Frequently asked questions

Not by itself. Moving anything out needs a one-time signature made from your 24 words. The one exception is one you choose: a session budget lets a wallet like Phantom spend up to a limit per period, only to allowed destinations, until it expires. See session budgets.

Keep savings in the vault and give your everyday wallet a small budget (for example 1 SOL a week). Phantom signs normal transactions within that budget; anything bigger needs the hash signature. Losing the phone costs at most what is left of the budget.

No. One vault address holds up to 3 signer trees of 256 one-time keys plus an optional recovery tree, so the same address serves hundreds of actions. When keys run low, migrate to a new vault with one signature.

Yes. A vault can have up to 3 signer trees (each from its own 24 words) and a threshold: 2-of-3 means two different phrases must approve exactly the same action before it executes.

Without a recovery key or co-signers: the funds are gone. With a recovery key: once the signers have been inactive for the recovery delay, the recovery phrase gets full control. With a testament: after its delay the heirs receive everything. Make backups on /backup in addition to paper.

Up to 4 trusted addresses receive withdrawals immediately. Other destinations get at most the instant limit of SOL per 24 h straight away; anything more waits out the delay as a pending withdrawal that a signer or the recovery key can cancel, or is refused when the delay is 0.

Up to 4 heirs with shares. If no signer acts for the testament delay (365 days by default), anyone can split all SOL and tokens among the heirs; a keeper does it automatically. A Ping is enough to show you are alive.

Extra deposit addresses derived from your vault, one per id. Give each customer their own; anyone can sweep them into the vault. You get per-payer accounting without publishing the vault address.

Yes, everywhere: SPL and Token-2022 for withdrawals, rules, schedules, budgets, testament, migration, invoices and the Escape Hatch. Token-2022 mints with transfer fees, hooks, permanent delegates, confidential transfers or non-transferable tokens are refused.

A fire exit for your ordinary wallet. Link it to your vault, let the hatch move your tokens (a delegate) and pre-sign a never-expiring transaction that moves your SOL. If you press panic or the quantum canary trips, everything in the wallet is pushed into your vault. Set it up on /escape.

No. It protects the moment it is triggered and races whoever broke the key. If an attacker moves first, it is too late. Tokens you receive later need approving again, and a stored SOL escape is voided when the wallet's nonce is used for something else. Keep most funds in the vault itself.

Yes, by design: that is what lets keepers act for you. It can only move your wallet's SOL into your own linked vault, so the worst a stranger can do is send it early; getting the SOL out of the vault then takes your hash signature.

When your wallet links to a vault it signs a timestamped on-chain record: proof, made while ed25519 is still safe, that this wallet belongs to that vault. Changing it takes 30 days and is impossible after the canary trips.

A bounty on an ed25519 address that nobody has a key for (it is a hash that happens to be a curve point). Only breaking ed25519 can move it; if it moves, anyone can trip the canary and keepers evacuate all linked wallets. See /canary, where you can recompute the address in your browser.

Paste it into the scanner: it shows what sits on that ed25519 key and whether the Escape Hatch covers it.

No. The destination, amount, fee and everything else are inside the signed message, and permissionless instructions only do what the vault's rules already allow. They can refuse or be slow; then anyone, you included, can send the same transactions.

The site's keeper runs once a day (a Vercel cron). A long-running keeper (bot/) can run every minute. Schedules and testaments therefore pay out after they are due, not at the exact second, unless you or someone else runs them earlier.

Yes. Sign on a device that stays offline with /offline, then carry the result back as QR codes or text and submit it on /submit. The signed result holds no secret.

Moving funds out of a vault needs only hash-based signatures, so a quantum computer breaking ed25519 does not open it. Wallets, session keys, validators and other programs still use elliptic curves. Noxvault protects what is inside the vault, and offers the Escape Hatch for what is not.

No. It runs on devnet and has not been reviewed by anyone outside the team. See risks.

Planned, not live. The idea: holders above a threshold relay for free. The contract address is not known yet. Ignore anyone sending you one before that.