Recipe: cold storage, hot wallet DeFi

Goal — Keep the assets in a cold storage Safe. A hot wallet executes only approved DeFi actions, only against scoped protocols. Transfers and arbitrary contract calls stay impossible.

Good for:

• The cold-treasury-plus-hot-operator model: custody stays in the cold Safe, an operations wallet runs the allowed DeFi flows.
• DeFi position maintenance: delegate the routine actions — supply, withdraw, claim — with tight parameter scoping.
• A small blast radius: when the hot wallet key leaks, the attacker can only move funds between the Safe and the approved protocols.

Steps

1. Open Policies and create a new policy, for example “Cold Safe DeFi Ops”.
2. Select the cold storage Safe as the vault.
3. Add the hot wallet address as a Member.
4. In Actions, add one or more DeFi actions for the approved protocols.
5. Scope each action tightly: the exact protocol, the exact operations (for example supply and withdraw only), and the tokens and amounts where the template supports it.
6. Do not add Transfer actions. Do not add Custom actions.
7. Click Apply Changes and sign with the cold Safe.

Do it as code

Define the policy as a constellation role that carries only scoped DeFi Kit actions — and no transfer permissions. For an extra veto window on top, route the role through a Delay Modifier. Start from the Roles quickstart.