Don't trust us. Check.

Former owner withdraws after transferring

withdraw_* and break_seal require the caller to be the owner

Transfer an opened vault, by any path

One transfer gate, which refuses opened vaults; no other code changes the owner

Keep a signature for a sealed vault

No signature can be requested while sealed; the signer sees no call

Race break_seal against a transfer

Receipts run one at a time; whichever runs first wins, the other fails cleanly

Transfer while a withdrawal is being signed

A signature in flight means the vault is opened, which refuses transfers

Bypass the gate: approvals, the transfer_call return leg, a forgotten path

No approvals extension; the return leg uses the gate; a test fails if any other code writes the owner

Make the contract sign arbitrary bytes

Typed withdrawals only, built in-contract: EVM native transfer, Bitcoin SIGHASH_ALL with change to the vault, Solana one system transfer with a recent blockhash

Collide derivation paths to sign for another vault

Paths built only by the contract from sequential IDs and fixed chain tags

A signer timeout or error leaves the vault stuck

The callback never panics; the record fails, the vault stays opened, a retry works

Two signatures exist after a retry

Both pay the same owner and spend the same coins or nonce; at most one confirms

Admin or upgrade powers

No admin, upgrade or raw-sign methods; full-access keys deleted; code hash published

Drain storage to freeze the contract

Every state-growing call pays; the custody log is capped at 16

A stale copy of a Bearer link takes the vault after it was passed on

A link is the key of the account holding the vault; passing it on moves the vault to another account, so an old copy controls an empty one

A seller takes payment and never transfers

Out of scope: Bearer guarantees what you receive, not that someone pays you. Said on the How page

Wrong display data from an indexer

Balances are labelled observed, with source and time; the contract never relies on them

Deposits on the wrong network

Warnings in the deposit flow; the contract signs only for Base Sepolia

The signer returns a signature for the wrong key

The callback checks every signature against the vault's own key before storing anything

Someone who sees a Bearer link takes the vault first

By design, like cash: the page says so and offers to move it out; the key stays after #, never sent to a server

Passing a vault on, or making links, stops halfway and loses the new key

The new link is stored and saved before anything moves; every step checks what already happened, so it resumes

Fake a listing by calling the market's nft_on_transfer directly

Only the Bearer contract may call it

Sell an opened vault, or one the seller no longer holds

The vault arrives through Bearer's sealed-only gate and stays in escrow; the gate checks again as it moves to the buyer

Buyer pays and gets nothing, pays a different price, or races another buyer

Exact price; a sale in flight locks the listing; the vault moves before any money; a vault that didn't move refunds the buyer

A payout bounces and the money is lost

Kept as a claimable balance for whoever holds the account name

Settlement stops halfway

Buying and delisting refuse under 60 Tgas; the callbacks never panic

Fill the market's storage for free

Each listing holds a 0.01 NEAR deposit checked against its storage, returned on sale or delisting

Someone else delists, or a delisted vault is bought

Only the seller delists; delisting removes the listing

A vault sent to the market without a listing is stuck there

return_unlisted sends it to the holder before the market, read from the custody log; never a listed vault

The market account's key holder acts as the owner of a listed vault

No admin or upgrade methods; full-access keys deleted at the locked deploy; until then the site shows the key count

Fake a schedule by calling the schedule's nft_on_transfer directly

Only the Bearer contract may call it

Release a scheduled vault before its date

release refuses until the block time reaches the date

Release it to someone other than the recipient

The recipient is fixed when scheduling; release takes no recipient

Cancel what was promised

Only the giver, only if cancellable, only before the date

The recipient's name isn't registered, so a squatter gets the vault

release checks the account exists first; otherwise the vault stays

The giver withdraws while the vault is scheduled

The schedule holds the vault and never breaks seals

Fill the schedule's storage for free

Each schedule holds a 0.01 NEAR deposit, checked against its storage

A handover stops halfway

Gas floors; callbacks never panic and put the schedule back to waiting

A vault sent without a schedule is stuck

return_unscheduled sends it back to the holder before the schedule

The schedule account's key holder acts as the owner of a scheduled vault

No admin or upgrade methods; full-access keys deleted at the locked deploy; the site shows the lock state

A buyer reads an observed balance as a guaranteed value

Listings show balances as observations, with source, time and confirmation status