How Kaspa Safe works

Kaspa Safe is a vault for KAS that lives directly on the blockchain. Every withdrawal waits out a delay you chose; a separate alarm key can cancel a theft in progress; an optional dead-man switch passes the vault to an heir. This page walks through the actual mechanics — down to the covenant's spend paths — and the security model.

The covenant: every coin has a fixed set of exits

A vault is an instance of the open-source covenant contract vault.sil (Kaspa Toccata, mainnet). The coins are locked by a script with exactly two states — in vault and withdrawal pending — and a short list of transitions. Anything not on this list is not a "forbidden action" the server refuses; it's a transaction the Kaspa network itself won't accept, because no such path exists in the script.

The keyless paths are the trick that lets the server be helpful without being trusted: our watcher can complete your matured withdrawal or deliver an inheritance, but the covenant hard-wires where the money goes. Time is measured in DAA — Kaspa's native "ticks", roughly 10 per second (36 000 DAA ≈ 1 hour); the interface always shows human units.

The three keys

The hot and funding keys are generated in your browser and saved automatically into your encrypted master key file. The safer default keeps the alarm key only on the card; the wizard lets you choose shared profile storage instead. If you choose shared storage, export a fresh full .age copy after creating the Safe: Forge Sync strips alarm_sk, so a synced second device cannot cancel a withdrawal without that full copy. We never see any of the keys.

Creating a vault, step by step

1. Pick the rules. Cancel window: presets 6 h / 24 h / 48 h / 7 d / 14 d, or custom 1 hour – 90 days (24 h is a sane default — under 6 h you might sleep through a theft). Optional inheritance: 6 / 12 / 24 months or custom 1 day – 5 years, delivery automatic or by the heir's key.
2. Keys are forged. The browser generates the three keys: hot and funding go straight into your Desk profile. The alarm key defaults to a separate alarm card — download or print it and confirm the last 4 characters — or you can choose to keep it in the encrypted profile. If inheritance is on, you enter the heir's Kaspa address (and, optionally, their email for a free notification when the window opens).
3. Fund it. Send KAS to the shown funding address, then press "Lock into vault" — your browser assembles and signs the covenant transaction. The funding address is your own address (its key was just created into your profile), not ours: until you press the button, the coins are entirely under your control. This intermediate step exists because a covenant can't be created by a plain transfer. Never send coins directly to the vault address — a direct transfer doesn't become part of the covenant. Topping up later = one more funding cycle (or one click of "To safe" from the Desk wallet).
4. Sealed. You see the vault address, amount and txid — and can connect Telegram alerts. Everything cryptographic happened in your browser; the server received only public parameters.

When the alert says "a withdrawal has started"

You have the whole cancel window. In separate-storage mode, any browser plus your alarm card is enough. In shared-storage mode on another device, import the full encrypted .age copy exported from the creation device — Forge Sync alone does not carry the alarm key. Open My vault, press ⛔ Cancel withdrawal, and move the funds to a fresh vault. Since you control both keys, the migrate path can do the move instantly via the open-source vaultctl. The full playbook lives on the Recovery page.

Inheritance, honestly

1. The timer is the on-chain age of the vault coin: check in at least once per period and the vault stays yours. Cancelling a theft also resets it.
2. In automatic mode the heir needs no key and no software — after the period the coins arrive at their address by the keyless path. In manual mode the heir claims with their own key. Before the period expires the heir can see and take nothing.
3. The optional heir email notification is free and doesn't depend on any subscription — it fires when the window opens, contains the vault address and instructions, and never any keys or amounts.
4. Point inheritance at your own second address and it doubles as insurance against losing the hot key.

What it costs

Security model

1. The server can't steal. No private keys ever reach it, and the keyless covenant paths hard-wire their destinations (a matured withdrawal → its fixed address; auto-inheritance → the heir). What the server stores: public keys, delay parameters, and — if you opted in — an heir email / Telegram link. See Privacy.
2. A thief with the hot key gets zero. The only way out is the delayed withdrawal with a publicly visible, fixed destination — and the alarm key cancels it.
3. A thief with BOTH keys wins instantly. Hot + alarm together are full owner authority: the migrate path moves the vault anywhere with no delay. Separate storage is therefore the safer default. Choosing shared encrypted-profile storage trades that isolation for convenience and makes the full file a single point of failure.
4. The service dying doesn't touch your money. The vault is an on-chain contract that checks only keys and time. The open-source vaultctl CLI performs every operation from a terminal against any Kaspa v2+ node (run with --utxoindex); the offline decryptor extracts your keys from the backup without any network. To simply watch a vault, paste its address into any Kaspa explorer.
5. Lost both keys, no inheritance? The coins are frozen forever — nobody, including us, can reach them. That is the flip side of non-custodial; enable inheritance, even "to yourself".
6. Verify, don't trust. The contract and tools are public: github.com/Kaspaforge/kaspaforge. vaultctl selftest runs 25 checks of every path and attack inside the node VM.

See also: Kaspa Safe overview · Recovery · the Desk & your keys · how Escrow works