# How Develp protects your stake

> How Develp protects a client's stake: withdrawal credentials on the client's address, keys generated offline, remote signing and slashing protection.

The withdrawal credentials stay on your address, keys are generated offline and used through a remote signer that keeps a slashing protection record, and the infrastructure is spread across providers and regions and watched around the clock.

## How keys are handled

The signing key signs a validator's duties, and it cannot move your stake. Withdrawals go only to your own address.

**Where the signing key sits.** Validator machines connect to Ethereum and ask a remote signer, kept apart from them, for each signature. The signing key sits in the remote signer. Monitoring covers the machines and the signer.

1. Monitoring runs day and night, with an on-call team behind it.
2. The validators run with more than one provider and in more than one region.
3. The remote signer runs apart from the validator machines, which ask it for every signature.
4. Each key is generated offline and has one signer only.

## How slashing protection works

Slashing can happen when the same key signs in two places at once, for example when a backup starts while the main machine is still signing. The signer keeps a record of what it has signed and refuses a second, conflicting signature.

**Two machines ask to sign the same slot.** A main validator and a backup both ask to sign for the same slot. The remote signer signs the first request and refuses the second, conflicting one.

## Upgrades and relays

- **Upgrades followed from the inside**: Each network upgrade is followed by the team behind Nimbus before it reaches mainnet.
- **Relays and MEV**: Blocks are built through MEV-Boost with several relays, and OFAC-compliant relays are used if your policy requires them.

## Report a vulnerability

Report vulnerabilities through the Institute of Free Technology's bug bounty program at HackenProof, and security incidents through the contact in our security.txt file.

[Report through HackenProof](https://hackenproof.com/companies/ift) [security.txt](https://develp.co/.well-known/security.txt)

---
Source: https://develp.co/security/