How a payout is protected

How a payout is protected A workflow diagram generated by Archify. 01 / The Gate · your published rules 02 / People with permissions · then the licensed provider 03 / A second, different person EX / Held or refused Gate decides · one of six words · The Gate · your published rules Gate decides one of six words Payout instruction · to a registered beneficiary · People with permissions · then the licensed provider Payout instruction to a registered beneficiary APPROVED · ALLOW recorded · People with permissions · then the licensed provider APPROVED ALLOW recorded Approve · one person · fresh 2FA · People with permissions · then the licensed provider Approve one person · fresh 2FA Release · separate permission · fresh 2FA · People with permissions · then the licensed provider Release separate permission · fresh 2FA Provider moves the money · and reports the outcome · People with permissions · then the licensed provider Provider moves the money and reports the outcome Second approval · different person · fresh 2FA · A second, different person Second approval different person · fresh 2FA Refused · DENY · terminal · Held or refused Refused DENY · terminal Held, with reasons · a person resolves it · Held or refused Held, with reasons a person resolves it below the threshold above the threshold ALLOW HOLD · REVIEW · STEP_UP DENY resolved the only call that moves money Legend Recorded by Pehmen A person with a fresh second factor Outside Pehmen

What an attacker must defeat

  • • A registered destination, never a typed account number; cooling-off, two notices and a second approver on any change
  • • Two permissions, two fresh second factors, and above the threshold two different people
  • • Every verdict, approval and release in an append-only, hash-chained audit trail