From d99c2ed3f84fbda4b5f41f378e5bdc43ec1ff1fb Mon Sep 17 00:00:00 2001
From: kasperpawlowski <kasperpawlowski@gmail.com>
Date: Mon, 10 Aug 2026 14:08:51 +0200
Subject: [PATCH 1/7] feat: show Safe multisig badge on governance addresses
 and oracle router governor

---
 abis/oracle.ts                                |  11 ++
 abis/safe.ts                                  |  33 +++++
 assets/sprite/svg/safe.svg                    |   1 +
 components/entities/safe/SafeAccountBadge.vue |  38 +++++
 .../overview/SecuritizeVaultOverview.vue      |  73 +--------
 .../overview/VaultOverviewAddressValue.vue    |  50 +++++++
 .../overview/VaultOverviewBlockAddresses.vue  |  60 ++++----
 .../earn/VaultOverviewEarnBlockAddresses.vue  |  35 +----
 .../earn/VaultOverviewEarnBlockManagement.vue |  34 +----
 composables/useOracleRouterGovernor.ts        |  73 +++++++++
 composables/useSafeAddressInfo.ts             | 100 +++++++++++++
 .../useOracleRouterGovernor.test.ts           |  80 ++++++++++
 tests/composables/useSafeAddressInfo.test.ts  | 139 ++++++++++++++++++
 tests/utils/onchain-lookup-cache.test.ts      |  79 ++++++++++
 tests/utils/safe-account.test.ts              |  52 +++++++
 utils/onchain-lookup-cache.ts                 |  58 ++++++++
 utils/safe-account.ts                         |  66 +++++++++
 17 files changed, 823 insertions(+), 159 deletions(-)
 create mode 100644 abis/safe.ts
 create mode 100644 assets/sprite/svg/safe.svg
 create mode 100644 components/entities/safe/SafeAccountBadge.vue
 create mode 100644 components/entities/vault/overview/VaultOverviewAddressValue.vue
 create mode 100644 composables/useOracleRouterGovernor.ts
 create mode 100644 composables/useSafeAddressInfo.ts
 create mode 100644 tests/composables/useOracleRouterGovernor.test.ts
 create mode 100644 tests/composables/useSafeAddressInfo.test.ts
 create mode 100644 tests/utils/onchain-lookup-cache.test.ts
 create mode 100644 tests/utils/safe-account.test.ts
 create mode 100644 utils/onchain-lookup-cache.ts
 create mode 100644 utils/safe-account.ts

diff --git a/abis/oracle.ts b/abis/oracle.ts
index 264517081..b240d30f9 100644
--- a/abis/oracle.ts
+++ b/abis/oracle.ts
@@ -1,3 +1,14 @@
+/** `governor()` getter from euler-price-oracle's Governable (EulerRouter). */
+export const governableGovernorAbi = [
+  {
+    type: 'function',
+    name: 'governor',
+    inputs: [],
+    outputs: [{ name: 'governor', type: 'address' }],
+    stateMutability: 'view',
+  },
+] as const
+
 export const priceOracleAbi = [
   {
     type: 'function',
diff --git a/abis/safe.ts b/abis/safe.ts
new file mode 100644
index 000000000..7aaec779c
--- /dev/null
+++ b/abis/safe.ts
@@ -0,0 +1,33 @@
+/**
+ * Minimal fragments for probing Safe (ex Gnosis Safe) smart accounts.
+ *
+ * `masterCopy()` is not a regular function on the Safe singleton — Safe proxy
+ * contracts (v1.1.1+) special-case the `0xa619486e` selector in their fallback
+ * and return the singleton address stored at slot 0 without delegating. An
+ * `eth_call` against any Safe proxy therefore answers it, while EOAs return
+ * empty data and non-Safe contracts revert or return garbage that fails
+ * decoding.
+ */
+export const safeAccountAbi = [
+  {
+    type: 'function',
+    name: 'masterCopy',
+    inputs: [],
+    outputs: [{ name: 'masterCopy', type: 'address' }],
+    stateMutability: 'view',
+  },
+  {
+    type: 'function',
+    name: 'getThreshold',
+    inputs: [],
+    outputs: [{ name: 'threshold', type: 'uint256' }],
+    stateMutability: 'view',
+  },
+  {
+    type: 'function',
+    name: 'getOwners',
+    inputs: [],
+    outputs: [{ name: 'owners', type: 'address[]' }],
+    stateMutability: 'view',
+  },
+] as const
diff --git a/assets/sprite/svg/safe.svg b/assets/sprite/svg/safe.svg
new file mode 100644
index 000000000..c0dd53f94
--- /dev/null
+++ b/assets/sprite/svg/safe.svg
@@ -0,0 +1 @@
+<svg width="24" height="24" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M21.757 11.998h-2.485c-.742 0-1.343.579-1.343 1.293v3.47c0 .714-.602 1.293-1.344 1.293H6.699c-.743 0-1.344.578-1.344 1.292v2.391c0 .714.601 1.293 1.344 1.293h10.458c.742 0 1.335-.579 1.335-1.293V19.82c0-.714.602-1.22 1.344-1.22h1.92c.743 0 1.344-.58 1.344-1.293v-4.03c0-.714-.601-1.278-1.343-1.278ZM5.355 7.249c0-.714.6-1.293 1.343-1.293h9.88c.743 0 1.344-.579 1.344-1.293v-2.39c0-.714-.601-1.293-1.344-1.293H6.125c-.742 0-1.343.579-1.343 1.293v1.842c0 .714-.602 1.292-1.344 1.292H1.526C.784 5.407.182 5.986.182 6.7v4.034c0 .714.604 1.264 1.346 1.264h2.485c.743 0 1.344-.579 1.344-1.293L5.355 7.25ZM10.472 9.485h2.387c.778 0 1.409.608 1.409 1.356v2.296c0 .748-.632 1.356-1.41 1.356h-2.386c-.778 0-1.409-.608-1.409-1.356v-2.296c0-.749.632-1.356 1.409-1.356Z" fill="currentColor"/></svg>
diff --git a/components/entities/safe/SafeAccountBadge.vue b/components/entities/safe/SafeAccountBadge.vue
new file mode 100644
index 000000000..b1286b300
--- /dev/null
+++ b/components/entities/safe/SafeAccountBadge.vue
@@ -0,0 +1,38 @@
+<script setup lang="ts">
+import { shortenAddress } from '~/utils/string-utils'
+
+const { address } = defineProps<{ address: string }>()
+
+const { safeInfo } = useSafeAddressInfo(() => address)
+
+const tooltipSections = computed(() => {
+  if (!safeInfo.value) return []
+  const { threshold, owners, version } = safeInfo.value
+  return [
+    {
+      title: `Safe smart account (v${version})`,
+      text: `Executing a transaction from this address requires ${threshold} of its ${owners.length} owner signatures.`,
+    },
+    {
+      title: `Owners (${owners.length})`,
+      text: owners.map(owner => shortenAddress(owner)).join(', '),
+    },
+  ]
+})
+</script>
+
+<template>
+  <UiHoverPreviewTooltip
+    v-if="safeInfo"
+    title="Safe multisig"
+    :sections="tooltipSections"
+  >
+    <span class="flex items-center gap-4 text-content-secondary">
+      <SvgIcon
+        class="!w-14 !h-14"
+        name="safe"
+      />
+      <span class="text-p5">({{ safeInfo.threshold }}/{{ safeInfo.owners.length }})</span>
+    </span>
+  </UiHoverPreviewTooltip>
+</template>
diff --git a/components/entities/vault/overview/SecuritizeVaultOverview.vue b/components/entities/vault/overview/SecuritizeVaultOverview.vue
index 5febee351..8b4df7d51 100644
--- a/components/entities/vault/overview/SecuritizeVaultOverview.vue
+++ b/components/entities/vault/overview/SecuritizeVaultOverview.vue
@@ -5,10 +5,8 @@ import { getProductByVault, getProductKeyByVault, isVaultGovernanceLimited } fro
 import { getEulerLabelEntityLogo } from '~/entities/euler/labels'
 import { isVaultBlockedByCountry } from '~/composables/useGeoBlock'
 import { autoLink } from '~/utils/autoLink'
-import { getExplorerLink } from '~/utils/block-explorer'
-import { getSpecialAddressLabel } from '~/utils/special-addresses'
 import { formatAssetValue } from '~/utils/sdk-prices'
-import { formatNumber, compactNumber, formatUsdValue, formatCompactUsdValue, shortenAddress } from '~/utils/string-utils'
+import { formatNumber, compactNumber, formatUsdValue, formatCompactUsdValue } from '~/utils/string-utils'
 import { nanoToValue } from '~/utils/crypto-utils'
 import { formatMarketAvailability } from '~/utils/vault-display'
 import { VaultApyModal } from '#components'
@@ -23,7 +21,6 @@ const emit = defineEmits<{
 const route = useRoute()
 const { enableEntityBranding: enableEntityBrandingDisplay, enableVaultType: enableVaultTypeDisplay } = useDeployConfig()
 
-const { chainId } = useEulerAddresses()
 const { borrowList: _borrowList, isVaultGovernorVerified } = useVaults()
 const { settings } = useUserSettings()
 const enableIntrinsicApy = computed(() => settings.value.enableIntrinsicApy)
@@ -45,14 +42,6 @@ const isDeprecated = computed(() => {
 const deprecationReason = computed(() => isDeprecated.value ? product.deprecationReason || '' : '')
 const isRestricted = computed(() => isVaultBlockedByCountry(vault.address))
 
-const { copyToClipboard } = useClipboardCopy()
-
-const onCopyClick = (address: string) => {
-  copyToClipboard(address).catch(() => {})
-}
-
-const getExplorerAddressLink = (address: string) => getExplorerLink(address, chainId.value, true)
-
 // Count markets where this can be borrowed (securitize vaults cannot be borrow destinations)
 const borrowCount = computed(() => 0)
 
@@ -330,71 +319,23 @@ const supplyCapPercentageDisplay = computed(() => {
         :label="`${vault.asset.symbol} token`"
         orientation="horizontal"
       >
-        <div class="flex gap-4 items-center">
-          <NuxtLink
-            :to="getExplorerAddressLink(vault.asset.address)"
-            class="text-accent-600 underline cursor-pointer hover:text-accent-500"
-            target="_blank"
-          >
-            {{ getSpecialAddressLabel(vault.asset.address) || shortenAddress(vault.asset.address) }}
-          </NuxtLink>
-          <button
-            class="text-content-muted cursor-pointer outline-none hover:text-content-secondary active:text-content-primary"
-            @click="onCopyClick(vault.asset.address)"
-          >
-            <SvgIcon
-              class="!w-18 !h-18"
-              name="copy"
-            />
-          </button>
-        </div>
+        <VaultOverviewAddressValue :address="vault.asset.address" />
       </VaultOverviewLabelValue>
       <VaultOverviewLabelValue
         :label="`${vault.asset.symbol} vault`"
         orientation="horizontal"
       >
-        <div class="flex gap-4 items-center">
-          <NuxtLink
-            :to="getExplorerAddressLink(vault.address)"
-            class="text-accent-600 underline cursor-pointer hover:text-accent-500"
-            target="_blank"
-          >
-            {{ getSpecialAddressLabel(vault.address) || shortenAddress(vault.address) }}
-          </NuxtLink>
-          <button
-            class="text-content-muted cursor-pointer outline-none hover:text-content-secondary active:text-content-primary"
-            @click="onCopyClick(vault.address)"
-          >
-            <SvgIcon
-              class="!w-18 !h-18"
-              name="copy"
-            />
-          </button>
-        </div>
+        <VaultOverviewAddressValue :address="vault.address" />
       </VaultOverviewLabelValue>
       <VaultOverviewLabelValue
         v-if="vault.governor && vault.governor !== '0x0000000000000000000000000000000000000000'"
         label="Risk manager"
         orientation="horizontal"
       >
-        <div class="flex gap-4 items-center">
-          <NuxtLink
-            :to="getExplorerAddressLink(vault.governor)"
-            class="text-accent-600 underline cursor-pointer hover:text-accent-500"
-            target="_blank"
-          >
-            {{ getSpecialAddressLabel(vault.governor) || shortenAddress(vault.governor) }}
-          </NuxtLink>
-          <button
-            class="text-content-muted cursor-pointer outline-none hover:text-content-secondary active:text-content-primary"
-            @click="onCopyClick(vault.governor)"
-          >
-            <SvgIcon
-              class="!w-18 !h-18"
-              name="copy"
-            />
-          </button>
-        </div>
+        <VaultOverviewAddressValue
+          :address="vault.governor"
+          check-safe
+        />
       </VaultOverviewLabelValue>
     </VaultOverviewAccordionSection>
   </div>
diff --git a/components/entities/vault/overview/VaultOverviewAddressValue.vue b/components/entities/vault/overview/VaultOverviewAddressValue.vue
new file mode 100644
index 000000000..e22faee47
--- /dev/null
+++ b/components/entities/vault/overview/VaultOverviewAddressValue.vue
@@ -0,0 +1,50 @@
+<script setup lang="ts">
+import { getExplorerLink } from '~/utils/block-explorer'
+import { getSpecialAddressLabel } from '~/utils/special-addresses'
+import { shortenAddress } from '~/utils/string-utils'
+
+const { address, checkSafe = false } = defineProps<{
+  address: string
+  /**
+   * Probe the address for being a Safe multisig and render the badge.
+   * Enable only for governance-related addresses — token/vault/IRM rows are
+   * known contracts and would just waste probes.
+   */
+  checkSafe?: boolean
+}>()
+
+const { chainId } = useEulerAddresses()
+const { copyToClipboard } = useClipboardCopy()
+
+const explorerLink = computed(() => getExplorerLink(address, chainId.value, true))
+const displayLabel = computed(() => getSpecialAddressLabel(address) || shortenAddress(address))
+
+const onCopyClick = () => {
+  copyToClipboard(address).catch(() => {})
+}
+</script>
+
+<template>
+  <div class="flex gap-4 items-center">
+    <NuxtLink
+      :to="explorerLink"
+      class="text-accent-600 underline cursor-pointer hover:text-accent-500"
+      target="_blank"
+    >
+      {{ displayLabel }}
+    </NuxtLink>
+    <SafeAccountBadge
+      v-if="checkSafe"
+      :address="address"
+    />
+    <button
+      class="text-content-muted cursor-pointer outline-none hover:text-content-secondary active:text-content-primary"
+      @click="onCopyClick"
+    >
+      <SvgIcon
+        class="!w-18 !h-18"
+        name="copy"
+      />
+    </button>
+  </div>
+</template>
diff --git a/components/entities/vault/overview/VaultOverviewBlockAddresses.vue b/components/entities/vault/overview/VaultOverviewBlockAddresses.vue
index db98148f5..e014ca6db 100644
--- a/components/entities/vault/overview/VaultOverviewBlockAddresses.vue
+++ b/components/entities/vault/overview/VaultOverviewBlockAddresses.vue
@@ -1,15 +1,10 @@
 <script setup lang="ts">
 import type { EVault } from '@eulerxyz/euler-v2-sdk'
-import { getExplorerLink } from '~/utils/block-explorer'
-import { getSpecialAddressLabel } from '~/utils/special-addresses'
 import { getVaultHookTarget } from '~/utils/vault-hooks'
 import { isVaultBorrowable } from '~/utils/vault/classification'
-import { shortenAddress } from '~/utils/string-utils'
 
 const { vault, defaultOpen = true } = defineProps<{ vault: EVault, defaultOpen?: boolean }>()
 
-const { chainId } = useEulerAddresses()
-
 // Surface borrow-side addresses while debt is being wound down, not only while
 // new borrows are allowed (see isVaultBorrowable).
 const isBorrowable = computed(() => isVaultBorrowable(vault))
@@ -18,8 +13,14 @@ const interestRateModelAddress = computed(() =>
   vault.interestRateModel.address,
 )
 
+const oracleRouterAddress = computed(() =>
+  vault.oracle.name === 'EulerRouter' ? vault.oracle.oracle : null,
+)
+
+const { governor: oracleGovernor } = useOracleRouterGovernor(oracleRouterAddress)
+
 const vaultAddresesInfo = computed(() => {
-  const baseAddresses: Array<{ title: string, address?: string }> = [
+  const baseAddresses: Array<{ title: string, address?: string, checkSafe?: boolean }> = [
     {
       title: `${vault.asset.symbol} token`,
       address: vault.asset.address,
@@ -43,6 +44,7 @@ const vaultAddresesInfo = computed(() => {
     {
       title: `Risk manager`,
       address: vault.governorAdmin,
+      checkSafe: true,
     },
   )
 
@@ -51,11 +53,25 @@ const vaultAddresesInfo = computed(() => {
       {
         title: `Fee receiver`,
         address: vault.fees.governorFeeReceiver,
+        checkSafe: true,
       },
       {
         title: `Oracle router`,
         address: vault.oracle.oracle,
       },
+    )
+
+    if (oracleGovernor.value) {
+      baseAddresses.push(
+        {
+          title: `Oracle governor`,
+          address: oracleGovernor.value,
+          checkSafe: true,
+        },
+      )
+    }
+
+    baseAddresses.push(
       {
         title: `Unit of account`,
         address: vault.unitOfAccount?.address,
@@ -74,16 +90,8 @@ const vaultAddresesInfo = computed(() => {
     },
   )
 
-  return baseAddresses.filter((item): item is { title: string, address: string } => Boolean(item.address))
+  return baseAddresses.filter((item): item is { title: string, address: string, checkSafe?: boolean } => Boolean(item.address))
 })
-
-const { copyToClipboard } = useClipboardCopy()
-
-const onCopyClick = (address: string) => {
-  copyToClipboard(address).catch(() => {})
-}
-
-const getExplorerAddressLink = (address: string) => getExplorerLink(address, chainId.value, true)
 </script>
 
 <template>
@@ -111,24 +119,10 @@ const getExplorerAddressLink = (address: string) => getExplorerLink(address, cha
           />
         </span>
       </template>
-      <div class="flex gap-4 items-center">
-        <NuxtLink
-          :to="getExplorerAddressLink(infoItem.address)"
-          class="text-accent-600 underline cursor-pointer hover:text-accent-500"
-          target="_blank"
-        >
-          {{ getSpecialAddressLabel(infoItem.address) || shortenAddress(infoItem.address) }}
-        </NuxtLink>
-        <button
-          class="text-content-muted cursor-pointer outline-none hover:text-content-secondary active:text-content-primary"
-          @click="onCopyClick(infoItem.address)"
-        >
-          <SvgIcon
-            class="!w-18 !h-18"
-            name="copy"
-          />
-        </button>
-      </div>
+      <VaultOverviewAddressValue
+        :address="infoItem.address"
+        :check-safe="infoItem.checkSafe"
+      />
     </VaultOverviewLabelValue>
   </VaultOverviewAccordionSection>
 </template>
diff --git a/components/entities/vault/overview/earn/VaultOverviewEarnBlockAddresses.vue b/components/entities/vault/overview/earn/VaultOverviewEarnBlockAddresses.vue
index be700b9f7..af0d531de 100644
--- a/components/entities/vault/overview/earn/VaultOverviewEarnBlockAddresses.vue
+++ b/components/entities/vault/overview/earn/VaultOverviewEarnBlockAddresses.vue
@@ -1,11 +1,7 @@
 <script setup lang="ts">
 import type { EulerEarn } from '@eulerxyz/euler-v2-sdk'
-import { getExplorerLink } from '~/utils/block-explorer'
-import { getSpecialAddressLabel } from '~/utils/special-addresses'
-import { shortenAddress } from '~/utils/string-utils'
 
 const { vault, defaultOpen = true } = defineProps<{ vault: EulerEarn, defaultOpen?: boolean }>()
-const { chainId } = useEulerAddresses()
 
 const vaultAddresesInfo = computed(() => ([
   {
@@ -19,16 +15,9 @@ const vaultAddresesInfo = computed(() => ([
   {
     title: `Fee receiver`,
     address: vault.governance.feeReceiver,
+    checkSafe: true,
   },
 ]))
-
-const { copyToClipboard } = useClipboardCopy()
-
-const onCopyClick = (address: string) => {
-  copyToClipboard(address).catch(() => {})
-}
-
-const getExplorerAddressLink = (address: string) => getExplorerLink(address, chainId.value, true)
 </script>
 
 <template>
@@ -43,24 +32,10 @@ const getExplorerAddressLink = (address: string) => getExplorerLink(address, cha
       :label="infoItem.title"
       orientation="horizontal"
     >
-      <div class="flex gap-4 items-center">
-        <NuxtLink
-          :to="getExplorerAddressLink(infoItem.address)"
-          class="text-accent-600 underline cursor-pointer hover:text-accent-500"
-          target="_blank"
-        >
-          {{ getSpecialAddressLabel(infoItem.address) || shortenAddress(infoItem.address) }}
-        </NuxtLink>
-        <button
-          class="text-neutral-400 cursor-pointer outline-none hover:text-neutral-600 active:text-neutral-700"
-          @click="onCopyClick(infoItem.address)"
-        >
-          <SvgIcon
-            class="!w-18 !h-18"
-            name="copy"
-          />
-        </button>
-      </div>
+      <VaultOverviewAddressValue
+        :address="infoItem.address"
+        :check-safe="infoItem.checkSafe"
+      />
     </VaultOverviewLabelValue>
   </VaultOverviewAccordionSection>
 </template>
diff --git a/components/entities/vault/overview/earn/VaultOverviewEarnBlockManagement.vue b/components/entities/vault/overview/earn/VaultOverviewEarnBlockManagement.vue
index 07bc1a585..2e58b4cad 100644
--- a/components/entities/vault/overview/earn/VaultOverviewEarnBlockManagement.vue
+++ b/components/entities/vault/overview/earn/VaultOverviewEarnBlockManagement.vue
@@ -1,12 +1,8 @@
 <script setup lang="ts">
 import type { EulerEarn } from '@eulerxyz/euler-v2-sdk'
 import { formatTtl } from '~/utils/crypto-utils'
-import { getExplorerLink } from '~/utils/block-explorer'
-import { getSpecialAddressLabel } from '~/utils/special-addresses'
-import { shortenAddress } from '~/utils/string-utils'
 
 const { vault, defaultOpen = true } = defineProps<{ vault: EulerEarn, defaultOpen?: boolean }>()
-const { chainId } = useEulerAddresses()
 
 const vaultAddressesInfo = computed(() => ([
   {
@@ -23,8 +19,6 @@ const vaultAddressesInfo = computed(() => ([
   },
 ]))
 
-const { copyToClipboard } = useClipboardCopy()
-
 const timelockDisplay = computed(() => {
   if (vault.governance.timelock === 0) {
     return '0 days'
@@ -34,12 +28,6 @@ const timelockDisplay = computed(() => {
   const timelockInDays = BigInt(Math.floor(timelockInSeconds / 86400))
   return formatTtl(timelockInDays)?.display || 'Unknown'
 })
-
-const onCopyClick = (address: string) => {
-  copyToClipboard(address).catch(() => {})
-}
-
-const getExplorerAddressLink = (address: string) => getExplorerLink(address, chainId.value, true)
 </script>
 
 <template>
@@ -54,24 +42,10 @@ const getExplorerAddressLink = (address: string) => getExplorerLink(address, cha
       :label="infoItem.title"
       orientation="horizontal"
     >
-      <div class="flex gap-4 items-center">
-        <NuxtLink
-          :to="getExplorerAddressLink(infoItem.address)"
-          class="text-accent-600 underline cursor-pointer hover:text-accent-500"
-          target="_blank"
-        >
-          {{ getSpecialAddressLabel(infoItem.address) || shortenAddress(infoItem.address) }}
-        </NuxtLink>
-        <button
-          class="text-neutral-400 cursor-pointer outline-none hover:text-neutral-600 active:text-neutral-700"
-          @click="onCopyClick(infoItem.address)"
-        >
-          <SvgIcon
-            class="!w-18 !h-18"
-            name="copy"
-          />
-        </button>
-      </div>
+      <VaultOverviewAddressValue
+        :address="infoItem.address"
+        check-safe
+      />
     </VaultOverviewLabelValue>
     <VaultOverviewLabelValue
       label="Timelock"
diff --git a/composables/useOracleRouterGovernor.ts b/composables/useOracleRouterGovernor.ts
new file mode 100644
index 000000000..b79713f63
--- /dev/null
+++ b/composables/useOracleRouterGovernor.ts
@@ -0,0 +1,73 @@
+import { computed, toValue, watch, type MaybeRefOrGetter } from 'vue'
+import { getAddress, isAddress, type Address, type PublicClient } from 'viem'
+import { governableGovernorAbi } from '~/abis/oracle'
+import { createOnchainLookupCache } from '~/utils/onchain-lookup-cache'
+
+// Router governance changes rarely; 5 min matches the app's other caches.
+const CACHE_TTL_MS = 5 * 60_000
+
+const governorCache = createOnchainLookupCache<Address | null>(CACHE_TTL_MS)
+
+const probeGovernor = async (
+  client: PublicClient,
+  router: Address,
+): Promise<Address | null> => {
+  try {
+    const governor = await client.readContract({
+      address: router,
+      abi: governableGovernorAbi,
+      functionName: 'governor',
+      authorizationList: undefined,
+    })
+    return getAddress(governor)
+  }
+  catch {
+    // Not a Governable contract (or empty call data) — no governor to show.
+    return null
+  }
+}
+
+/**
+ * Reactive `governor()` lookup for an EulerRouter address.
+ *
+ * `governor` stays `undefined` until resolved; a resolved `null` means the
+ * contract has no readable governor (don't render a row). The zero address is
+ * passed through — it means governance was renounced, which is worth showing.
+ */
+export const useOracleRouterGovernor = (
+  routerAddress: MaybeRefOrGetter<string | null | undefined>,
+) => {
+  const { chainId } = useEulerAddresses()
+  const { client } = useRpcClient()
+
+  const probeAddress = computed<Address | null>(() => {
+    const value = toValue(routerAddress)
+    if (!value || !isAddress(value)) return null
+    return getAddress(value)
+  })
+
+  const cacheKey = computed(() => {
+    if (!probeAddress.value || !chainId.value) return null
+    return `${chainId.value}:${probeAddress.value.toLowerCase()}`
+  })
+
+  watch(
+    [cacheKey, client],
+    ([key, rpcClient]) => {
+      // Probe client-side only — SSR output renders without the row and
+      // hydrates identically (the client cache starts empty too).
+      if (import.meta.server) return
+      const target = probeAddress.value
+      if (!key || !rpcClient || !target) return
+      governorCache.load(key, () => probeGovernor(rpcClient, target)).catch(() => {})
+    },
+    { immediate: true },
+  )
+
+  const governor = computed<Address | null | undefined>(() => {
+    if (!cacheKey.value) return undefined
+    return governorCache.read(cacheKey.value)
+  })
+
+  return { governor }
+}
diff --git a/composables/useSafeAddressInfo.ts b/composables/useSafeAddressInfo.ts
new file mode 100644
index 000000000..b4c744810
--- /dev/null
+++ b/composables/useSafeAddressInfo.ts
@@ -0,0 +1,100 @@
+import { computed, toValue, watch, type MaybeRefOrGetter } from 'vue'
+import { getAddress, isAddress, type Address, type PublicClient } from 'viem'
+import { safeAccountAbi } from '~/abis/safe'
+import { createOnchainLookupCache } from '~/utils/onchain-lookup-cache'
+import { getSpecialAddressLabel } from '~/utils/special-addresses'
+import { resolveSafeAccountInfo, type SafeAccountInfo } from '~/utils/safe-account'
+
+// Threshold/owners can change over time; 5 min matches the app's other caches.
+const CACHE_TTL_MS = 5 * 60_000
+
+const safeInfoCache = createOnchainLookupCache<SafeAccountInfo | null>(CACHE_TTL_MS)
+
+/**
+ * Probe whether an address is a Safe smart account.
+ *
+ * All three reads fire concurrently — the transport batches them into a
+ * single RPC request. EOAs return empty call data and non-Safe contracts
+ * revert on the unknown selectors, so failed reads mean "not a Safe" rather
+ * than an error. Only a rejected `masterCopy()` matching a known singleton
+ * would be ambiguous, and that combination cannot occur.
+ */
+const probeSafeAccount = async (
+  client: PublicClient,
+  address: Address,
+): Promise<SafeAccountInfo | null> => {
+  const [masterCopy, threshold, owners] = await Promise.allSettled([
+    client.readContract({
+      address,
+      abi: safeAccountAbi,
+      functionName: 'masterCopy',
+      authorizationList: undefined,
+    }),
+    client.readContract({
+      address,
+      abi: safeAccountAbi,
+      functionName: 'getThreshold',
+      authorizationList: undefined,
+    }),
+    client.readContract({
+      address,
+      abi: safeAccountAbi,
+      functionName: 'getOwners',
+      authorizationList: undefined,
+    }),
+  ])
+
+  return resolveSafeAccountInfo(
+    masterCopy.status === 'fulfilled' ? masterCopy.value : null,
+    threshold.status === 'fulfilled' ? threshold.value : null,
+    owners.status === 'fulfilled' ? owners.value : null,
+  )
+}
+
+/**
+ * Reactive Safe detection for a displayed address.
+ *
+ * `safeInfo` is `null` until the probe resolves positively — callers just
+ * hide the badge for non-Safes, unknowns, and while loading. Probing runs
+ * client-side only; results are cached per `${chainId}:${address}` across
+ * component instances.
+ */
+export const useSafeAddressInfo = (
+  address: MaybeRefOrGetter<string | null | undefined>,
+) => {
+  const { chainId } = useEulerAddresses()
+  const { client } = useRpcClient()
+
+  const probeAddress = computed<Address | null>(() => {
+    const value = toValue(address)
+    if (!value || !isAddress(value)) return null
+    // Sentinel addresses (zero/USD/ETH/BTC) are never Safes — skip the probe.
+    if (getSpecialAddressLabel(value)) return null
+    return getAddress(value)
+  })
+
+  const cacheKey = computed(() => {
+    if (!probeAddress.value || !chainId.value) return null
+    return `${chainId.value}:${probeAddress.value.toLowerCase()}`
+  })
+
+  watch(
+    [cacheKey, client],
+    ([key, rpcClient]) => {
+      // Probe client-side only — SSR output renders without badges and
+      // hydrates identically (the client cache starts empty too).
+      if (import.meta.server) return
+      const target = probeAddress.value
+      if (!key || !rpcClient || !target) return
+      safeInfoCache.load(key, () => probeSafeAccount(rpcClient, target)).catch(() => {})
+    },
+    { immediate: true },
+  )
+
+  const safeInfo = computed<SafeAccountInfo | null>(() => {
+    if (!cacheKey.value) return null
+    return safeInfoCache.read(cacheKey.value) ?? null
+  })
+
+  return { safeInfo }
+}
diff --git a/tests/composables/useOracleRouterGovernor.test.ts b/tests/composables/useOracleRouterGovernor.test.ts
new file mode 100644
index 000000000..4bf093e8d
--- /dev/null
+++ b/tests/composables/useOracleRouterGovernor.test.ts
@@ -0,0 +1,80 @@
+import { ref } from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const ROUTER_ADDRESS = '0x00000000000000000000000000000000000000cc'
+const GOVERNOR_ADDRESS = '0x00000000000000000000000000000000000000dd'
+const ZERO_ADDRESS = '0x0000000000000000000000000000000000000000'
+
+const stubEnvironment = (client: unknown) => {
+  vi.stubGlobal('useEulerAddresses', () => ({ chainId: ref(1) }))
+  vi.stubGlobal('useRpcClient', () => ({ client: ref(client) }))
+}
+
+const importComposable = async () => {
+  const { useOracleRouterGovernor } = await import('~/composables/useOracleRouterGovernor')
+  return useOracleRouterGovernor
+}
+
+describe('useOracleRouterGovernor', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.unstubAllGlobals()
+  })
+
+  it('resolves the router governor', async () => {
+    const client = { readContract: vi.fn(async () => GOVERNOR_ADDRESS) }
+    stubEnvironment(client)
+    const useOracleRouterGovernor = await importComposable()
+
+    const { governor } = useOracleRouterGovernor(() => ROUTER_ADDRESS)
+    await vi.waitFor(() => expect(governor.value).toBeTruthy())
+    expect(governor.value?.toLowerCase()).toBe(GOVERNOR_ADDRESS)
+  })
+
+  it('passes through the zero address for renounced governance', async () => {
+    const client = { readContract: vi.fn(async () => ZERO_ADDRESS) }
+    stubEnvironment(client)
+    const useOracleRouterGovernor = await importComposable()
+
+    const { governor } = useOracleRouterGovernor(() => ROUTER_ADDRESS)
+    await vi.waitFor(() => expect(governor.value).toBe(ZERO_ADDRESS))
+  })
+
+  it('resolves null when the contract has no readable governor', async () => {
+    const client = {
+      readContract: vi.fn(async () => {
+        throw new Error('execution reverted')
+      }),
+    }
+    stubEnvironment(client)
+    const useOracleRouterGovernor = await importComposable()
+
+    const { governor } = useOracleRouterGovernor(() => ROUTER_ADDRESS)
+    await vi.waitFor(() => expect(client.readContract).toHaveBeenCalled())
+    await Promise.resolve()
+    expect(governor.value).toBeNull()
+  })
+
+  it('stays undefined without a router address and never probes', async () => {
+    const client = { readContract: vi.fn() }
+    stubEnvironment(client)
+    const useOracleRouterGovernor = await importComposable()
+
+    const { governor } = useOracleRouterGovernor(() => null)
+    await Promise.resolve()
+    expect(governor.value).toBeUndefined()
+    expect(client.readContract).not.toHaveBeenCalled()
+  })
+
+  it('caches lookups across instances', async () => {
+    const client = { readContract: vi.fn(async () => GOVERNOR_ADDRESS) }
+    stubEnvironment(client)
+    const useOracleRouterGovernor = await importComposable()
+
+    const first = useOracleRouterGovernor(() => ROUTER_ADDRESS)
+    await vi.waitFor(() => expect(first.governor.value).toBeTruthy())
+    const second = useOracleRouterGovernor(() => ROUTER_ADDRESS)
+    await vi.waitFor(() => expect(second.governor.value).toBeTruthy())
+    expect(client.readContract).toHaveBeenCalledTimes(1)
+  })
+})
diff --git a/tests/composables/useSafeAddressInfo.test.ts b/tests/composables/useSafeAddressInfo.test.ts
new file mode 100644
index 000000000..e9136b077
--- /dev/null
+++ b/tests/composables/useSafeAddressInfo.test.ts
@@ -0,0 +1,139 @@
+import { ref } from 'vue'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const SAFE_ADDRESS = '0x00000000000000000000000000000000000000aa'
+const OTHER_ADDRESS = '0x00000000000000000000000000000000000000bb'
+const ZERO_ADDRESS = '0x0000000000000000000000000000000000000000'
+const SAFE_141_SINGLETON = '0x41675C099F32341bf84BFc5382aF534df5C7461a'
+const UNKNOWN_SINGLETON = '0x1111111111111111111111111111111111111111'
+
+const OWNERS = [
+  '0x00000000000000000000000000000000000000a1',
+  '0x00000000000000000000000000000000000000a2',
+  '0x00000000000000000000000000000000000000a3',
+  '0x00000000000000000000000000000000000000a4',
+  '0x00000000000000000000000000000000000000a5',
+  '0x00000000000000000000000000000000000000a6',
+  '0x00000000000000000000000000000000000000a7',
+]
+
+type ReadContractArgs = { address: string, functionName: string }
+
+const safeClient = (singleton: string = SAFE_141_SINGLETON) => {
+  const calls: ReadContractArgs[] = []
+  return {
+    calls,
+    readContract: vi.fn(async ({ address, functionName }: ReadContractArgs) => {
+      calls.push({ address, functionName })
+      if (functionName === 'masterCopy') return singleton
+      if (functionName === 'getThreshold') return 3n
+      if (functionName === 'getOwners') return OWNERS
+      throw new Error(`unexpected function ${functionName}`)
+    }),
+  }
+}
+
+const eoaClient = () => ({
+  readContract: vi.fn(async () => {
+    throw new Error('returned no data ("0x")')
+  }),
+})
+
+const stubEnvironment = (client: unknown) => {
+  vi.stubGlobal('useEulerAddresses', () => ({ chainId: ref(1) }))
+  vi.stubGlobal('useRpcClient', () => ({ client: ref(client) }))
+}
+
+const importComposable = async () => {
+  const { useSafeAddressInfo } = await import('~/composables/useSafeAddressInfo')
+  return useSafeAddressInfo
+}
+
+describe('useSafeAddressInfo', () => {
+  beforeEach(() => {
+    vi.resetModules()
+    vi.unstubAllGlobals()
+  })
+
+  it('detects a Safe and exposes threshold and owners', async () => {
+    const client = safeClient()
+    stubEnvironment(client)
+    const useSafeAddressInfo = await importComposable()
+
+    const { safeInfo } = useSafeAddressInfo(() => SAFE_ADDRESS)
+    expect(safeInfo.value).toBeNull()
+
+    await vi.waitFor(() => expect(safeInfo.value).not.toBeNull())
+    expect(safeInfo.value).toEqual({
+      version: '1.4.1',
+      threshold: 3,
+      owners: OWNERS,
+    })
+    expect(client.calls.map(call => call.functionName).sort()).toEqual(
+      ['getOwners', 'getThreshold', 'masterCopy'],
+    )
+  })
+
+  it('reports null for a proxy pointing at an unknown singleton', async () => {
+    const client = safeClient(UNKNOWN_SINGLETON)
+    stubEnvironment(client)
+    const useSafeAddressInfo = await importComposable()
+
+    const { safeInfo } = useSafeAddressInfo(() => SAFE_ADDRESS)
+    await vi.waitFor(() => expect(client.readContract).toHaveBeenCalled())
+    await Promise.resolve()
+    expect(safeInfo.value).toBeNull()
+  })
+
+  it('reports null for EOAs and non-Safe contracts', async () => {
+    const client = eoaClient()
+    stubEnvironment(client)
+    const useSafeAddressInfo = await importComposable()
+
+    const { safeInfo } = useSafeAddressInfo(() => SAFE_ADDRESS)
+    await vi.waitFor(() => expect(client.readContract).toHaveBeenCalledTimes(3))
+    await Promise.resolve()
+    expect(safeInfo.value).toBeNull()
+  })
+
+  it('never probes sentinel or invalid addresses', async () => {
+    const client = safeClient()
+    stubEnvironment(client)
+    const useSafeAddressInfo = await importComposable()
+
+    useSafeAddressInfo(() => ZERO_ADDRESS)
+    useSafeAddressInfo(() => 'not-an-address')
+    useSafeAddressInfo(() => null)
+
+    await Promise.resolve()
+    expect(client.readContract).not.toHaveBeenCalled()
+  })
+
+  it('shares the cache between composable instances', async () => {
+    const client = safeClient()
+    stubEnvironment(client)
+    const useSafeAddressInfo = await importComposable()
+
+    const first = useSafeAddressInfo(() => SAFE_ADDRESS)
+    await vi.waitFor(() => expect(first.safeInfo.value).not.toBeNull())
+
+    const second = useSafeAddressInfo(() => SAFE_ADDRESS)
+    await vi.waitFor(() => expect(second.safeInfo.value).not.toBeNull())
+    // 3 reads for the first instance, none for the second.
+    expect(client.readContract).toHaveBeenCalledTimes(3)
+  })
+
+  it('probes distinct addresses independently', async () => {
+    const client = safeClient()
+    stubEnvironment(client)
+    const useSafeAddressInfo = await importComposable()
+
+    const first = useSafeAddressInfo(() => SAFE_ADDRESS)
+    const second = useSafeAddressInfo(() => OTHER_ADDRESS)
+    await vi.waitFor(() => expect(first.safeInfo.value).not.toBeNull())
+    await vi.waitFor(() => expect(second.safeInfo.value).not.toBeNull())
+
+    const probedAddresses = new Set(client.calls.map(call => call.address.toLowerCase()))
+    expect(probedAddresses).toEqual(new Set([SAFE_ADDRESS, OTHER_ADDRESS]))
+  })
+})
diff --git a/tests/utils/onchain-lookup-cache.test.ts b/tests/utils/onchain-lookup-cache.test.ts
new file mode 100644
index 000000000..51b3264a1
--- /dev/null
+++ b/tests/utils/onchain-lookup-cache.test.ts
@@ -0,0 +1,79 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createOnchainLookupCache } from '~/utils/onchain-lookup-cache'
+
+describe('createOnchainLookupCache', () => {
+  beforeEach(() => {
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+  })
+
+  it('caches probe results within the TTL', async () => {
+    const cache = createOnchainLookupCache<string>(1_000)
+    const probe = vi.fn(async () => 'value')
+
+    await expect(cache.load('1:0xabc', probe)).resolves.toBe('value')
+    await expect(cache.load('1:0xabc', probe)).resolves.toBe('value')
+    expect(probe).toHaveBeenCalledTimes(1)
+    expect(cache.read('1:0xabc')).toBe('value')
+  })
+
+  it('re-probes after the TTL expires', async () => {
+    const cache = createOnchainLookupCache<string>(1_000)
+    const probe = vi.fn(async () => 'value')
+
+    await cache.load('1:0xabc', probe)
+    vi.advanceTimersByTime(1_001)
+    await cache.load('1:0xabc', probe)
+    expect(probe).toHaveBeenCalledTimes(2)
+  })
+
+  it('shares one probe between concurrent loads', async () => {
+    const cache = createOnchainLookupCache<string>(1_000)
+    let resolveProbe!: (value: string) => void
+    const probe = vi.fn(() => new Promise<string>((resolve) => {
+      resolveProbe = resolve
+    }))
+
+    const first = cache.load('1:0xabc', probe)
+    const second = cache.load('1:0xabc', probe)
+    resolveProbe('value')
+    await expect(first).resolves.toBe('value')
+    await expect(second).resolves.toBe('value')
+    expect(probe).toHaveBeenCalledTimes(1)
+  })
+
+  it('keys entries independently', async () => {
+    const cache = createOnchainLookupCache<string>(1_000)
+
+    await cache.load('1:0xabc', async () => 'mainnet')
+    await cache.load('8453:0xabc', async () => 'base')
+    expect(cache.read('1:0xabc')).toBe('mainnet')
+    expect(cache.read('8453:0xabc')).toBe('base')
+  })
+
+  it('does not cache probe failures and retries on the next load', async () => {
+    const cache = createOnchainLookupCache<string>(1_000)
+    const probe = vi.fn()
+      .mockRejectedValueOnce(new Error('rpc down'))
+      .mockResolvedValueOnce('value')
+
+    await expect(cache.load('1:0xabc', probe)).resolves.toBeUndefined()
+    expect(cache.read('1:0xabc')).toBeUndefined()
+    await expect(cache.load('1:0xabc', probe)).resolves.toBe('value')
+    expect(probe).toHaveBeenCalledTimes(2)
+  })
+
+  it('serves the expired entry when a refresh probe fails', async () => {
+    const cache = createOnchainLookupCache<string>(1_000)
+    const probe = vi.fn()
+      .mockResolvedValueOnce('stale-but-real')
+      .mockRejectedValueOnce(new Error('rpc down'))
+
+    await cache.load('1:0xabc', probe)
+    vi.advanceTimersByTime(1_001)
+    await expect(cache.load('1:0xabc', probe)).resolves.toBe('stale-but-real')
+  })
+})
diff --git a/tests/utils/safe-account.test.ts b/tests/utils/safe-account.test.ts
new file mode 100644
index 000000000..fb6e9284b
--- /dev/null
+++ b/tests/utils/safe-account.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from 'vitest'
+import { getSafeSingletonVersion, resolveSafeAccountInfo } from '~/utils/safe-account'
+
+const SAFE_141_SINGLETON = '0x41675C099F32341bf84BFc5382aF534df5C7461a'
+const SAFE_130_L2_SINGLETON = '0x3E5c63644E683549055b9Be8653de26E0B4CD36E'
+const UNKNOWN_CONTRACT = '0x1111111111111111111111111111111111111111'
+
+const OWNERS = [
+  '0x00000000000000000000000000000000000000a1',
+  '0x00000000000000000000000000000000000000a2',
+  '0x00000000000000000000000000000000000000a3',
+] as const
+
+describe('getSafeSingletonVersion', () => {
+  it('recognizes canonical singletons regardless of casing', () => {
+    expect(getSafeSingletonVersion(SAFE_141_SINGLETON)).toBe('1.4.1')
+    expect(getSafeSingletonVersion(SAFE_141_SINGLETON.toLowerCase())).toBe('1.4.1')
+    expect(getSafeSingletonVersion(SAFE_130_L2_SINGLETON)).toBe('1.3.0')
+  })
+
+  it('rejects unknown addresses and empty input', () => {
+    expect(getSafeSingletonVersion(UNKNOWN_CONTRACT)).toBeUndefined()
+    expect(getSafeSingletonVersion(null)).toBeUndefined()
+    expect(getSafeSingletonVersion(undefined)).toBeUndefined()
+  })
+})
+
+describe('resolveSafeAccountInfo', () => {
+  it('resolves a valid Safe configuration', () => {
+    const info = resolveSafeAccountInfo(SAFE_141_SINGLETON, 2n, OWNERS)
+    expect(info).toEqual({
+      version: '1.4.1',
+      threshold: 2,
+      owners: OWNERS,
+    })
+  })
+
+  it('rejects an unknown singleton even with plausible threshold/owners', () => {
+    expect(resolveSafeAccountInfo(UNKNOWN_CONTRACT, 2n, OWNERS)).toBeNull()
+  })
+
+  it('rejects missing threshold or owners', () => {
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, null, OWNERS)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 2n, null)).toBeNull()
+  })
+
+  it('rejects Safe-invariant violations from lookalikes', () => {
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 0n, OWNERS)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 4n, OWNERS)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, BigInt(Number.MAX_SAFE_INTEGER) + 1n, OWNERS)).toBeNull()
+  })
+})
diff --git a/utils/onchain-lookup-cache.ts b/utils/onchain-lookup-cache.ts
new file mode 100644
index 000000000..517f4a116
--- /dev/null
+++ b/utils/onchain-lookup-cache.ts
@@ -0,0 +1,58 @@
+import { ref } from 'vue'
+import { createInFlightDedup } from '~/utils/in-flight'
+
+export type OnchainLookupCache<T> = {
+  /**
+   * Read the cached value for a key. Reactive — computeds calling this
+   * re-evaluate when any lookup completes. `undefined` means "not resolved
+   * yet"; a cached `null` (if T includes it) is a resolved negative.
+   */
+  read: (key: string) => T | undefined
+  /**
+   * Resolve a key via `probe`, caching the result for `ttlMs`. Concurrent
+   * calls for the same key share one probe. A throwing probe (e.g. RPC
+   * transport failure) is NOT cached, so a later call retries instead of
+   * pinning a transient failure for the TTL.
+   */
+  load: (key: string, probe: () => Promise<T>) => Promise<T | undefined>
+}
+
+/**
+ * Module-scoped cache for small on-chain lookups keyed by `${chainId}:${address}`.
+ * Keys embed the chain, so chain switches need no invalidation — results land
+ * under their own key and stale probes can never overwrite fresher chains.
+ */
+export const createOnchainLookupCache = <T>(ttlMs: number): OnchainLookupCache<T> => {
+  const entries = new Map<string, { value: T, fetchedAt: number }>()
+  const inFlight = createInFlightDedup<string, T | undefined>()
+  // Bumped after every completed probe so reactive readers re-evaluate.
+  const version = ref(0)
+
+  const read = (key: string): T | undefined => {
+    void version.value
+    return entries.get(key)?.value
+  }
+
+  const load = (key: string, probe: () => Promise<T>): Promise<T | undefined> => {
+    const cached = entries.get(key)
+    if (cached && Date.now() - cached.fetchedAt < ttlMs) {
+      return Promise.resolve(cached.value)
+    }
+
+    return inFlight.run(key, async () => {
+      try {
+        const value = await probe()
+        entries.set(key, { value, fetchedAt: Date.now() })
+        version.value++
+        return value
+      }
+      catch {
+        // Serve the expired entry (if any) rather than dropping the badge on
+        // a transient RPC failure; the next load() retries the probe.
+        return entries.get(key)?.value
+      }
+    })
+  }
+
+  return { read, load }
+}
diff --git a/utils/safe-account.ts b/utils/safe-account.ts
new file mode 100644
index 000000000..f60c96b4e
--- /dev/null
+++ b/utils/safe-account.ts
@@ -0,0 +1,66 @@
+import type { Address } from 'viem'
+
+export type SafeAccountInfo = {
+  /** Safe contract version of the singleton the proxy points at, e.g. '1.4.1'. */
+  version: string
+  /** Number of owner signatures required to execute a transaction. */
+  threshold: number
+  owners: readonly Address[]
+}
+
+/**
+ * Canonical Safe singleton (implementation) deployments, lowercased.
+ *
+ * Safe singletons are deployed deterministically at identical addresses on
+ * every chain via the Safe Singleton Factory, so a single append-only list
+ * covers all networks. Includes the "eip155" v1.3.0 variants used on chains
+ * where the canonical deployment was not possible. zkSync-VM variants are
+ * omitted — no supported chain needs them.
+ *
+ * Source: https://github.com/safe-global/safe-deployments
+ *
+ * v1.0.0 proxies predate the `masterCopy()` fallback special-case, so v1.0.0
+ * Safes fail the probe and simply get no badge.
+ */
+const SAFE_SINGLETON_VERSIONS: Record<string, string> = {
+  '0x34cfac646f301356faa8b21e94227e3583fe3f5f': '1.1.1',
+  '0x6851d6fdfafd08c0295c392436245e5bc78b0185': '1.2.0',
+  '0xd9db270c1b5e3bd161e8c8503c55ceabee709552': '1.3.0',
+  '0x69f4d1788e39c87893c980c06edf4b7f686e2938': '1.3.0',
+  '0x3e5c63644e683549055b9be8653de26e0b4cd36e': '1.3.0',
+  '0xfb1bffc9d739b8d520daf37df666da4c687191ea': '1.3.0',
+  '0x41675c099f32341bf84bfc5382af534df5c7461a': '1.4.1',
+  '0x29fcb43b46531bca003ddc8fcb67ffe91900c762': '1.4.1',
+  '0xff51a5898e281db6dfc7855790607438df2ca44b': '1.5.0',
+  '0xedd160febbd92e350d4d398fb636302fccd67c7e': '1.5.0',
+}
+
+export const getSafeSingletonVersion = (
+  singleton: string | null | undefined,
+): string | undefined =>
+  singleton ? SAFE_SINGLETON_VERSIONS[singleton.toLowerCase()] : undefined
+
+/**
+ * Validate raw probe results into a SafeAccountInfo, or null when the address
+ * is not a recognizable Safe. Threshold/owner invariants mirror what the Safe
+ * contracts themselves enforce; anything violating them is a lookalike.
+ */
+export const resolveSafeAccountInfo = (
+  singleton: string | null | undefined,
+  threshold: bigint | null | undefined,
+  owners: readonly Address[] | null | undefined,
+): SafeAccountInfo | null => {
+  const version = getSafeSingletonVersion(singleton)
+  if (!version) return null
+  if (threshold == null || owners == null) return null
+
+  const thresholdCount = Number(threshold)
+  if (!Number.isSafeInteger(thresholdCount) || thresholdCount < 1) return null
+  if (owners.length < thresholdCount) return null
+
+  return {
+    version,
+    threshold: thresholdCount,
+    owners,
+  }
+}

From f4d5e38214381dc3f90b10b695e629e568cf3cc1 Mon Sep 17 00:00:00 2001
From: kasperpawlowski <kasperpawlowski@gmail.com>
Date: Mon, 10 Aug 2026 14:27:07 +0200
Subject: [PATCH 2/7] fix: move safe badge left of address, drop owners list
 from tooltip

---
 components/entities/safe/SafeAccountBadge.vue | 19 ++++---------------
 .../overview/VaultOverviewAddressValue.vue    |  8 ++++----
 2 files changed, 8 insertions(+), 19 deletions(-)

diff --git a/components/entities/safe/SafeAccountBadge.vue b/components/entities/safe/SafeAccountBadge.vue
index b1286b300..e8c7a3315 100644
--- a/components/entities/safe/SafeAccountBadge.vue
+++ b/components/entities/safe/SafeAccountBadge.vue
@@ -1,23 +1,12 @@
 <script setup lang="ts">
-import { shortenAddress } from '~/utils/string-utils'
-
 const { address } = defineProps<{ address: string }>()
 
 const { safeInfo } = useSafeAddressInfo(() => address)
 
-const tooltipSections = computed(() => {
-  if (!safeInfo.value) return []
+const tooltipText = computed(() => {
+  if (!safeInfo.value) return ''
   const { threshold, owners, version } = safeInfo.value
-  return [
-    {
-      title: `Safe smart account (v${version})`,
-      text: `Executing a transaction from this address requires ${threshold} of its ${owners.length} owner signatures.`,
-    },
-    {
-      title: `Owners (${owners.length})`,
-      text: owners.map(owner => shortenAddress(owner)).join(', '),
-    },
-  ]
+  return `This address is a Safe smart account (v${version}). Executing a transaction from it requires ${threshold} of its ${owners.length} owner signatures.`
 })
 </script>
 
@@ -25,7 +14,7 @@ const tooltipSections = computed(() => {
   <UiHoverPreviewTooltip
     v-if="safeInfo"
     title="Safe multisig"
-    :sections="tooltipSections"
+    :text="tooltipText"
   >
     <span class="flex items-center gap-4 text-content-secondary">
       <SvgIcon
diff --git a/components/entities/vault/overview/VaultOverviewAddressValue.vue b/components/entities/vault/overview/VaultOverviewAddressValue.vue
index e22faee47..a4afe7e09 100644
--- a/components/entities/vault/overview/VaultOverviewAddressValue.vue
+++ b/components/entities/vault/overview/VaultOverviewAddressValue.vue
@@ -26,6 +26,10 @@ const onCopyClick = () => {
 
 <template>
   <div class="flex gap-4 items-center">
+    <SafeAccountBadge
+      v-if="checkSafe"
+      :address="address"
+    />
     <NuxtLink
       :to="explorerLink"
       class="text-accent-600 underline cursor-pointer hover:text-accent-500"
@@ -33,10 +37,6 @@ const onCopyClick = () => {
     >
       {{ displayLabel }}
     </NuxtLink>
-    <SafeAccountBadge
-      v-if="checkSafe"
-      :address="address"
-    />
     <button
       class="text-content-muted cursor-pointer outline-none hover:text-content-secondary active:text-content-primary"
       @click="onCopyClick"

From 7bdd0f2318322b5df59d95871191e81dd212c61e Mon Sep 17 00:00:00 2001
From: kasperpawlowski <kasperpawlowski@gmail.com>
Date: Mon, 10 Aug 2026 14:37:30 +0200
Subject: [PATCH 3/7] fix: address review findings on safe detection probes

Transport-level RPC failures now rethrow instead of being cached as negative detections for the TTL. Owner lists violating Safe's OwnerManager invariants (zero, sentinel, duplicate owners) are rejected as lookalikes.
---
 composables/useOracleRouterGovernor.ts        |  5 +++-
 composables/useSafeAddressInfo.ts             | 16 +++++++++---
 .../useOracleRouterGovernor.test.ts           | 19 ++++++++++++++
 tests/composables/useSafeAddressInfo.test.ts  | 25 +++++++++++++++++++
 tests/utils/safe-account.test.ts              |  8 ++++++
 utils/safe-account.ts                         | 15 +++++++++--
 6 files changed, 81 insertions(+), 7 deletions(-)

diff --git a/composables/useOracleRouterGovernor.ts b/composables/useOracleRouterGovernor.ts
index b79713f63..42873e900 100644
--- a/composables/useOracleRouterGovernor.ts
+++ b/composables/useOracleRouterGovernor.ts
@@ -2,6 +2,7 @@ import { computed, toValue, watch, type MaybeRefOrGetter } from 'vue'
 import { getAddress, isAddress, type Address, type PublicClient } from 'viem'
 import { governableGovernorAbi } from '~/abis/oracle'
 import { createOnchainLookupCache } from '~/utils/onchain-lookup-cache'
+import { isTransportError } from '~/utils/viem-errors'
 
 // Router governance changes rarely; 5 min matches the app's other caches.
 const CACHE_TTL_MS = 5 * 60_000
@@ -21,7 +22,9 @@ const probeGovernor = async (
     })
     return getAddress(governor)
   }
-  catch {
+  catch (err) {
+    // A flaky RPC response must not get cached as "no governor" for the TTL.
+    if (isTransportError(err)) throw err
     // Not a Governable contract (or empty call data) — no governor to show.
     return null
   }
diff --git a/composables/useSafeAddressInfo.ts b/composables/useSafeAddressInfo.ts
index b4c744810..010ac5a11 100644
--- a/composables/useSafeAddressInfo.ts
+++ b/composables/useSafeAddressInfo.ts
@@ -3,6 +3,7 @@ import { getAddress, isAddress, type Address, type PublicClient } from 'viem'
 import { safeAccountAbi } from '~/abis/safe'
 import { createOnchainLookupCache } from '~/utils/onchain-lookup-cache'
 import { getSpecialAddressLabel } from '~/utils/special-addresses'
+import { isTransportError } from '~/utils/viem-errors'
 import { resolveSafeAccountInfo, type SafeAccountInfo } from '~/utils/safe-account'
 
 // Threshold/owners can change over time; 5 min matches the app's other caches.
@@ -15,15 +16,15 @@ const safeInfoCache = createOnchainLookupCache<SafeAccountInfo | null>(CACHE_TTL
  *
  * All three reads fire concurrently — the transport batches them into a
  * single RPC request. EOAs return empty call data and non-Safe contracts
- * revert on the unknown selectors, so failed reads mean "not a Safe" rather
- * than an error. Only a rejected `masterCopy()` matching a known singleton
- * would be ambiguous, and that combination cannot occur.
+ * revert on the unknown selectors, so those failures mean "not a Safe".
+ * Transport-level failures are rethrown instead — a flaky RPC response must
+ * not get cached as a definitive negative for the TTL.
  */
 const probeSafeAccount = async (
   client: PublicClient,
   address: Address,
 ): Promise<SafeAccountInfo | null> => {
-  const [masterCopy, threshold, owners] = await Promise.allSettled([
+  const results = await Promise.allSettled([
     client.readContract({
       address,
       abi: safeAccountAbi,
@@ -44,6 +45,13 @@ const probeSafeAccount = async (
     }),
   ])
 
+  for (const result of results) {
+    if (result.status === 'rejected' && isTransportError(result.reason)) {
+      throw result.reason
+    }
+  }
+
+  const [masterCopy, threshold, owners] = results
   return resolveSafeAccountInfo(
     masterCopy.status === 'fulfilled' ? masterCopy.value : null,
     threshold.status === 'fulfilled' ? threshold.value : null,
diff --git a/tests/composables/useOracleRouterGovernor.test.ts b/tests/composables/useOracleRouterGovernor.test.ts
index 4bf093e8d..3bfa4beec 100644
--- a/tests/composables/useOracleRouterGovernor.test.ts
+++ b/tests/composables/useOracleRouterGovernor.test.ts
@@ -66,6 +66,25 @@ describe('useOracleRouterGovernor', () => {
     expect(client.readContract).not.toHaveBeenCalled()
   })
 
+  it('does not cache transport failures as "no governor"', async () => {
+    const readContract = vi.fn()
+      .mockRejectedValueOnce(new Error('HTTP request failed'))
+      .mockResolvedValue(GOVERNOR_ADDRESS)
+    stubEnvironment({ readContract })
+    const useOracleRouterGovernor = await importComposable()
+
+    const first = useOracleRouterGovernor(() => ROUTER_ADDRESS)
+    await vi.waitFor(() => expect(readContract).toHaveBeenCalled())
+    // Macrotask flush so the failed probe fully settles and releases its
+    // in-flight slot before the retry instance is created.
+    await new Promise(resolve => setTimeout(resolve, 0))
+    expect(first.governor.value).toBeUndefined()
+
+    // A fresh instance retries because the transport failure was not cached.
+    const second = useOracleRouterGovernor(() => ROUTER_ADDRESS)
+    await vi.waitFor(() => expect(second.governor.value).toBeTruthy())
+  })
+
   it('caches lookups across instances', async () => {
     const client = { readContract: vi.fn(async () => GOVERNOR_ADDRESS) }
     stubEnvironment(client)
diff --git a/tests/composables/useSafeAddressInfo.test.ts b/tests/composables/useSafeAddressInfo.test.ts
index e9136b077..c7d58c473 100644
--- a/tests/composables/useSafeAddressInfo.test.ts
+++ b/tests/composables/useSafeAddressInfo.test.ts
@@ -123,6 +123,31 @@ describe('useSafeAddressInfo', () => {
     expect(client.readContract).toHaveBeenCalledTimes(3)
   })
 
+  it('does not cache transport failures as negatives', async () => {
+    const readContract = vi.fn()
+      .mockRejectedValueOnce(new Error('HTTP request failed'))
+      .mockRejectedValueOnce(new Error('HTTP request failed'))
+      .mockRejectedValueOnce(new Error('HTTP request failed'))
+      .mockImplementation(async ({ functionName }: { functionName: string }) => {
+        if (functionName === 'masterCopy') return SAFE_141_SINGLETON
+        if (functionName === 'getThreshold') return 3n
+        return OWNERS
+      })
+    stubEnvironment({ readContract })
+    const useSafeAddressInfo = await importComposable()
+
+    const first = useSafeAddressInfo(() => SAFE_ADDRESS)
+    await vi.waitFor(() => expect(readContract).toHaveBeenCalledTimes(3))
+    // Macrotask flush so the failed probe fully settles and releases its
+    // in-flight slot before the retry instance is created.
+    await new Promise(resolve => setTimeout(resolve, 0))
+    expect(first.safeInfo.value).toBeNull()
+
+    // A fresh instance retries because the transport failure was not cached.
+    const second = useSafeAddressInfo(() => SAFE_ADDRESS)
+    await vi.waitFor(() => expect(second.safeInfo.value).not.toBeNull())
+  })
+
   it('probes distinct addresses independently', async () => {
     const client = safeClient()
     stubEnvironment(client)
diff --git a/tests/utils/safe-account.test.ts b/tests/utils/safe-account.test.ts
index fb6e9284b..5ec3a8f9e 100644
--- a/tests/utils/safe-account.test.ts
+++ b/tests/utils/safe-account.test.ts
@@ -49,4 +49,12 @@ describe('resolveSafeAccountInfo', () => {
     expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 4n, OWNERS)).toBeNull()
     expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, BigInt(Number.MAX_SAFE_INTEGER) + 1n, OWNERS)).toBeNull()
   })
+
+  it('rejects owner lists a Safe cannot have', () => {
+    const zeroOwner = '0x0000000000000000000000000000000000000000'
+    const sentinelOwner = '0x0000000000000000000000000000000000000001'
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [...OWNERS, zeroOwner])).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [...OWNERS, sentinelOwner])).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [OWNERS[0], OWNERS[0].toUpperCase().replace('0X', '0x')])).toBeNull()
+  })
 })
diff --git a/utils/safe-account.ts b/utils/safe-account.ts
index f60c96b4e..88750555a 100644
--- a/utils/safe-account.ts
+++ b/utils/safe-account.ts
@@ -1,4 +1,7 @@
-import type { Address } from 'viem'
+import { zeroAddress, type Address } from 'viem'
+
+/** Safe's OwnerManager linked-list sentinel — never a legitimate owner. */
+const SENTINEL_OWNER = '0x0000000000000000000000000000000000000001'
 
 export type SafeAccountInfo = {
   /** Safe contract version of the singleton the proxy points at, e.g. '1.4.1'. */
@@ -43,7 +46,11 @@ export const getSafeSingletonVersion = (
 /**
  * Validate raw probe results into a SafeAccountInfo, or null when the address
  * is not a recognizable Safe. Threshold/owner invariants mirror what the Safe
- * contracts themselves enforce; anything violating them is a lookalike.
+ * contracts themselves enforce (OwnerManager forbids zero/sentinel/duplicate
+ * owners); anything violating them is a lookalike.
+ *
+ * This is a display heuristic: a purpose-built contract can still mimic all
+ * probed functions. Never use the result for authorization decisions.
  */
 export const resolveSafeAccountInfo = (
   singleton: string | null | undefined,
@@ -58,6 +65,10 @@ export const resolveSafeAccountInfo = (
   if (!Number.isSafeInteger(thresholdCount) || thresholdCount < 1) return null
   if (owners.length < thresholdCount) return null
 
+  const normalizedOwners = owners.map(owner => owner.toLowerCase())
+  if (normalizedOwners.some(owner => owner === zeroAddress || owner === SENTINEL_OWNER)) return null
+  if (new Set(normalizedOwners).size !== normalizedOwners.length) return null
+
   return {
     version,
     threshold: thresholdCount,

From b29d966165c41cbc01b926d45f163ba350aa417c Mon Sep 17 00:00:00 2001
From: kasperpawlowski <kasperpawlowski@gmail.com>
Date: Mon, 10 Aug 2026 15:14:10 +0200
Subject: [PATCH 4/7] fix: type owner-list test fixtures as addresses

---
 tests/utils/safe-account.test.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/utils/safe-account.test.ts b/tests/utils/safe-account.test.ts
index 5ec3a8f9e..c90ae37d1 100644
--- a/tests/utils/safe-account.test.ts
+++ b/tests/utils/safe-account.test.ts
@@ -51,10 +51,11 @@ describe('resolveSafeAccountInfo', () => {
   })
 
   it('rejects owner lists a Safe cannot have', () => {
-    const zeroOwner = '0x0000000000000000000000000000000000000000'
-    const sentinelOwner = '0x0000000000000000000000000000000000000001'
+    const zeroOwner = '0x0000000000000000000000000000000000000000' as const
+    const sentinelOwner = '0x0000000000000000000000000000000000000001' as const
+    const duplicateOwner = '0x00000000000000000000000000000000000000A1' as const
     expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [...OWNERS, zeroOwner])).toBeNull()
     expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [...OWNERS, sentinelOwner])).toBeNull()
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [OWNERS[0], OWNERS[0].toUpperCase().replace('0X', '0x')])).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [OWNERS[0], duplicateOwner])).toBeNull()
   })
 })

From b5d8cd38306b99479f0cb0673a91f1af6f715614 Mon Sep 17 00:00:00 2001
From: kasperpawlowski <kasperpawlowski@gmail.com>
Date: Mon, 10 Aug 2026 15:58:59 +0200
Subject: [PATCH 5/7] fix: describe safe owner threshold instead of claiming
 universal signature requirement

---
 components/entities/safe/SafeAccountBadge.vue | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/components/entities/safe/SafeAccountBadge.vue b/components/entities/safe/SafeAccountBadge.vue
index e8c7a3315..4bd600176 100644
--- a/components/entities/safe/SafeAccountBadge.vue
+++ b/components/entities/safe/SafeAccountBadge.vue
@@ -3,10 +3,18 @@ const { address } = defineProps<{ address: string }>()
 
 const { safeInfo } = useSafeAddressInfo(() => address)
 
+// Describes the configured owner threshold only — enabled Safe modules can
+// execute without owner confirmations, and the probe does not inspect them.
 const tooltipText = computed(() => {
   if (!safeInfo.value) return ''
   const { threshold, owners, version } = safeInfo.value
-  return `This address is a Safe smart account (v${version}). Executing a transaction from it requires ${threshold} of its ${owners.length} owner signatures.`
+  return `This address is a Safe smart account (v${version}) configured with a ${threshold}-of-${owners.length} owner threshold.`
+})
+
+const ariaLabel = computed(() => {
+  if (!safeInfo.value) return 'Safe multisig'
+  const { threshold, owners } = safeInfo.value
+  return `Safe multisig: ${threshold} of ${owners.length} owner threshold`
 })
 </script>
 
@@ -15,6 +23,7 @@ const tooltipText = computed(() => {
     v-if="safeInfo"
     title="Safe multisig"
     :text="tooltipText"
+    :aria-label="ariaLabel"
   >
     <span class="flex items-center gap-4 text-content-secondary">
       <SvgIcon

From 6adf4f999d1059122ab4a8d7164892ffb8f814b9 Mon Sep 17 00:00:00 2001
From: kasperpawlowski <kasperpawlowski@gmail.com>
Date: Mon, 10 Aug 2026 16:40:46 +0200
Subject: [PATCH 6/7] fix: reject safe self-ownership in probe validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mirrors OwnerManager GS203 (owner != address(this)) — a lookalike listing itself as owner no longer passes.
---
 composables/useSafeAddressInfo.ts |  1 +
 tests/utils/safe-account.test.ts  | 27 +++++++++++++++++----------
 utils/safe-account.ts             |  8 ++++++--
 3 files changed, 24 insertions(+), 12 deletions(-)

diff --git a/composables/useSafeAddressInfo.ts b/composables/useSafeAddressInfo.ts
index 010ac5a11..2153a915f 100644
--- a/composables/useSafeAddressInfo.ts
+++ b/composables/useSafeAddressInfo.ts
@@ -53,6 +53,7 @@ const probeSafeAccount = async (
 
   const [masterCopy, threshold, owners] = results
   return resolveSafeAccountInfo(
+    address,
     masterCopy.status === 'fulfilled' ? masterCopy.value : null,
     threshold.status === 'fulfilled' ? threshold.value : null,
     owners.status === 'fulfilled' ? owners.value : null,
diff --git a/tests/utils/safe-account.test.ts b/tests/utils/safe-account.test.ts
index c90ae37d1..c61dd0375 100644
--- a/tests/utils/safe-account.test.ts
+++ b/tests/utils/safe-account.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { getSafeSingletonVersion, resolveSafeAccountInfo } from '~/utils/safe-account'
 
+const SAFE_ADDRESS = '0x00000000000000000000000000000000000000aa'
 const SAFE_141_SINGLETON = '0x41675C099F32341bf84BFc5382aF534df5C7461a'
 const SAFE_130_L2_SINGLETON = '0x3E5c63644E683549055b9Be8653de26E0B4CD36E'
 const UNKNOWN_CONTRACT = '0x1111111111111111111111111111111111111111'
@@ -27,7 +28,7 @@ describe('getSafeSingletonVersion', () => {
 
 describe('resolveSafeAccountInfo', () => {
   it('resolves a valid Safe configuration', () => {
-    const info = resolveSafeAccountInfo(SAFE_141_SINGLETON, 2n, OWNERS)
+    const info = resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 2n, OWNERS)
     expect(info).toEqual({
       version: '1.4.1',
       threshold: 2,
@@ -36,26 +37,32 @@ describe('resolveSafeAccountInfo', () => {
   })
 
   it('rejects an unknown singleton even with plausible threshold/owners', () => {
-    expect(resolveSafeAccountInfo(UNKNOWN_CONTRACT, 2n, OWNERS)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, UNKNOWN_CONTRACT, 2n, OWNERS)).toBeNull()
   })
 
   it('rejects missing threshold or owners', () => {
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, null, OWNERS)).toBeNull()
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 2n, null)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, null, OWNERS)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 2n, null)).toBeNull()
   })
 
   it('rejects Safe-invariant violations from lookalikes', () => {
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 0n, OWNERS)).toBeNull()
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 4n, OWNERS)).toBeNull()
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, BigInt(Number.MAX_SAFE_INTEGER) + 1n, OWNERS)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 0n, OWNERS)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 4n, OWNERS)).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, BigInt(Number.MAX_SAFE_INTEGER) + 1n, OWNERS)).toBeNull()
   })
 
   it('rejects owner lists a Safe cannot have', () => {
     const zeroOwner = '0x0000000000000000000000000000000000000000' as const
     const sentinelOwner = '0x0000000000000000000000000000000000000001' as const
     const duplicateOwner = '0x00000000000000000000000000000000000000A1' as const
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [...OWNERS, zeroOwner])).toBeNull()
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [...OWNERS, sentinelOwner])).toBeNull()
-    expect(resolveSafeAccountInfo(SAFE_141_SINGLETON, 1n, [OWNERS[0], duplicateOwner])).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 1n, [...OWNERS, zeroOwner])).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 1n, [...OWNERS, sentinelOwner])).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 1n, [OWNERS[0], duplicateOwner])).toBeNull()
+  })
+
+  it('rejects self-ownership regardless of casing (OwnerManager GS203)', () => {
+    const selfOwner = SAFE_ADDRESS.toUpperCase().replace('0X', '0x') as `0x${string}`
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 1n, [SAFE_ADDRESS as `0x${string}`])).toBeNull()
+    expect(resolveSafeAccountInfo(SAFE_ADDRESS, SAFE_141_SINGLETON, 1n, [...OWNERS, selfOwner])).toBeNull()
   })
 })
diff --git a/utils/safe-account.ts b/utils/safe-account.ts
index 88750555a..4f621074e 100644
--- a/utils/safe-account.ts
+++ b/utils/safe-account.ts
@@ -47,12 +47,13 @@ export const getSafeSingletonVersion = (
  * Validate raw probe results into a SafeAccountInfo, or null when the address
  * is not a recognizable Safe. Threshold/owner invariants mirror what the Safe
  * contracts themselves enforce (OwnerManager forbids zero/sentinel/duplicate
- * owners); anything violating them is a lookalike.
+ * owners and self-ownership, GS203); anything violating them is a lookalike.
  *
  * This is a display heuristic: a purpose-built contract can still mimic all
  * probed functions. Never use the result for authorization decisions.
  */
 export const resolveSafeAccountInfo = (
+  account: string,
   singleton: string | null | undefined,
   threshold: bigint | null | undefined,
   owners: readonly Address[] | null | undefined,
@@ -65,8 +66,11 @@ export const resolveSafeAccountInfo = (
   if (!Number.isSafeInteger(thresholdCount) || thresholdCount < 1) return null
   if (owners.length < thresholdCount) return null
 
+  const normalizedAccount = account.toLowerCase()
   const normalizedOwners = owners.map(owner => owner.toLowerCase())
-  if (normalizedOwners.some(owner => owner === zeroAddress || owner === SENTINEL_OWNER)) return null
+  if (normalizedOwners.some(owner =>
+    owner === zeroAddress || owner === SENTINEL_OWNER || owner === normalizedAccount,
+  )) return null
   if (new Set(normalizedOwners).size !== normalizedOwners.length) return null
 
   return {

From 0b1bd5015b7119bde6c1b235d030beb4eaaab978 Mon Sep 17 00:00:00 2001
From: Seranged <80223622+Seranged@users.noreply.github.com>
Date: Tue, 11 Aug 2026 16:07:01 +0100
Subject: [PATCH 7/7] chore: bump SDK to 2.0.0

Use the published package and drop unused deployment fields removed from the SDK surface.
---
 composables/useEulerAddresses.ts | 11 -----------
 package-lock.json                |  8 ++++----
 package.json                     |  2 +-
 3 files changed, 5 insertions(+), 16 deletions(-)

diff --git a/composables/useEulerAddresses.ts b/composables/useEulerAddresses.ts
index 3652a3e65..ad88c4791 100644
--- a/composables/useEulerAddresses.ts
+++ b/composables/useEulerAddresses.ts
@@ -13,8 +13,6 @@ export type EulerLensAddresses = {
 export type EulerTokenAddresses = {
   EUL: string | undefined
   rEUL: string | undefined
-  eUSD: string | undefined
-  seUSD: string | undefined
 } | null
 
 const allowedChainIds = ref<number[]>([])
@@ -135,8 +133,6 @@ export const useEulerAddresses = () => {
     return {
       EUL: config.addresses.tokenAddrs.EUL,
       rEUL: config.addresses.tokenAddrs.rEUL,
-      eUSD: config.addresses.tokenAddrs.eUSD,
-      seUSD: config.addresses.tokenAddrs.seUSD,
     }
   })
 
@@ -150,18 +146,11 @@ export const useEulerAddresses = () => {
       capRiskStewardFactory: peripheryAddrs.capRiskStewardFactory,
       escrowedCollateralPerspective: peripheryAddrs.escrowedCollateralPerspective,
       eulerEarnFactoryPerspective: peripheryAddrs.eulerEarnFactoryPerspective,
-      eulerEarnGovernedPerspective: peripheryAddrs.eulerEarnGovernedPerspective,
-      eulerUngoverned0xPerspective: peripheryAddrs.eulerUngoverned0xPerspective,
-      eulerUngovernedNzxPerspective: peripheryAddrs.eulerUngovernedNzxPerspective,
       evkFactoryPerspective: peripheryAddrs.evkFactoryPerspective,
-      externalVaultRegistry: peripheryAddrs.externalVaultRegistry,
       feeFlowController: peripheryAddrs.feeFlowController,
-      governedPerspective: peripheryAddrs.governedPerspective,
       governorAccessControlEmergencyFactory: peripheryAddrs.governorAccessControlEmergencyFactory,
-      irmRegistry: peripheryAddrs.irmRegistry,
       kinkIRMFactory: peripheryAddrs.kinkIRMFactory,
       kinkyIRMFactory: peripheryAddrs.kinkyIRMFactory,
-      oracleAdapterRegistry: peripheryAddrs.oracleAdapterRegistry,
       oracleRouterFactory: peripheryAddrs.oracleRouterFactory,
       securitizeFactory: peripheryAddrs.securitizeFactory,
       swapVerifier: peripheryAddrs.swapVerifier,
diff --git a/package-lock.json b/package-lock.json
index a6ce61644..fee53fc1e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8,7 +8,7 @@
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "@eulerxyz/euler-v2-sdk": "1.2.5",
+        "@eulerxyz/euler-v2-sdk": "2.0.0",
         "@floating-ui/vue": "2.0.1",
         "@gvade/nuxt3-svg-sprite": "1.0.3",
         "@keyringnetwork/keyring-connect-sdk": "3.2.0",
@@ -1551,9 +1551,9 @@
       }
     },
     "node_modules/@eulerxyz/euler-v2-sdk": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/@eulerxyz/euler-v2-sdk/-/euler-v2-sdk-1.2.5.tgz",
-      "integrity": "sha512-Ug9FzKyV/UdVaTzjKO5RqIhspAO9NHdvfsSrv2b8maIgsfBr9l6s4qLqjmlek9fjOOPC+4aurDEmpHT4GTUDNA==",
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@eulerxyz/euler-v2-sdk/-/euler-v2-sdk-2.0.0.tgz",
+      "integrity": "sha512-tOaLsScpVwKn3D5h78nf+Nz4xv4rd8n2/WUFQBtxIP549XoSWb9rSWCAi3o4oySgzB2RIljnKuKKauNzrCnw9w==",
       "license": "MIT",
       "dependencies": {
         "viem": "2.48.8"
diff --git a/package.json b/package.json
index e9e4e1c92..1659f7c94 100644
--- a/package.json
+++ b/package.json
@@ -35,7 +35,7 @@
     ]
   },
   "dependencies": {
-    "@eulerxyz/euler-v2-sdk": "1.2.5",
+    "@eulerxyz/euler-v2-sdk": "2.0.0",
     "@floating-ui/vue": "2.0.1",
     "@gvade/nuxt3-svg-sprite": "1.0.3",
     "@keyringnetwork/keyring-connect-sdk": "3.2.0",