Dual-signature flow

​

The rule

1. User signature — EIP-712 from the vault owner EOA.
2. Backend signature — EIP-712 from a platform backend key: any address holding BACKEND_ROLE on the VaultFactory (VaultFactory.isBackend(signer)).

​

Sequence

​

Why two signatures

• User signature. Proves user authorised this specific withdrawal.
• Backend signature. Attests the request passed platform compliance (AML, banned-destination, restrictions).
• Unilateral backend moves are impossible. The backend’s key alone doesn’t unlock the vault.

​

What the on-chain verifies

function withdrawERC20(
    address token,
    address to,
    uint256 amount,
    uint256 salt,
    uint256 deadline,
    bytes calldata ownerSig,
    bytes calldata backendSig
) external {
    if (block.timestamp > deadline) revert WithdrawExpired();
    // Compliance restriction on this vault's owner
    if (!depositLimitRegistry.canWithdraw(vaultOwner)) revert WithdrawalRestricted();

    // EIP-712 digest of WithdrawERC20(token, to, amount, salt, deadline)
    // under this vault's domain (see the EIP-712 page)
    bytes32 digest = ...;
    if (usedDigests[digest]) revert WithdrawAlreadyUsed();
    usedDigests[digest] = true;

    if (ECDSA.recover(digest, ownerSig) != vaultOwner) revert InvalidOwnerSignature();
    if (!factory.isBackend(ECDSA.recover(digest, backendSig))) revert InvalidBackendSignature();

    if (amount > ledgerERC20[token]) revert InsufficientLedger();
    ledgerERC20[token] -= amount;
    IERC20(token).safeTransfer(to, amount);
}

• Digest-based replay protection — single-use per digest.
• Revocable before execution — the vault owner or a platform backend key can call invalidateDigest(digest) (or the batch invalidateDigests) to burn a signed withdrawal before it is submitted; any later submission of that digest reverts. See Digest invalidation.
• Emergency withdraw — if the backend is gone or refusing legitimate withdrawals, the vault owner calls initiateEmergencyWithdraw(); after a 7-day timelock it can drain the vault to the owner address during a 7-day window, with no backend signature. See Emergency withdraw.

​

Backend co-signer security