protect user assets