Robinhood Chain
Your coins wait. Your guardian whistles.
A vault with a waiting room. Every withdrawal is announced and has to wait. If it is not you, your guardian refuses it with Face ID. A stolen key alone gets nothing out.
One key. One second.
On a normal wallet, whoever has the key empties it in a single transaction. Phishing, a leaked seed phrase, a malicious signature: you find out afterwards. Blocks here take a tenth of a second, so there is no afterwards to react in.
A plain wallet
- Key stolen at 03:12
- Transfer signed at 03:12
- Funds gone at 03:12
03:12:00 confirmed
A Marmot vault
- Key stolen at 03:12
- Withdrawal announced at 03:12, ripe at 03:12 + 24 h
- Your phone buzzes. You whistle.
03:12:41 guardian refuses (Face ID, 1 tap)
+24 h execute(0) -> NotPending
Be the thief.
You hold the stolen key. Announce a withdrawal, then try everything: execute early, shorten the wait, swap the guardian, take over the vault. Then let the guardian whistle.
Three rooms.
Nothing leaves the vault in a single step. Every exit goes through the waiting room, including changes to the rules.
Entrance
The owner announces what they want: send, approve, change the guardian, change the wait, hand over the keys. The announcement is public and stamped with a time.
Waiting room
For the whole waiting time, the guardian can refuse the announcement, or whistle at everything. They sign with a passkey on their phone. Anyone may carry the signature on chain, so the guardian needs no gas.
Vault door
When the wait is over, anyone can run the announcement. Not before, not after 14 days. The guardian can refuse. Nobody can move money by whistling.
See it first.
The whole idea in under a minute. With sound.
Rules you can check.
The guardian can only say no
There is no function that lets the guardian move money, change the owner or unlock anything. At worst, a hacked guardian is an annoying guardian.
Settings wait too
Shortening the wait, replacing the guardian, changing the owner: all announced, all subject to the same wait and the same veto. No instant change exists.
No keys to the vault
No admin, no pause button, no upgrade, no fee. The factory only deploys. The rules are the code you can read.
Proof, not promises
Run on the real chain.
No deployment needed. The script injects the contract into a read-only call on Robinhood Chain and replays the attack against its own P-256 precompile. A second test runs random sequences on the Solidity and on the JavaScript engine and compares them step by step.
Versus the usual.
Marmot trades convenience for time. Here is the whole bill.
| One key | Hardware wallet | Multisig | Marmot | |
|---|---|---|---|---|
| Key stolen or phished | everything leaves | safer key, but you can still be tricked into signing | attacker needs M keys | the thief must also wait, unseen by you |
| Time to react | none | none | none | the waiting time (you choose it) |
| Everyday friction | none | confirm on a device | chase co-signers every time | each withdrawal waits |
| Second person or device | no | no | yes, every transaction | a phone passkey, only to say no |
| If the key is lost | seed phrase | seed phrase | other signers | Marmot cannot recover it |
| Cost | free | a device | more gas per tx | about 2.1M gas once to create |
Read this part.
Not audited, not deployed. The contract is written and tested. The demo above runs on a pretend ledger.
The guardian has to look. If nobody watches, the wait is just a delay. That is why there is a lookout that whistles, and a terminal watcher that can refuse unknown destinations by itself.
Lost owner key means locked funds. Marmot cannot recover what the owner key could not move.