# What happens when I "Protect" something?

In order to have Harpie keep watch over your wallet, you have to "protect" each of your tokens.

### Protecting an asset allows us to move it in the event of an attack

Your trusted network tells Harpie what traffic we should be watching for on your wallet. However, what your trusted network _does not do_ is allow us to actually intervene in the event of an attack.

By protecting your assets, you give Harpie permission to move your tokens and NFTs to a safe location the second we detect malicious activity on your wallet. This is done through the `approve` function. If you've used a DeFi protocol or an NFT marketplace like OpenSea or Compound, you've most likely used the `approve` function before.

### What exactly happens during an attack?

When a thief sends a transaction to steal your money, Harpie eliminates that transaction before it can affect your balance. We essentially "skip the line" and transfer your assets out of your wallet before a thief can.

Our systems use an advanced strategy called [frontrunning](https://consensys.github.io/smart-contract-best-practices/attacks/frontrunning/). By paying a higher gas fee, Harpie can beat out attackers by taking advantage of a blockchain's consensus mechanism.

### But wait... How can I trust Harpie?

You may be asking yourself:

> _How can I trust Harpie with the ability to move my tokens? Isn't it a security risk?_

`Approval` is a huge security risk, and thus, we have done as much as we can to ensure that you feel comfortable with taking the risk.

When Harpie moves your tokens on your behalf, we are only able to move it to the [noncustodial-vault](../../tech-and-security/contracts/noncustodial-vault "mention"). When your tokens are inside the Vault, no one else (not even Harpie) can withdraw your stored tokens. This is guaranteed by code, and this code is completely transparent and has multiple public audits that you can find at [audit](../../tech-and-security/contracts/audit "mention").

This means that, even though we have the power to move your tokens to the Vault on your behalf, we never have the power to access or withdraw them.
