Security
What we protect, and what we don't.
Nox runs on Robinhood Chain mainnet. The demo vault on this site is a simulation in your browser and holds nothing.
01 Threat model
If someone gets in, here is what stops them.
| If an attacker has | They try to | What stops them |
|---|---|---|
| Your private key | Drain the vault | Risky sends are held. You or your Guardian cancel or rescue. Nobody can release a hold early. |
| Your key, and patience | Swap the safe harbor or remove the Guardian, then drain | Moving the safe harbor waits 7 days, and your Guardian can cancel it. Removing the Guardian waits your hold delay. You see every pending change in the app. |
| Your Guardian's key | Steal funds | It can't. A Guardian can only cancel, freeze and rescue, and a rescue only goes to your safe harbor. |
| Your Guardian's key | Cancel everything you send | You remove the Guardian after your hold delay. It can't cancel its own removal. |
| A phishing site | Get you to approve a drainer, or sign a permit | Every token approval from the vault is held. The vault can't sign off-chain permits at all. |
| Address poisoning | Get you to send to a look-alike address | A large send to a new address is held, so you have time to notice. Check the whole address. |
| This website going down | Stop you from acting | Holds are enforced by the contract, not by this site. Cancel and rescue can still be called on the contract directly, for example with a command-line tool. |
02 Known limitations
Where the protection ends.
- Only funds inside the vault are protected. Nox can't stop transactions from your ordinary wallet.
- Instant means instant. Someone with your key can move up to your instant and daily limits right away. Set them to an amount you could afford to lose.
- Slow and visible, not impossible. If a thief has your key, waits out every delay, and nobody reacts, funds can eventually move.
- Your safe harbor must be independent. If it shares a seed phrase or device with your main key, a rescue can't help.
- No off-chain signatures. The vault can't sign Permit, Permit2 or marketplace orders. That blocks a whole class of phishing, but apps that need those signatures won't work with the vault yet.
03 Where Nox stands
The road to real funds.
- DoneContracts built test-first112 automated tests. Three invariant suites check, over 512,000 random calls each, that the Guardian can only send to your safe harbor, that no held send runs early, and that no looser rule applies before its delay.
- DoneStatic analysisSlither: no high-severity findings. Every other finding is fixed or explained.
- LiveRobinhood Chain mainnetVault factory
0x9Bc43b207883Ff2219AB0a9e12d6bA29101cfB25. - PlannedGuardian serviceAn automated Guardian that reviews held transactions and alerts you.