Role Definitions
| Role | How identified |
|---|---|
| Sender | hash160(pubkey) == senderHash compiled into bytecode |
| Authority | hash160(pubkey) == authorityHash compiled into bytecode |
| Recipient | hash160(pubkey) == recipient_hash from NFT commitment |
| Vault Signer | hash160(pubkey) matches one of the stored vault signer hashes |
| M-of-N Signers | required signer subset validated by the treasury covenant |
| All N Signers | every registered signer participates in the same transition |
| Permissionless | any caller may submit the valid transaction when contract conditions are met |
Streaming Covenants
| Function | VestingCovenant | RecurringPaymentCovenant |
|---|---|---|
claim() | Recipient | , |
pay() | , | Permissionless |
complete() | Permissionless after end | , |
pause() | Sender | Sender |
resume() | Sender | Sender |
cancel() | Sender if cancelable | Sender if cancelable |
transfer() | Recipient if transferable | , |
refill() | , | Sender |
Distribution Covenants
| Function | Airdrop | Grant | Bounty | Reward |
|---|---|---|---|---|
claim() | Permissionless submission with claim-authority co-sign | , | Authority co-sign | , |
releaseMilestone() | , | Authority | , | , |
reward() | , | , | , | Authority |
pause() | Authority | Authority | Authority | Authority |
resume() | Authority | Authority | Authority | Authority |
cancel() | Authority if cancelable | Authority if cancelable | Authority if cancelable | Authority if cancelable |
transfer() | , | Recipient if transferable | , | , |
Treasury Covenants
| Function | VaultCovenant | ProposalCovenant |
|---|---|---|
spend() | M-of-N vault signers | , |
unlockPeriod() | any single vault signer | , |
approve() | , | registered vault signer |
execute() | , | permissionless after timelock |
cancel() | , | M-of-N vault signers |
expire() | , | permissionless after deadline |
pause() | any single vault signer | , |
resume() | M-of-N vault signers | , |
emergencyLock() | all registered signers | , |
Governance Covenants
| Function | VoteLockCovenant |
|---|---|
reclaim() | voter after unlockTimestamp |
earlyReclaim() | voter after final proposal state is known |
What the Backend Cannot Do
The backend API and indexer do not get special contract privileges. They cannot:- spend from a covenant without the right signer set
- override caps, schedules, or allowlists
- cancel non-cancelable state
- redirect payouts to unauthorized recipients