After the immutable delay, a threshold of EIP-712 signatures executes a Safe owner swap through the installed module. The recovery owner becomes active, the former owner is removed, and the watch nonce increments. The recovery line cannot cross before its time.
PLATE IV
Provable equivocation
Two conflicting recovery signatures for the same watch nonce are objective onchain proof. The equivocator’s locked WARD burns to the immutable burn sink only when WardRetainerVault can transfer that bond to the sink.
Field note
Wardline is a permissionless guardian market for smart accounts. An owner escrows a finite WETH retainer, chooses a guardian threshold and minimum WARD bond, and installs an immutable recovery delay. Guardians lock WARD, demonstrate periodic availability, and receive vested slices of the prepaid retainer. A threshold of EIP-712 signatures can start recovery only after the delay. Recovery then executes a Safe owner swap through the installed module: the recovery owner becomes active, the former owner is removed, and the watch nonce increments. If one guardian signs conflicting recoveries for the same account nonce, either signature pair becomes objective onchain evidence that burns its locked bond when WardRetainerVault can transfer that WARD to the immutable burn sink. After expiry, expire_watch must be called: it closes the watch, refunds unused WETH, then releases every WARD bond in one transaction. A blocked WARD release reverts that entire call, including closure and the unused-WETH refund. Wardline promises accountable availability and resistance to equivocation—not truthful judgment, recovery success, or loss insurance. Its fixed-supply ERC20 and purpose-separated mechanism modules are bounded, non-extractive, compatible with hidden separate-wallet protection, and designed to be fork-provable by the launch gate. A shallow market could still support an early, low-value assignment: a guardian may buy only the required bond, complete observable checkpoints, and earn externally supplied WETH. Larger-bond assignments remain a possibility as liquidity develops, not an assumption.
Survey drawings
Vesting, expiry, owner swap, release or burn
prepaid WETH · slices vest · remainder stays in the wellexpire_watch after expiry · unused WETH refund then every WARD release · a blocked WARD release reverts the whole callinstalled module · Safe owner swap · nonce incrementshonest lock opens if vault-to-guardian is clear · conflicting pair burns if vault-to-sink is clear
Module duties
Five mapped books, four bound artifacts
WardlineRolloutFactory deploys the five modules after configureToken, configureWETH, and configureGuardianDomain. Wiring finishes with setVault, setOracleReader, setFeeRouter, setPolicyBook, authorizeSlasher, and sealConfiguration. The bound mechanism set is keeper-book, vault, oracle-reader, and policy-book.
Keeper book
Bonded guardian assignments and periodic availability. A fresh 2-of-3 Safe can only register an operator in its exec-queue. The launch wallet cannot bypass that queue, and the council has no token, launch, limit, or protection authority.
Vault
Custodies prepaid WETH retainers and locked WARD bonds.
Oracle reader
Verifies EIP-712 threshold signatures and same-nonce equivocation.
Fee router
Pays vested slices through draw_retainer, a WETH-only payout that is not a WARD-screen transfer. After expiry, expire_watch closes, refunds unused WETH, then releases every WARD bond in one transaction; a blocked WARD release reverts the entire call.
Policy book
Stores immutable per-account threshold, bond, delay, and expiry terms. After the delay it executes the Safe owner swap through the installed module.
Cadastral schedule
WARD as a fixed-supply ERC20
Mark
Record
Name
Wardline
Symbol
WARD
Supply
37,418,263 — minted once to the launch wallet
Distribution
100% seeded. No presale, vesting, or airdrop.
Market
WARD/WETH on Uniswap V3. WETH names the pair; genesis liquidity is token-only.
Opening
One-sided concentrated range. Exactly 0 paired quote asset at genesis. Not a full-range deposit.
Position
External LaunchOps, acting through the launch wallet, mints the position through NFPM directly to that wallet and manages decreaseLiquidity, collect, and burn. The token never owns, stores, recovers, or exposes the LP NFT or tokenId.
Recovery
After the delay, a threshold of EIP-712 signatures executes a Safe owner swap through the installed module. The recovery owner becomes active, the former owner is removed, and the watch nonce increments. A failed owner swap refuses the recovery.
Proof
Isolated Base execution is pinned to chain 8453 block 50372547 and runtime-matches the factory plus the four bound mechanism artifacts. Observed values come from deployed state and transactions: five-module factory creation, 2-of-3 operator registration, module installation, finite WETH prepayment, two WARD bonds, availability checkpoints, delay rejection, vested WETH payment, Safe owner replacement, nonce increment, same-nonce equivocation burn, expiry refund, honest-bond release, and unchanged fixed supply.
Contract
Address unpublished
Separate-wallet protection
A distinct operator can halt transfers
Expiry refunds and honest-bond release describe the retainer mechanism only. They do not mean every address can always move WARD.
Hidden protection is deploy-only and wallet-separate from both the guardian roster and the launch desk. ward_screen’s immutable separate operator can indefinitely restrict any non-launch participant or helper, including a guardian, WardRetainerVault, or the immutable burn sink. There is no automatic restriction expiry. interdict(true) and remit(false) restrict; interdict(false) and remit(true) release; the bulk entrypoints behave the same. The operator can engage, release, and bulk those marks through a neutral inline interface; scanner paths may be auto, on-open, or manual. Intake proves engage, release, bulk release, and restored sell value. Operator misuse remains a honeypot-like trust risk. The 2-of-3 keeper council has no protection authority.
Direct WARD transfers check both non-pool endpoints. Canonical-pool transfers check only the buyer on buys and only the seller on sells. Restricting the pool address itself therefore does not stop those canonical-pool routes.
Bond entry needs guardian-to-vault clearance. Honest release needs vault-to-guardian clearance. Equivocation burn needs vault-to-burn-sink clearance. expire_watch must be called after expiry; it performs close, unused-WETH refund, then every WARD bond release in one transaction. A blocked WARD release reverts the entire call, including closure and the earlier WETH refund. Vested draw_retainer is a WETH-only payout and is not a WARD-screen transfer.