What Moat stops.
What it doesn't.

It stops

• Stolen seed phraseThe thief can only start a withdrawal. It waits. You get an alert, cancel it, or send everything to your safe wallet.
• Phishing signatureA bad signature from your vault wallet can at most start a withdrawal, which waits and can be stopped. Your everyday wallet is the one that gets drained, and it only holds pocket change. The rest is behind the moat.
• Wrench attack at homeYou can open the app in front of them. The money still waits the full time and your trusted contact can cancel from elsewhere. There is nothing to hand over right now.
• SIM swap, stolen phoneA phone alone can only start a withdrawal. Your trusted contact, on another phone, sees the alert and stops it.
• Malware, drainersSame as a stolen seed: a withdrawal has to wait, and can be cancelled or rescued.

It does not stop

• Someone holds you longer than the waiting time, and you have no trusted contactThe delay buys time, not a miracle. A trusted contact on another phone is what turns time into safety. Set one.
• You lose every keyLose the vault wallet, the trusted contact and the safe wallet, and nobody can recover the money. Not us, not anyone. Back them up.
• Tokens with a freeze authority or permanent delegateSome tokens let their issuer freeze or move balances. A vault can't protect you from the token's own issuer. SOL and most big tokens have no such power.
• Tokens with special transfer rulesSome Token-2022 tokens run extra code on every transfer (transfer hooks). Most work; a few may not.

The three keys

The exact on-chain rules

• Open a vaultAnyone, once per wallet. Sets the waiting time (1 hour to 30 days), the trusted contact and the safe wallet. None of the three can change later.
• Add moneyAnyone can send SOL or tokens to the vault address.
• Start a withdrawalOnly the vault wallet. One at a time. It sets an amount and a destination and starts the countdown.
• Cancel a withdrawalThe vault wallet or the trusted contact, at any time before it's sent.
• Send a withdrawalAnyone, but only after the countdown ends, and only to the destination that was set when it started.
• Emergency rescueThe vault wallet or the trusted contact. Sends everything, at once, only to the safe wallet. Cancels any waiting withdrawal.
• Change the rulesNobody. The program has no admin key and its code is immutable.

What was reviewed

The program went through an internal adversarial review: we tried to steal from it with stolen keys, bad accounts and odd tokens, and fixed what we found. This is not a third-party audit. If you want one before trusting it with a lot, that's the right instinct.

• FIX 1Token transfers now pass through the extra accounts that transfer-hook tokens require, instead of failing on them.
• FIX 2Every token account the program touches is checked strictly: right owner, right token, right token program.
• FIX 3The trusted contact and the safe wallet must be different from the vault wallet and from each other, so a stolen key can't rescue to itself.
• FIX 4A withdrawal can't be sent back into the vault, and a rescue can only go to the stored safe wallet.

The program itself

• IMMUTABLEThe upgrade authority was removed. The code on-chain today is the code forever. You can check that below, live.
• NO ADMINThere is no admin key, no pause button, no backdoor. The program only ever does the six things listed above.
• NO FEESMoat takes nothing. You pay Solana's normal network fee, a fraction of a cent, plus a small deposit Solana keeps in the vault account.
• PRIVATE DEPOSITSOptional, and the one place Moat holds money. A private deposit sits in one of Moat's shared pool wallets for 15 to 90 minutes (up to about 2 hours), then goes to your vault in 1 to 3 parts from other pool wallets. The pool keys live on our server, so during that window you trust Moat. Amounts are fixed (0.1 to 10 SOL) so deposits blend; Moat takes no fee. Moat's database links each payment to its vault until delivery. Privacy grows with the number of users. A payment sent after its 30 minute window is never lost: it is flagged for refund.
• SOURCESource available on request. A public repository is coming; the link will live here.