scafonix vault — Programmable MPC Vault (pEOA)

1. Security Policy Specification

The policy below is canonically hashed and cryptographically bound to the 2nd key share ($sk_B = sk_{B\_seed} + h_p$). Neither scafonix nor the user can modify or relax this policy post-generation.

Daily Spending Limit — Max 0.1 ETH per transfer on Ethereum Mainnet.

Whitelisted DEX Router Only — Restricts calls strictly to verified Uniswap V3 Router.

Custom IAM Policy JSON — Define arbitrary AWS IAM-style statements.

Canonical Policy Document (JSON):

Deterministic Policy Hash (h_p): -

2. Emergency Recovery Password

Password (used to encrypt Share C voucher):

This password encrypts your offline recovery ticket via AES-256-GCM. It is never transmitted to any server.

Advanced Network Settings (2nd Inspector Endpoint)

Inspector API Endpoint:

3. Vault Generation Result

CRITICAL BACKUP REQUIREMENT: Save the Emergency Recovery Voucher (Share C) below. Neither scafonix nor the inspector server stores a copy of Share C. If the server is offline or permanently decommissioned, this voucher and your recovery password are the only way to recover your assets.

On-Chain Vault Address	0x...
Client Share (sk_A)	0x...
Inspector Commitment (Q_B)	0x...
Mathematical Verification	[PASSED] In-browser WASM verified Q = Q_A + Q_B matches on-chain address.

Emergency Recovery Voucher (Share C):

Recovered Signer Address	0x...
ECDSA r	0x...
ECDSA s (EIP-2 Canonical)	0x...
Recovery Identifier (v)	27
Combined Raw Signature	0x...