Security model
What the contracts allow, what they forbid, and how to check each claim on this page yourself rather than believing it.
There is no admin
The Lockbox contracts have no owner, no roles, no pause switch and no upgrade path. Every parameter, including the fee and where the fee goes, is fixed when the contract is deployed and can never be changed. Nobody can withdraw your tokens early, shorten a lock, redirect a payout or pause a claim, and that includes us.
There is exactly one thing about a live lock that can move, and it only moves one way. The beneficiary of a plain timelock can push its unlock date further out, for free, as many times as they like. Nobody else can do it, it can never pull a date closer, it stops working once the lock has opened, and it is refused outright on anything with a vesting schedule. So the date shown on a lock is a promise that the tokens are not available before then, never a promise that they become available exactly then.
This cuts both ways and you should know the cost. If you lock tokens to the wrong address, name the wrong beneficiary or pick the wrong date, there is no support desk that can undo it. The same property that stops us interfering stops us helping.
Each lock is its own wallet
Deposits do not sit in a shared pool. Every lock creates a fresh vesting wallet holding only that lock's tokens, and the deposit goes straight into it. One lock can never be paid out of another lock's funds, and a badly behaved token can only ever affect its own lock.
The main contract is not a custodian. Tokens touch it only in passing, inside the transaction that moves them, and it never holds a balance between calls.
Who can take the tokens out
- A standard lock: only the named beneficiary receives them, and only as the schedule releases. Anyone can trigger the release, which is deliberate, but the tokens can only ever arrive at the beneficiary.
- A transferable vault: whoever holds the NFT at the moment of the claim receives them. Selling or sending the NFT hands over the remaining stream, which is the whole point of that product.
- A burn: nobody, ever. The tokens go to an address that has no private key.
What this does not protect you from
Being straight about the limits is more useful than a list of assurances.
- Hostile or unusual tokens. A token that can mint, pause transfers, tax them or blocklist addresses can still do all of that to tokens sitting in a lock. Locking does not tame the token.
- Fee on transfer tokens. If a token deducts a fee when it moves, the lock records the amount you asked to lock while the wallet holds what actually arrived. Claims pay out what is really there, so the stated figure reads high for those tokens.
- Mistakes in what you typed. The wrong beneficiary is permanent.
- A contract that cannot claim. If you name a contract that has no way to call the release function, its tokens stay locked forever.
How to check all of this
Do not take the above on trust. The source of every deployed contract is verified on the block explorer for its chain, which means the code you can read is provably the code that runs.
- Open the contract on the explorer from any lock page on this site.
- Confirm the source is verified, then read it. Search for owner, admin, pause and upgrade.
- Read the fee as a public value from the contract rather than from any website, including this one.
- Check the vesting wallet holding your lock, and confirm the balance is really there.
The guide to checking someone else's lock walks through the same process from a buyer's point of view.
Reviews
The transferable vault contracts were reviewed by an independent developer before release, and one change came out of that review: the mint no longer asks the recipient's wallet to acknowledge the NFT, because wallets on these chains commonly delegate their code in a way that would have rejected the lock and reverted the whole transaction. Lockbox has not had a paid audit from a named security firm, and saying so plainly is better than implying otherwise.