> For the complete documentation index, see [llms.txt](https://argon-4.gitbook.io/argon-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://argon-4.gitbook.io/argon-docs/using-enclave/vaults.md).

# Vaults

TimeLock, Inheritance, and Last Will vaults: KAS locked by Kaspa covenants that only the people you name can claim, only when the rules you set allow.

A vault is KAS locked by a **covenant**: a small program on Kaspa itself that decides who may spend the coins and when. Nobody holds the vault for you. Not Enclave, not a server, not a multisig of strangers. The rules are in the script, the script is on the network, and SureSign builds every step from a program that ships inside Enclave.

Both views: **Desk → Vaults**. Vaults are available on Kaspa mainnet and testnet-10.

## Three products

|                                 | **TimeLock**                                              | **Inheritance**                                        | **Last Will**                             |
| ------------------------------- | --------------------------------------------------------- | ------------------------------------------------------ | ----------------------------------------- |
| For                             | Locking KAS until a date                                  | An account you use, with heirs                         | Deep storage you intend to leave behind   |
| Everyday key can                | Nothing, unless it is also the claimant                   | **Withdraw** and **refresh**                           | **Refresh only**; it can never move funds |
| Who can spend before the window | Nobody                                                    | The controller (everyday key)                          | The **cold key** only                     |
| After the window                | The claimant; backups after further waits                 | The primary heir; the backup heir after a further wait | The heir                                  |
| If the everyday key is stolen   | Nothing to steal; the lock holds                          | The vault can be drained                               | Cannot be drained; at most kept "alive"   |
| Windows                         | Lock 1–2485 days; each backup waits at least one more day | Each window 7–2485 days; the two together at most 2485 | Silence 7–2485 days                       |

### TimeLock

Lock KAS until a date. You name a **claimant** and, optionally, a **first backup** and **second backup** who can claim after successively longer waits. Anyone may add to the vault. Nothing leaves before the lock. If the person who funds the vault is not a claimant, they have no way to spend it, and the review says so before you create it.

### Inheritance

An account you continue to use, with a safety net. The **controller** can withdraw or **refresh** at any time. If the controller goes silent for the **primary window**, the **primary heir** can claim; after the **backup window** on top of that, the **backup heir** can too. A refresh restarts the clock, and Enclave reminds you before a window opens.

### Last Will

Separation of powers for savings. The **everyday key** can only refresh, proving you are alive; it can never move funds. The **cold key**, kept offline or elsewhere, is the only key that can withdraw before the window. After the **silence** window the **heir** can claim. Losing the everyday key costs you nothing; refreshing is the only thing it does.

{% hint style="warning" %}
**After the window opens, the keys race.** Kaspa's covenants can express "at least this old", not "no older than". Once a window has passed, the heir can claim *and* the controller or cold key can still withdraw; whoever's transaction is accepted first wins. Every review names the race in plain words. Refresh on time and it never arises.
{% endhint %}

## Create a vault

{% stepper %}
{% step %}

### Choose the product and the amount

Pick TimeLock, Inheritance, or Last Will. Enter the amount in KAS. A deposit must be at least 0.5 KAS.
{% endstep %}

{% step %}

### Name the parties

Each role is a Kaspa address. **This account** fills a role with your own account's key. Roles are fixed at creation; a covenant cannot rotate keys later, so choose addresses you and your heirs will still control.
{% endstep %}

{% step %}

### Set the windows

Windows are entered in days. Kaspa measures them in block-score ticks (about 864,000 per day), so the review prints each window as ticks with the calendar estimate beside it. The ticks are the rule; the calendar is an approximation.
{% endstep %}

{% step %}

### Review in SureSign

The review shows the amount locked, the covenant's name on the network, every party and window, the race, and the one **Enclave fee** (about US$0.20 in KAS) charged when a vault is opened. Adding to a vault that already holds a Note carries no fee, and the review headline says *Add* rather than *Lock*.
{% endstep %}
{% endstepper %}

## Every vault has a name the network keeps

At creation the vault is born with a **covenant identity** (KIP-20), a fingerprint Kaspa carries on the coins themselves. A refresh carries it on, so a refreshed vault provably remains the vault it was born as; a payout retires it. Enclave names the vault from that identity, in the same words the public covenant directory [kascov.io](https://kascov.io) uses, and links to its explorer page. Anyone can verify a vault without trusting Enclave.

## The register

Vaults are listed under **Active** and **Settled** (a vault is settled once its coins are gone), each named *Family · Covenant Name* with the protected amount, its stage, and the next refresh or claim time. Open one for the deposits and their individual clocks, the parties, and the paperwork.

Each deposit has its own clock: a Note added later unlocks later, never earlier. A vault with several deposits is claimed with several transactions, planned together as one job.

## Refresh, claim, withdraw

Every move on a vault is taken from its **room** in the [Deal Desk](/argon-docs/using-enclave/deal-desk.md): the register offers **Open vault room** and *Refresh in its room*. The room shows only the moves that are valid right now for your role, judged by SureSign against the vault's actual age on the network. A claim before its window is not offered, and Kaspa would reject it anyway.

## Paperwork

An heir or claimant needs to know the vault exists and be able to find it. **Paperwork** produces a document for them: what the vault is, what they will need to do, what is inside (the vault's public locator) and what is never inside (no keys, nothing that lets anyone spend), the verbatim locator text, and a QR code. **Copy packet**, **Save sheet** (an HTML file), and **Print** are available in both views. The recipient imports the locator through **Desk → Deals → Import a deal** and their room opens with their role's actions.

## Reminders

Inheritance and Last Will vaults carry a local reminder that fires in the week before a window opens and repeats at most weekly. Reminders are stored on this device, contain no addresses or amounts, and can be turned off under **Settings → Privacy → Vault reminders** or per vault.

## Fees

One Enclave fee, at creation, never again: not on top-ups, refreshes, claims, or withdrawals. A covenant spend pays the network's minimum relay fee, which SureSign tops up from one of your ordinary Notes because the program itself only releases 1,000 sompi for fees. See [Fees](/argon-docs/using-enclave/fees.md).

## Coming later

**Multi-Sig** vaults appear in Studio as a page that describes the idea and can construct nothing. **Mecenas** (recurring payments) is under research. Neither is offered until its program is proven on a Kaspa node.