–
–
| Asset | In Sanctum | Sends now | This hour | Rolling 24 h |
|---|
"Sends now" is the most a withdrawal can be and still leave at once: the smaller of the hourly room, the 24-hour room and the queue threshold. Anything larger waits in the queue.
Anyone can deposit. ETH goes in with one transaction; a token needs an approval first, then the deposit.
The hot key withdraws. Up to the "Sends now" amount leaves at once, with no fee. Anything larger waits in the queue for the Sanctum's delay and pays 0.25% when released. The cold key can skip the queue but is still held to the caps.
Queued transfers wait out the delay, then either key can send them in full, minus 0.25% to the FeeRouter. Either key can cancel one before then, and a Panic voids everything queued before it. Transfers queued in the 24 hours after a cold unfreeze also need the cold key's approval.
Guardians are wallets your cold key trusts. Any one of them can freeze this Sanctum for 24 hours. Together, a threshold of them can replace a lost cold key. That takes 7 days, and the current cold key can cancel it at any point. The cold key can also switch recovery off. Guardians can then still freeze, but can't propose a new cold key, and any running recovery is cancelled. New Sanctums start with recovery on.
No recovery running.
Coverage is $5 a month, paid in ETH at the Chainlink price or in USDC. Anyone can pay for any Sanctum, and months stack. Not paying never locks you out. Coverage only tells watchers whether to look after the Sanctum, and the watcher market isn't live yet.
–
The hot key can only make rules stricter. It can lower limits and lengthen the wait, and once it turns the allowlist on, it can't turn it off. A hot-key change waits 3 days, and any Panic cancels it. The cold key can set any rules at once.
Panic
Freezes the Sanctum for 24 hours: nothing leaves, and every queued transfer is voided. The hot key, the cold key and any guardian can do this.
Unfreeze
Cold key only. Ends a freeze now. For the next 24 hours guardians cannot freeze it again, and anything queued in that window needs your cold approval before it can be sent.
Require cold approval
Cold key only. An advisory flag that tells guardians and watchers to treat any queued transfer you have not approved as suspicious. The contract itself does not block on it.
Watchers
Cold key only.
Keys
Cold key only. If the hot key is stolen, Panic first, then replace it here. Moving the cold key gives the new address every power on this page. Both changes apply at once.