Trust
Threat scenarios
Ten things that can go wrong, and what happens.
| # | Scenario | Outcome |
|---|---|---|
| 1 | Owner key stolen, guardian awake | The thief's announcements are refused. You rotate the owner (announce, wait, execute), and the thief's leftovers die. Funds stay. |
| 2 | Owner key stolen, guardian asleep | The announcement ripens and runs. The wait gave you time, and you did not use it. This is why the lookout exists. |
| 3 | Guardian passkey stolen (device and biometric) | The thief can refuse your announcements and freeze the vault, but cannot move anything. Funds are safe and stuck until you change the guardian, which they can also refuse. For large sums, use a multi-signer ERC-1271 guardian. |
| 4 | Both stolen | Funds can be taken. Keep the two on different devices. |
| 5 | Owner key lost | Funds are locked forever. Use a smart-account owner with its own recovery if that worries you. |
| 6 | Guardian lost | Nothing can be refused. Announce a new guardian and wait. Until it executes you rely on luck. |
| 7 | You are phished into announcing an unlimited approve | The lookout flags it "UNLIMITED APPROVAL". The guardian refuses before it runs. |
| 8 | A relayer ignores your signed veto | Anyone can submit it. Use the CLI relay or your wallet. The signature stays valid until the epoch changes. |
| 9 | Someone front-runs your veto signature | Harmless: the effect is exactly the veto you wanted. |
| 10 | The thief announces a shorter delay first | That is an announcement too. It waits the full old delay, and you refuse it. |
The race to rotate
If the key is stolen, the thief and you share it. Both of you can announce. You announce a new owner; the thief announces a withdrawal. The guardian, who is you, refuses the withdrawal and lets your rotation ripen. When it runs, the old key is dead and every earlier announcement dies with it. The guardian is what breaks the tie.
The freeze
A compromised guardian can refuse every announcement forever. The contract has no unvetoable path, because one would also be a path for the thief. That is a deliberate trade: freezing is bad, theft is worse. It is the reason for the guardian options above.