To prevent account impersonation, Two-factor authentication (2FA) is required to be completed by users.

2FA would protect any data and action related to the holdings of a user accessing the following functionality:

• Participating in a Sale

• Viewing Sales participations

• Claiming tokens

• Participating in a Burn Event

• Claiming  Burn Event tokens

• Viewing Portfolio

• Editing Settings

• Bridging $MERIT

2FA logic

Users with 2FA deactivated can receive an email to activate it.

• This email contains a 2FA code that is valid for 5 minutes.

• If you enter the code in time, the 2FA is activated.

• If you don’t, the 2FA  is not activated, and the request will have to be resent.

• Timeout: 24 hours of inactivity. After that time, you will be prompted again to input a new 2FA code.

2FA in Onboarding and Settings

• After your  nickname and email verified steps, you will be able to activate your 2FA

• When you click “activate 2FA” in the Onboarding or their Settings, an email is sent to you with the 2FA code.

• If you change your email address, your 2FA must be reactivated