Browser to BlockDAG

Your Desk profile is an age-encrypted container in browser storage, locked by your password. Since profile v3 all keys derive from one HD master seed, so a single key-file export also covers safes and deals you create later. The decrypted profile exists only in page memory; the export is a file only you hold. Losing the export and the password means losing access — there are no accounts and no reset.

Every money instrument runs on two SilverScript covenants: vault.sil (7 spend paths) and escrow.sil (10 fixed payout paths; Deposit reuses it with the depositor as the default side). The compiled script is enforced by Kaspa consensus — Toccata covenants, mainnet since June 30, 2026. Every path asserts a single input and an on-chain fee cap. The sources are open and unaudited; hashes and verification steps live in the Security Center.

The service runs its own Kaspa node; the same node fronts the public endpoint node.kaspaforge.org:16110 used by the open-source recovery tools, so vaultctl and dealctl work even without our web. The API stores public parameters and broadcasts already-signed transactions — it never holds a key that could move funds.

Kaspa nodes do not index address history. The Desk assembles your transaction history from a public Kaspa indexer plus its local journal — display only. Funds never depend on an indexer: covenant state is read directly from the node, and recovery works against any Kaspa node.

Optional Forge Sync mirrors a safe projection of your profile between your devices. It is encrypted end-to-end before upload; the server stores ciphertext-only records it cannot read, and vault alarm keys never enter the mirror — even when one is stored in the encrypted profile. Sync cannot bootstrap an empty device: it is a mirror, not a backup.

The public pages are static files; the Desk is a React PWA, precached so it opens offline with your local data. A Content-Security-Policy restricts script sources and network destinations, shrinking the blast radius of an injection — defense in depth, not a substitute for the open-source client and an independently verified recovery kit.