19 Trust
Roadmap
A sober status table of what exists and what comes next, and a short changelog.
#Status
| Phase | Scope | State |
|---|---|---|
| V0: contract and lab | Oopsend.sol (ETH and ERC-20: claim, undo, expiry, fee accrual), 30 Foundry tests plus a fork test with real USDG, the JavaScript engine, the lab, the site, these docs | built |
| V1: deploy | deployment to Robinhood Chain (0x7B530e91D9dc24C78Ca2eEE2B494E7dE1B680AC0, block 90156561), the app pages (app.html to send and undo with a wallet, claim.html for the recipient) pointed at it | done |
| V1.1: gasless claims | a public relayer so recipients need no ETH, with simulation and spending caps. The contract needs no change | design |
| V1.2: undo from X | the @UseOopsend undo bot and the undo page, see Undo from X | design |
| V2: on-chain buyback | a contract that turns swept fees into a buyback and burn that anyone can trigger, replacing the hand-run wallet | design |
| V3: scheduled and multi-recipient | scheduled sends (claimable only after a time), multi-recipient links (N claims per link), batches | research |
Nothing in V1.1 to V3 is promised. They are ordered by how directly they follow from the contract, and they may change.
#What "built" means here
The contract compiles, passes its tests and is deployed. The lab and the home page attacks run its rules in a browser on a local ledger, which is a simulation and not the chain. See Risks.
#Principles for what comes next
- Keep the contract small. New behaviour goes in new contracts and in the app, not into the escrow.
- Never add an admin path to escrowed funds. That is the property the whole design rests on.
- Say what is a design and what is running. This page is the place where that is written down.
- Caps stay low until there is a track record. They can be raised later by the admin, by the admin.
#Changelog
#0.2: live on Robinhood Chain
- Deployed at
0x7B530e91D9dc24C78Ca2eEE2B494E7dE1B680AC0(block 90156561, transaction0x877015a2d1ff4810350bd413ab139e409a35a82a98e495c08c1311ccaca2da75) with admin and fee wallet0x59B6919AdC07a3b6a6D7b91f7773A721bD0c6c73, fee 30 bps, ETH cap 2 ETH, token cap 100 bps. - Exercised on the real chain: create and undo, create and claim to a fresh address, refused wrong-recipient and wrong-key claims, early refund refused, claimed link not claimable twice, fee sweep.
node scripts/live-check.mjsreplays it. app.htmlandclaim.htmlare wallet-only and use this address.
#0.1: contract and lab
Oopsend.sol: create (ETH and ERC-20), claim by EIP-712 signature naming the recipient, undo by the sender, permissionless expiry refund, fee accrual with permissionless sweep, admin tuning limited to fee up to 1%, caps and pause.LinkCreatedcarries the linkid, so a sender can list and undo their own links from chain events on any device.- 30 Foundry tests (unit, fuzz, re-entrancy), 1 fork test with real USDG on chain 4663.
- JavaScript engine reproducing the Solidity vectors exactly; 15 parity tests.
- Lab, home page attacks, docs.