Security
Manage the protected roles and the time lock that every other rule on the account depends on.
Where: Policies → Security · You need: owner wallet connected; a broadcaster to submit signed changes; the Recovery wallet to start or cancel a transfer of ownership
Ownership
Owner controls the account: it administers roles and policies and approves delayed requests. Recovery "Receives ownership if you need to recover the account." It is the fallback when the owner key is lost or compromised. The two must be different addresses.
Transfer ownership
Ownership moves to the Recovery address, not to an arbitrary one. The form shows Current owner and Recovery address (receiving owner). The transfer is time-locked: "Transfer waits 1d before it can complete." (the delay is your current time lock).
Only the Recovery wallet can start the request, and only the Recovery wallet can cancel it. The owner cannot raise a transfer of its own ownership. Either the owner or Recovery may approve it once the delay has run.
Connect the Recovery wallet, click Transfer ownership, review both addresses, click Submit request.
The request appears in Approvals as Blocked while the time lock runs.
After the delay, the owner or the Recovery wallet opens it and clicks Approve. Ownership changes at that moment. Cancel is available during the wait, to the Recovery wallet only.
The receiving address is fixed when the request is made. Changing Recovery afterwards does not change a pending transfer.
Recovery
Set recovery (when none is set) or Update recovery changes the fallback address. It is a signed meta-transaction: the owner signs, a broadcaster submits. The Overview card shows Recovery not set until this is done; treat that as urgent, because without it a lost owner key means a locked account.
Time lock
Current delay is the wait every pending on-chain request must sit through before it can be approved: "Every pending on-chain request must wait this long before it can be approved."
What the delay protects
The delay is the window in which a request can be cancelled. If a signer's key is misused, the time lock is what gives an approver time to notice the request in Approvals and click Cancel before anything moves. A longer delay means more safety and slower operations; pick it for the value at risk.
Change it
Click Change time lock.
Enter an amount and a unit (Minutes, Hours, Days). The value must be greater than zero. Accounts deployed with the Web3 shell require at least 1 day.
Sign; a broadcaster submits.
The new delay applies to requests made after the change. Requests already waiting keep the delay they started with.
Broadcasters
Broadcasters are the 1 to 3 addresses that may submit signed meta-transactions for this account and pay the gas. They are the wallets that click Execute on the Approved tab, and they submit every signed configuration batch. The button reads Manage broadcasters whenever at least one broadcaster is set, and Add broadcaster only while the account has none. It adds, replaces or removes an address.
A broadcaster must be a different address from the owner. The owner authorises by signing; the broadcaster submits. If the same key did both, a compromised broadcaster key would also be a compromised owner, and the signed path would offer no separation. Deploy validation enforces this: "Broadcasters and recovery must use different addresses (up to 3 broadcasters)."
How each change is executed
Transfer ownership
Time-locked request → wait → approve
Recovery requests; owner or Recovery approves after the delay; only Recovery can cancel
Set or update recovery
Signed meta-transaction
Owner signs; broadcaster submits
Change time lock
Signed meta-transaction
Owner signs; broadcaster submits
Manage broadcasters
Request → approve, as a delayed release or a signed approval
Owner requests; owner approves after the delay, or signs an approval a broadcaster submits
Recovery and time lock changes are single-signature: one signed meta-transaction requests and approves in the same step, so there is nothing to wait for and nothing sits in the queue. Ownership and broadcaster changes are not. Each opens a pending record that waits in Approvals for a separate approval, so a broadcaster change is never one signed message on its own.
Where a change is signed and then submitted, the signed item sits on the Approved tab of Approvals until a broadcaster executes it. You can move it between devices as a signed file.
Related
Last updated
Was this helpful?