Postern
Every vault asks you to approve its token before you can deposit. That approval is a standing right over your balance held by somebody else, and it outlives the deposit, the redemption and your interest in the protocol. Postern measures what is standing on Robinhood Chain, and proves each one by spending it in simulation.
Reading the chain…
Every vault publishes its own security. None of them publishes yours.
Read any vault's front page and you will find four promises: no inflation attack, donations do not reprice, the fee is capped in code, the owner cannot touch principal. All four are about the vault. To reach it you signed something else.
What is audited
The contract. Its arithmetic, its access control, its rounding. This is the part with a security section, a test suite and, sometimes, an audit — and it is genuinely the hard part to get right.
- Lives in code somebody can read
- Fixed at deployment, or governed in the open
- Ends when you redeem
What you signed
An ERC-20 approval: a standing right over your balance, held by an address you do not control, with no expiry and no counterparty obligation. Your wallet offered you unlimited and you took it, because every interface defaults to it.
- Lives in the token's storage, not the vault's
- Survives your deposit, your redemption and your exit
- Ends when you go back and revoke it, and not before
This is not a bug in anybody's contract. An allowance is the correct, standard, necessary mechanism, and there is no version of ERC-20 that works without one. It is safe for exactly as long as somebody is watching the address holding it. That is the part with a measurement, and the measurement is below.
What is standing open right now
2,584 ERC-20 approvals read from 26 windows across the chain's whole life, then followed to the present block. No vendor, no key, no proxy.
transferFromProved, not inferred. For each of those 99, the spender's own transferFrom was executed from the spender's own address through eth_call — a real EVM with no persistence. The money moves and nothing is written. Two negative controls run beside every one: the same call for one unit more than the allowance permits, and the same call against a stranger's balance. Both must fail, or the proof beside them is reported void.
The doors opened on this chain, in the last few minutes
Read from the node when this page loaded, newest first — however many the last few hundred blocks happen to hold, which is why no count is printed here and one is printed underneath. Amber is an allowance that is still standing at the current block; the pale ones were spent or revoked. Nothing here is cached and nothing is a screenshot.
Reading the chain…
A postern is the small back gate. It is not a flaw in the design.
A bastioned trace is the only thing people ever built whose entire purpose was to leave no ground unobserved. Every angle in it answers one question: what can the wall see of itself? The canvas at the top of this page is that question, solved and then stood in: the camera is on the glacis outside the wall, and every pool of light on the ground is one gun's real field of fire, clipped by its embrasure, its reach, and every wall of its own fort standing in the way. The small arch in the curtain is the postern.
Dead ground against who is standing there
The shape of the fort is identical at every row. The bastion angles, the flanks, the fields of fire, the range of the weapon — none of it changes. The only variable is whether anybody is standing on the wall, and it moves the answer from 3.9% to 100.0%.
Dead ground against the salient angle
Fully manned, and only the geometry moving. The minimum sits at 98.2°, and the curve turns bad below about 85° — the sharpest salient still within half again the minimum. The manuals put a floor near sixty degrees on the same quantity; this solve was given no manual, only what a gun on a flank can see.
And the postern is the best-watched door in the fort. The ground in front of it is covered by 2 guns while the wall is manned — which is precisely why a sally port was cut into a curtain rather than anywhere else. It stops being safe at the row of the table where nobody is standing on the flanks any more, and the fort has not changed at all.
A vault that cannot leave a door open behind you
Four of its guarantees are the ones every vault already claims. They are here so they can be run rather than asserted. The fifth is about the approval.
You approve the amount you are depositing. Not more, and never type(uint256).max.
The vault reads your allowance first. Unlimited is refused. Anything other than the exact deposit is refused.
After the pull it reads the allowance again and reverts unless it is zero. A token that does not decrement is a token it will not transact with.
standing(you) is zero, and the vault publishes it. There is no key left in the lock to go back and turn.
24 of 24
properties executed on Robinhood Chain through an eth_call with no to — creation code on the real EVM. No testnet, no toolchain, no funded account, no key.
12 of 13
deliberate defects, each compiled and run, each caught. 2 survives on purpose, and the page says which and why. A suite nobody has shown to fail is a suite nobody has tested.
Nothing deployed
no canonical Postern vault is deployed — deploying costs gas from a wallet and this repository holds no key. The app deploys one from your own wallet, and the page tells you what you are signing before you sign it.