{"license":"CC-BY-4.0","licenseUrl":"https://creativecommons.org/licenses/by/4.0/","attribution":"ChainChoice (https://chainchoice.io)","category":"smart_accounts","evidenceReadAt":"2026-11-03","generatedAt":"2026-11-12","criteria":[{"id":"contractSecurityRecord","label":"Audit depth of the deployed version + real exploit history","weight":35},{"id":"upgradeControl","label":"Upgrade control and key holders","weight":25},{"id":"recoveryMechanics","label":"Recovery paths and their documented failure modes","weight":20},{"id":"costAndChainReach","label":"Published cost and chains you can actually reach","weight":20}],"providers":{"safe_smart_accounts":{"contractSecurityRecord":{"s":6,"q":"this attack targeted to the Bybit Safe was achieved through a compromised Safe{Wallet} developer machine resulting in the proposal of a disguised malicious transaction | The forensic review of external security researchers did NOT indicate any vulnerabilities in the Safe smart contracts or source…","u":"https://safefoundation.org/blog/safe-ecosystem-foundation-statement","d":"2026-11-03"},"upgradeControl":{"s":5,"q":"The SafeProxy contract (aka. Safe Smart Account) stores the address of the Singleton contract at storage slot(0) . | A malicious implementation contract can take over the SafeProxy contract, causing loss of access to the account and potentially losing all funds.","u":"https://docs.safe.global/advanced/smart-account-migration","d":"2026-11-03"},"recoveryMechanics":{"s":7,"q":"The delayed execution is a very important security measure given that the Recoverer can bypass the threshold of a Safe Account. | As of the initial release there is no form of notification sent on any of these occasions: recovery setup, proposal or execution.","u":"https://help.safe.global/articles/9622260218-account-recovery-with-saferecoveryhub","d":"2026-11-03"},"costAndChainReach":{"s":8,"q":"9 + Years in production 18 + Independent smart account audits 40 + Networks supported","u":"https://safe.global/","d":"2026-11-03"}},"squads_multisig":{"contractSecurityRecord":{"s":9,"q":"Our programs have undergone multiple security audits by leading security firms like OtterSec, Certora, Neodyme, etc. | has undergone [two formal verifications](https://docs.squads.so/main/security/formal-verifications/squads-protocol-v4) to make sure it is robust.","u":"https://docs.squads.so/main/basics/security.md","d":"2026-11-03"},"upgradeControl":{"s":10,"q":"Squads Protocol is a collection of open source, immutable smart accounts that are powered by Solana's 1,000+ validators. | unalterable by Squads Labs or any third party.","u":"https://docs.squads.so/main/basics/security.md","d":"2026-11-03"},"recoveryMechanics":{"s":3,"q":"Time locks allow Squad members to defer the execution of approved transactions for a set period of time. | Available periods: 1 hour, 1 day, 1 week, Custom (in seconds), None (disables the time lock).","u":"https://docs.squads.so/main/navigating-your-squad/settings/time-locks.md","d":"2026-11-03"},"costAndChainReach":{"s":4,"q":"Squads Multisig is built on Squads Protocol, the formally-verified autonomous finance layer on Solana, securing over $10 billion in value and more than $3 billion in stablecoin transfers.","u":"https://docs.squads.so/main/basics/security.md","d":"2026-11-03"}},"zodiac_os":{"contractSecurityRecord":{"s":2,"q":"On 1 June 2026, an attacker exploited an authorization bug in Roles v2.1.0 and Delay v1.1.0. | Patched mastercopies Roles 2.1.1 and Delay 1.1.1, released on 19 June 2026 after an audit by Gnosis. | Gnosis Pay accounts were the primary exploited deployment.","u":"https://docs.zodiac.eco/developers/security","d":"2026-11-03"},"upgradeControl":{"s":2,"q":"A module is a path into the Safe without signatures. The Safe owners choose which modules exist, which modifier limits each module, and which mastercopy each proxy runs.","u":"https://docs.zodiac.eco/developers/security","d":"2026-11-03"},"recoveryMechanics":{"s":6,"q":"After a cooldown , anyone can execute it. Before that, the owner can cancel it. | The Delay Modifier delays only the module path that goes through it. Safe owners that sign directly, and modules enabled directly on the Safe, are not delayed.","u":"https://docs.zodiac.eco/developers/delay","d":"2026-11-03"},"costAndChainReach":{"s":5,"q":"Free For early experimentation and small teams. $0 forever Assets $1M Monthly volume $100k Seats 3 Vaults 3 Policies 3 | Starter For small treasuries that have outgrown Free.","u":"https://www.zodiac.eco/pricing","d":"2026-11-03"}},"candide_smart_accounts":{"contractSecurityRecord":{"s":5,"q":"Contracts audited by Ackee, Nethermind and Certora.","u":"https://www.candide.dev/pricing","d":"2026-11-03"},"upgradeControl":{"s":4,"q":"The `SafeAccount` uses the original Safe Singleton and adds ERC-4337 functionality using a module/fallback handler.","u":"https://docs.candide.dev/wallet/abstractionkit/safe-account.md","d":"2026-11-03"},"recoveryMechanics":{"s":8,"q":"After the grace period, anyone can finalize the recovery to complete the ownership transfer | The grace period is a time delay between execution and finalization. It gives the current owner a window to cancel unauthorized recovery attempts.","u":"https://docs.candide.dev/wallet/plugins/recovery-with-guardians.md","d":"2026-11-03"},"costAndChainReach":{"s":6,"q":"Mainnet chains 2 7 All All | API requests 25,000 total 1M / mo 5M / mo Up to unlimited | Gas markup None None None None Sponsored ops included 1,000 total 5,000 / mo 25,000 / mo Up to unlimited Fee after included Move to Launch $0.01 / op $0.005 / op Custom","u":"https://www.candide.dev/pricing","d":"2026-11-03"}},"alchemy_smart_wallets":{"contractSecurityRecord":{"s":7,"q":"With multiple developer-years of work and two comprehensive audits from [ChainLight](https://github.com/alchemyplatform/modular-account/blob/develop/audits/2024-12-03_chainlight_14afcd8.pdf) and…","u":"https://www.alchemy.com/docs/wallets/smart-contracts/modular-account-v2/overview.md","d":"2026-11-03"},"upgradeControl":{"s":3,"q":"When modular accounts are created from the factory, an ERC-1967 proxy contract is deployed. Users can update the implementation their proxy points to to choose which smart account implementations to use.","u":"https://raw.githubusercontent.com/alchemyplatform/modular-account/develop/README.md","d":"2026-11-03"},"recoveryMechanics":{"s":2,"q":"The signer (EOA) address *is* the account address. Assets live at the signer address, and the EOA is delegated to MAv2.","u":"https://www.alchemy.com/docs/wallets/wallet-integrations/privy/signer-migration-overview.md","d":"2026-11-03"},"costAndChainReach":{"s":6,"q":"Pay as You Go Pay for what you use. Starting from 300 requests/second 30 apps & 100 webhooks $0.52/1M CUs | Throughput add-on to fit your needs | Admin fee - 8%","u":"https://www.alchemy.com/pricing","d":"2026-11-03"}},"biconomy_smart_accounts":{"contractSecurityRecord":{"s":7,"q":"Use 2.2.3 (Nexus 1.3.3) for all new accounts. Nexus versions before 1.3.3 have a re-initialization issue, fixed in 1.3.3 by making account initialization single-use per transaction. | Reviewed by Pashov Audit Group (July 2026)","u":"https://docs.biconomy.io/contracts-and-audits","d":"2026-11-03"},"upgradeControl":{"s":3,"q":"Call the `upgradeToAndCall()` method to upgrade your account to the latest implementation.","u":"https://docs.biconomy.io/upgrade-migrate/upgrade-mee-suite.md","d":"2026-11-03"},"recoveryMechanics":{"s":2,"q":"- **Graceful failure recovery** — cleanup transactions return unused funds to users","u":"https://docs.biconomy.io/llms.txt","d":"2026-11-03"},"costAndChainReach":{"s":3,"q":"failure recovery across 20+ EVM chains. No smart contracts required.","u":"https://docs.biconomy.io/llms.txt","d":"2026-11-03"}},"den_multisig":{"contractSecurityRecord":{"s":6,"q":"Last updated: July 9, 2026 Note: for clients utilizing Den Multisig, a deployment of the open-source Safe software provided by Den, or otherwise utilizing the Services without a signed Order form","u":"https://www.onchainden.com/terms","d":"2026-11-03"},"upgradeControl":{"s":4,"q":"Last updated: July 9, 2026 Note: for clients utilizing Den Multisig, a deployment of the open-source Safe software provided by Den, or otherwise utilizing the Services without a signed Order form","u":"https://www.onchainden.com/terms","d":"2026-11-03"},"recoveryMechanics":{"s":2,"q":"Note: for clients utilizing Den Multisig, a deployment of the open-source Safe software provided by Den, or otherwise utilizing the Services without a signed Order form, please note that the terms and conditions that apply to your use are available at the \"Other Offerings\"","u":"https://www.onchainden.com/terms","d":"2026-11-03"},"costAndChainReach":{"s":3,"q":"t.SUPPORTED_NETWORKS=[1,10,56,100,137,480,8453,42161,43114,80094,81457,7777777,21e6]","u":"https://app.onchainden.com/_next/static/chunks/pages/_app-8fa1772e314d5fa3.js","d":"2026-11-03"}}}}