cooling-off period.

Markets their creator resolves

Some markets, such as Members only markets in a Town, are resolved by their creator rather than by the protocol. A Buy on one always needs your signature, never a quick Buy, and the request warns you who resolves it. Only buy if you trust them. See How a market resolves.

A new owner key waits 3 days

You can move your account to a new owner key you choose. The change waits 3 days before it takes effect. We alert you as soon as one is proposed, and you can cancel it during the wait.

Platform changes are delayed and public

The settings above live in ULTRAMINT's account policy: the cooling-off period, the maximum limits, how long a request may live, and which markets and submitters count as ULTRAMINT's. Every change to that policy waits through a 24-hour timelock and is recorded publicly on Base before it takes effect, so anyone can see it coming. The rule that your account refuses direct transactions is not in the policy and cannot be changed at all.

What you should do

Protect your email or Google account. It is your login, it receives your codes, and it is the key to your account. Use a strong password and two-step verification. If you lose access to it, ULTRAMINT cannot restore your account.
Act on every withdrawal address warning. If you did not add the address, remove it straight away and contact support: see Contacting support.
Review your devices on your Security page, and revoke any you do not recognise or no longer use.
Never approve a request you did not start. If an approval screen appears when you did nothing, or names a market or amount you do not recognise, decline it.

What these safeguards cannot stop

Someone who controls your email or Google account can sign in as you and approve requests as you, including adding a withdrawal address, because they also receive the codes. Your account still accepts only the requests listed above, and the cooling-off period, the 3-day wait and the warnings give you time to notice and act, so check your notifications.
A request you approve without reading it. Your account does exactly what you sign. Read the summary before you approve.
A tampered ULTRAMINT website. If our website ever served malicious code while you are signed in, that code could ask your signing session for signatures. It could still only get actions your account accepts, and the cooling-off period, the 3-day wait on a new owner key and the alerts all still apply. Check every alert you get.
Someone using a device you approved can place quick Buys within your limits, on ULTRAMINT markets only, until you revoke the device. They cannot withdraw.

Your own responsibilities for your sign-in and devices are set out in the Terms of Service.

Did this not answer it? Contact support.