Overview
Ostrune is a commitment device for your own crypto. You deposit funds into a personal, non-custodial vault. Small withdrawals, up to an instant allowance you set, leave immediately. Anything larger is queued under a cooldown you chose, during which you can cancel it. The defining property: loosening any rule is itself subject to your active cooldown, so you can never remove the brake faster than the brake.
There is no protocol backend, oracle, keeper, token, admin key, or privileged operator. The vault is a single smart contract that you, and only you, own. Ostrune the interface is a thin, optional client; every rule and balance it shows is read directly from the chain. Its server route only authenticates and forwards capped gas-sponsorship requests and cannot change vault state without your signature.
Core concepts
The vault
A vault is one smart contract with a single immutable owner, created for you by the factory. It holds native MON. Only the owner can withdraw or change rules; the contract itself has no way to move funds anywhere the owner did not direct.
The instant allowance
Every vault has an instant allowance that refills continuously over a refill window, like a token bucket. If your allowance is 0.1 MON over a 24-hour window, you can take up to 0.1 MON at once with no delay, and the spendable amount climbs back to full over the next 24 hours. Withdrawals within the currently available allowance execute in a single transaction.
The cooldown
Any withdrawal larger than the available allowance does not execute. It is queued as a ticket with a fixed amount and recipient, and it can only be executed once the cooldown you set has elapsed. Until then you can cancel it. The recipient and amount are locked at the moment you queue, so once mature the ticket can be executed by anyone without changing where the funds go.
The self-binding rule
Tightening a rule, a longer cooldown, a smaller allowance, or adding a guardian, takes effect the moment you submit it. Loosening a rule queues under the cooldown already in force. You cannot shorten the delay, raise the allowance, or drop the guardian any faster than the current cooldown allows. This is what makes the commitment real.
Using Ostrune
The hosted app walks the whole flow. Every action is a real Monad Mainnet transaction; the interface never fakes a result.
- Connect. Sign in with an email, a social login, or your own wallet. Ostrune resolves your smart account and looks up whether you already have a vault.
- Create a vault. If you have none, set a cooldown, an instant allowance, a refill window, and an optional guardian. The app shows, in plain language, how long weakening those rules will later take.
- Deposit. Move MON into the vault. Deposits are never delayed.
- Withdraw. Within your allowance it sends immediately. Beyond it, the app queues a ticket and shows the exact time it can be executed.
- Cancel, veto, or execute. Cancel a pending ticket yourself, have your guardian veto it, or let anyone execute it once the cooldown matures.
- Change rules. The app labels each change Apply immediately or Queue for X, driven by the contract's own classification, not a guess.
Rules and self-binding
A vault has four rules:
- Cooldown — how long a queued withdrawal or a loosening rule change must wait.
- Instant allowance — the most you can withdraw with no delay.
- Refill window — how long the allowance takes to refill from empty to full.
- Guardian — an optional address that can veto queued withdrawals.
A proposed change is a tightening if it makes every dimension at least as strict, and strictly stricter on at least one. Anything else is a loosening and queues. Because the allowance and window together define a refill rate, the contract compares rates by cross-multiplication, so you cannot loosen by raising the window and the allowance in tandem. The interface mirrors this with the contract's own wouldTighten view so the label you see always matches what the chain will do.
The guardian
A guardian is a second address you may name. Its only power is to veto a queued withdrawal before it matures. A guardian cannot withdraw, redirect funds, change your rules, or veto a rule change, including its own replacement. Removing or replacing a guardian is a loosening, so it queues under the current cooldown like everything else. This bounds the damage a hostile or lost guardian key can do: it can block your transfers, never move your money.
Ticket lifecycle
Every queued action is a ticket. Tickets are one of two kinds, Withdrawal or RuleChange, and move through four statuses:
- Pending — queued, waiting for its cooldown. Can be cancelled by the owner, or vetoed by the guardian if it is a withdrawal.
- Executed — the cooldown passed and the action was carried out. Withdrawals move funds to the fixed recipient; rule changes apply the proposed rules.
- Cancelled — the owner cancelled it before maturity.
- Vetoed — the guardian blocked a queued withdrawal.
A rule-change ticket queued under an old rule set can become stale if the rules change underneath it. The contract exposes isStaleRuleChange so a stale ticket is surfaced honestly rather than silently applying outdated terms.
Contract reference
Addresses
Ostrune is deployed on Monad Mainnet (chain 143). Source is verified; you can read every value below directly on the explorer.
- Factory — 0xCe626D03e79181e1d1cA7C5dCf1446c6c725cA62
- Reference vault — 0x09AaC246358905e5559eaD9F5a9171f122feb775
Factory
createVault(cooldown, allowance, window, guardian)— deploys a vault owned by the caller and returns its address.vaultOf(owner)— the vault address for an owner, or the zero address if none.
Vault, owner actions
deposit()— payable; adds MON to the vault.withdraw(amount, to)— sends immediately within the allowance, otherwise queues a ticket.proposeRules(rules)— applies a tightening at once, or queues a loosening.cancel(ticketId)— cancels a pending ticket.
Vault, other actions
veto(ticketId)— guardian only; blocks a pending withdrawal.execute(ticketId)— anyone; carries out a matured ticket to its fixed recipient.
Vault, read-only
rules(),rulesVersion(),owner(),balance()availableNow()— the allowance spendable this instant.ticketCount(),tickets(id),isStaleRuleChange(id)wouldTighten(rules)— whether a proposed rule set would apply immediately.
The full source, ABI, and tests are in the public repository.
Security model
The vault has one immutable owner and no administrator. The factory has no owner and no upgrade path. There is no proxy, no selfdestruct, no delegatecall, and no sweep or rescue function. Queued withdrawals fix their amount and recipient at queue time, so a matured ticket cannot be redirected. The test suite covers the core paths and every escape attempt, runs each fuzz test ten thousand times, exercises stateful invariants across thousands of call sequences, and reports zero high and zero low findings under static analysis. Details are in the security policy.
Ostrune has not had an independent professional audit. Treat it as experimental software and use it with funds you can afford to risk.
Limitations
- No emergency access. A binding vault is a liability if you need funds urgently. Any escape hatch would defeat the mechanism. Choose a cooldown you can live with and keep emergency money elsewhere.
- Guardian risk. A guardian can grief you by vetoing, or lose their key. The guardian is optional, veto-only, and replaceable subject to the cooldown.
- Bypass by not funding. Ostrune only governs money you put inside it. That is inherent to any non-custodial commitment device.
- Unaudited. No independent professional audit has been performed.
FAQ
Can Ostrune, or anyone, take my funds?
No. The vault has a single immutable owner and no admin. Withdrawals go only where you direct them, and queued ones fix their recipient in advance.
What if I lose access to my wallet?
The vault is owned by your account. If you lose control of that account, no one, including the maintainer, can recover the vault for you. This is a property of self-custody, not a feature of Ostrune.
Why can anyone execute my matured withdrawal?
Because the recipient and amount were fixed when you queued it, permissionless execution cannot change the outcome. It simply means a matured withdrawal is not stuck waiting on you to send a second transaction.
Is the interface required?
No. The interface reads and writes the same public contract you could call yourself. If it ever goes offline, your vault and funds are unaffected and remain reachable directly on-chain.