Nox docs

Overview

Your vault is a smart contract that only you own. You keep using your normal wallet: it becomes the vault's owner and signs everything. Each send is checked against your rules before it runs:

• Routine sends run at once: small amounts, and sends to addresses you saved.
• Risky actions wait for your hold delay: large sends to new addresses, going over your daily limit, token approvals, and calls to other contracts.
• While something waits, you (or your guardian) can cancel it, freeze the vault, or rescue everything to your safe harbor. Nobody, not even you, can make a hold end early.

A thief with your key can do what you can, so the dangerous parts all wait. That gives you time to notice and stop them.

Why not just race the thief? Robinhood Chain orders transactions first come, first served, with very fast blocks, so you can't outbid a thief's transaction once it is sent. The protection has to live in the vault's own rules: the hold.

Quick start

1. Get a browser wallet. MetaMask, Rabby or similar, with a little ETH on Robinhood Chain for gas.
2. Open the app at /app and connect. If your wallet is on another network, the app asks it to switch to chain 4663.
3. Choose a safe harbor. A backup wallet on a different device with its own seed phrase. It's the only place a rescue can ever send funds, and it can't be your own wallet or the vault.
4. Pick a preset (you can change the rules later), optionally add a guardian and saved addresses, then create the vault. Your wallet signs one transaction.
5. Deposit ETH from your wallet.
6. Try it: send a small amount (instant), then a large amount to a new address (held), and cancel it.

No wallet? The demo vault runs the same rules in your browser with simulated balances.

Owner, guardian, safe harbor

Owner

Your wallet. It sends, changes rules and roles, and can do everything a guardian can.

Safe harbor

The backup address rescues go to. It holds no powers over the vault; it only receives. Give it a different seed phrase on a different device: if the malware that stole your key can also reach your safe harbor, a rescue sends funds straight to the thief.

Guardian (optional)

A second address you trust. It can only protect you: cancel, freeze, revoke and rescue to the safe harbor. It can never send funds anywhere else, change your rules or release a hold. An automated guardian service is planned; until it runs, you are your own guardian.

Your rules

Hold delay

How long risky actions wait. Anything from 1 hour to 7 days.

Instant limit (per token)

The most a single send to an address that isn't saved can be and still go through at once.

Daily limit (per token)

The most that can leave instantly in a 24-hour window. The window starts with the first instant send after the last one ended, so up to twice the limit can leave around a window boundary. Without a daily limit, no send of that token to an unsaved address is ever instant.

Saved addresses

Addresses you send to often. Sends to them skip the instant limit but still count towards the daily limit.

You can send up to 16 calls in one batch. If any call in a batch would be held, the whole batch is held.

Presets

Starting points when you create a vault. Every value can be changed later.

What gets held

Only three kinds of call can ever be instant: a plain ETH send, a token transfer, and a revoke. Everything else waits. When something is held, the vault records why, using these reasons:

Play the thief

You've stolen the key. Try to get the money out; the vault's real rules decide, live, in your browser.

Holds

• A held transaction waits for your hold delay, then can run.
• Once the delay has passed, the owner runs it from the app. The contract can also let anyone trigger held transactions after their delay (public execution), so they still run while you're away; it's off for vaults made in the app, with no switch for it yet.
• It runs exactly as it was held: nothing can be swapped in.
• While the vault is frozen, held transactions can't run.
• Nobody can release a hold early.

Emergency actions

Cancel

Stops a held transaction for good. Owner or guardian, at any time before it runs.

Freeze

Instant. Every send is held and nothing held can run. Unfreezing is a loosening, so it waits your hold delay.

Revoke

Sets a token approval to zero (or withdraws an NFT operator approval). Instant, owner or guardian. Not in the app yet; available on the contract.

Rescue

Moves the vault's whole balance of each listed token to your safe harbor. There is no destination to choose: a rescue can only ever go to the safe harbor.

If you didn't send something that's on hold: cancel it, freeze the vault, and rescue to your safe harbor. Then move to a new wallet; your old key is no longer safe.

Changing rules and roles

• Tightening is instant: a longer hold delay, lower limits, removing a saved address, freezing.
• Loosening waits your hold delay: a shorter delay, higher limits, adding a saved address, removing a daily limit, unfreezing. A guardian can cancel it.
• Safe harbor and ownership changes wait 7 days, whatever your hold delay, and a guardian can cancel them. Ownership transfer isn't in the app yet.
• Guardian changes wait your hold delay, and only the owner can cancel them, so a rogue guardian can't block its own removal.

Pending changes show in the app until they apply, or until someone cancels them.

Current limits

• No guardian service yet. You act as your own guardian.
• Not upgradeable. Nobody, including us, can change your vault's code or rules. Only you can, through the delays above.

More on threats and known limitations: Security.

Contracts and network

Network

Robinhood Chain, chain ID 4663

Vault factory

0x9Bc43b207883Ff2219AB0a9e12d6bA29101cfB25

Explorer

robinhoodchain.blockscout.com

Public RPC

https://rpc.mainnet.chain.robinhood.com

Each owner gets their own vault contract, created by the factory. The factory has no owner and no admin functions.

FAQ