DAILY SURFACE
Funding wallet
Deposits and relays transactions. It does not authorize vault withdrawals.
- Keep daily balances limited
- May pay relay gas
- Not an exit signer
Built for BNB Chain · separated authority
Put distance
between use
and authority.
SAFUMODE explores a vault where the wallet that funds or relays an action does not hold the authority to approve an exit.
“The device you use every day should not be the last word.”
- Everyday wallet
- Fund + relay
- Exit authority
- Approve requests
- Recovery authority
- Bounded controls
A design study, not a deployed product. No public deployment or custody service is offered.
01 / OPERATING MODEL
Authority is a boundary,
not a promise.
The model assigns narrow jobs to separate roles. The funding wallet can deposit and relay. A withdrawal authorizer approves exits. A recovery authorizer receives specific control powers—but cannot redirect recovery funds away from the recipient fixed at deployment.
This separation does not make key loss harmless. Lose both current authorities and there is no administrator, support desk, or back door to restore them.
02 / TWO-GATE ROUTING
Follow an exit request.
Choose a route to see which boundary applies. This is an educational model—no chain state is shown and no transaction is created.
TRUSTED ROUTE
The authorizer signs. A recipient already active in the current authority epoch can receive the withdrawal without the untrusted-recipient delay.
DELAYED ROUTE
The authorizer signs, then policy adds the configured waiting period. Either authority can cancel before later execution.
RECOVERY EXCEPTION
The recovery authority can transfer immediately, only to the immutable recovery recipient, while the vault is unpaused. The withdrawal delay does not apply.
03 / HARDWARE AUTHORITY
Your daily wallet
isn’t the exit key.
See where a Ledger-controlled key fits. This is an illustration, not a wallet connection or live transaction.
01 / REQUEST
Daily wallet
Submits an exit request. It cannot approve that exit alone.
02 / APPROVE
Ledger key
Separately reviews and signs the exact withdrawal authorization.
03 / CHECK
Vault rules
Verifies the signature. A new recipient must wait; a trusted one needn’t.
04 / EXIT
Funds move
Only when the required approval and route policy both pass.
What’s available now: Ledger clear-signing has been added to the local test-chain CLI. This website is read-only; Ledger signing and real-money vault use are not enabled here.
EXIT AUTHORITY
Withdrawal key
Signs withdrawal requests while remaining separate from the everyday wallet.
- Trusted route can be immediate
- Untrusted route waits
- Cannot alone establish trust
BOUNDED RECOVERY
Recovery key
Pauses, cancels and recovers only to the fixed recovery recipient.
- Co-approves trust and rotation
- Can veto pending rotation
- Cannot choose a new recovery destination
03 / RECOVERY LIMITS
A recovery path
is not a reset button.
Recovery is intentionally powerful and intentionally constrained. Its destination is fixed. There is no operator who can change it for you.
Contain an incident
Either current authority can pause. Pending withdrawals can be cancelled. A pending rotation can be vetoed.
Change sensitive policy
Resuming, adding a trusted recipient, and scheduling authority rotation require both current authorities.
Undo permanent loss
If both authority keys are lost, the contract provides no administrator recovery. Loss of the fixed recipient key can make recovered assets inaccessible.
04 / LOCAL INSTRUMENT
Inspect, don’t act.
This browser tool reads a user-supplied contract and compares chain, address, runtime bytecode hash and reported state with a static local allowlist. Unknown deployments remain unverified. It never signs.
SAFUMODE / OBSERVERNOT CONFIGURED
Preview an unverified contract
The selected wallet provider or RPC supplies chain, bytecode, and state and can fabricate all three. A static-pin match is useful independent comparison, not consensus proof; corroborate with independent providers. RPC URLs may expose your IP. RPC URL query parameters are intentionally ignored.
05 / FIELD NOTES
Read the edges
before the center.
RPCs are witnesses, not truth
A provider can misreport chain state and code. Compare independently operated sources.
Delay creates reaction time
It does not prevent a valid request from becoming executable after its waiting period.
Operations remain human
No production alert delivery, response team, relayer, transaction service, or custody service is included.