Security
How funds are protected
- Funds that rules move through the custody gate stay in your custody wallet. The gate draws on them through an allowance custody can reduce or revoke at any time.
- The gate can only pay the addresses listed when it was created. It has no admin.
- The account contract checks the approval count and the agent's rules on chain. The app can't bypass them.
- Moves under a rule with a wait show up in the Queue first, and custody or the account's signers can cancel them.
- If custody loses its keys, the Prime signers can send the funds to the gate's recovery address. At the account's full approval count they can also draw custody's funds to any other address on the gate's list, the Prime Account included, within custody's allowance. An agent's rules don't allow this.
- The co-sign page decodes the transaction itself and ignores any text sent with the link.
- A move that custody's allowance doesn't cover fails, whatever the Prime rules allow.
Setting up policies
- Keep each delegated key on a single rule. The caller picks which rule to use, so a key that is also on a rule without a policy can act through that one.
- Use the approval count to require two people. In Add a rule, two listed signers with Approvals required at 1 can each act alone; at 2, both must sign.
- Policies apply to delegated keys. The account's own signers aren't restricted by them.
- Spending limit periods are in ledgers. A ledger closes roughly every five seconds, so a day is about 17,280 ledgers.
- Pin the method as well as the amount. A spending limit counts calls named
transfer. - Reinstall a rule after changing its signers. Its policy refuses calls until you do (see Signers and approvals).
- Spending limits cap the total, not the number of calls. We have raised call-frequency limits with OpenZeppelin.
Third-party code
Spending limits and threshold approvals use OpenZeppelin's example contracts, built from OpenZeppelin's source and deployed by us. OpenZeppelin publishes them as experimental. Our internal review covered OctoGate, not these contracts.
The policy interpreter that evaluates your rules is our own. Its address and code hash are in the table below, so you can check what the account is running.
Mainnet contracts
| Address or code hash | |
|---|---|
| Prime Account code (OpenZeppelin smart account) | 91a2cd56… |
| Policy interpreter address | CAOBQ4ZXANKXAGEJWJLIGQJDFCTHMEZVUPLPX277KSDMEU4MEWVVXO2R |
| Policy interpreter code | 5143e641… |
| Custody gate code | b01024f3… |
| Execution contract code | 3dd675c0… (earlier setups run 68d012e7…) |
| Spending limit policy (OpenZeppelin) | CA7IBD266HIHFDUIBZLPIAITJUA3DVY4JAG6K3QMGBKLZCXXLP5E2F7A |
| Simple threshold policy (OpenZeppelin) | CDOGPGUFGGUDG25P3TG6XIXJKRRYOZ3PXUZIEPVH74KXRZIDKZ5HYEOS |
| Weighted threshold policy (OpenZeppelin) | CDWPZ4YZ3YIJ64XSHRMERRF2L2H7XD6SPUZDP3KI56T7QXQCICC25V3J |
When you set up your Prime Account, gate and execution contract, each is created from this code and gets its own address. The app refuses a gate or execution contract that runs any other code. Full hashes and the deployment transactions are in the oz-policy-builder repository.
The interpreter, gate and execution contract have no admin and no upgrade function, so the wallet that uploaded their code and created the interpreter has no control over them.
Audit status
OctoGate has been through our internal adversarial review and threat modelling. An external audit is in progress.