Concepts
The waiting room
Delay, ripeness, expiry, epochs and panic.
The delay
Set at creation, between 5 minutes and
30 days. Every announcement, including settings,
ripens at block.timestamp + delay measured when it was
announced. Changing the delay later only affects announcements made
after the change.
Ripe, then expired
An announcement can be run from readyAt until
readyAt + 14 days. After that it is dead. This stops an
old forgotten announcement from being run months later by surprise.
Phases an announcement goes through
| Phase | Meaning | Can happen next |
|---|---|---|
| waiting | Announced, not ripe yet | veto, panic, cancel, owner rotation |
| ready | Ripe and not expired: anyone can run it | execute, veto, panic, cancel |
| expired | More than 14 days after ripe | nothing |
| executed | Done | nothing |
| vetoed | Refused by the guardian | nothing |
| cancelled | Withdrawn by the owner | nothing |
| killed | Its epoch is over (panic, or owner rotation) | nothing |
Epochs and panic
The vault keeps a counter, the epoch. Each
announcement remembers the epoch it was made in.
panic adds one to the epoch, which kills every pending
announcement in one step. It does not touch money and it does not
stop new announcements: it is "refuse everything announced so far".
A guardian's signed panic includes the epoch it was signed for. Once the epoch moves, that signature is worthless, so it cannot be replayed.
Owner rotation
When an announcement that changes the owner is executed, the epoch also moves. Everything the previous key announced is killed. This is how you recover from a stolen key: announce a new owner, let the guardian refuse the thief's announcements while yours ripens, run it, and the old key's leftovers die.
Choosing a delay
| You are | Suggested wait | Why |
|---|---|---|
| Testing | 5 to 30 minutes | Fast feedback. Not for real money. |
| Checking your phone every day | 12 to 24 hours | You will see the alert on time. |
| Holding savings | 3 to 7 days | Covers travel and sleep. Withdrawals are rare anyway. |
| Holding for years | 14 to 30 days | A thief would need you absent for weeks. |
The wait must be longer than the longest time you are ever unreachable. That is the whole trade.
About time
The vault uses block.timestamp, in whole seconds. On a
rollup the sequencer sets it, within small bounds. A wait of minutes
or more is not affected by that.