SenditBank

The model

• Accounts. An account is a wallet address (or any contract acting as its own account). Balances are balanceOf[account][asset], never keyed by a key.
• Assets. pUSD, ETH as address(0), and tokens of a launcher the operator added (isAsset). Any other token is refused. totalHeld[asset] is the exact sum of every balance and never more than the bank holds.
• Keys. Addresses an account registered with a proof signed by the key. A key spends the account's balance at venues, sends, withdraws to the account's own wallet, refuels itself and revokes. It cannot register keys, change caps or withdrawTo another address.
• Venues. The contracts allowed to debit accounts: the engine, the orders book, the vault, the copy factory, the spot router, the pUSD exchange. Each asks bank.pull(msg.sender, asset, amount) with its own caller, so a venue cannot name whose money it takes. Every payout comes back with bank.push(account, ...), never to the signer.

There is no receive(), no sweep, no balance edit, no upgrade and no fee. ETH enters only through deposit and push.

Accounts and accountOf

accountOf(sender) is the account a sender acts for: the owner while sender is a key registered under the account's current keyEpoch and the current globalEpoch, and sender itself otherwise. So a wallet resolves to itself and every venue works wallet-signed too. Positions, vault shares, copy accounts and every event name the account, never the key.

A key is stale when accountOf(keyOf(account)) != account. There is no playerOf here: that is the arcade bank's name for the same idea.

The key proof

The key consents to serving the account by signing a digest:

keyDigest(account, key) = keccak256(abi.encode(
  "SENDIT/key-proof/v1", block.chainid, address(bank), account, key,
  keyEpoch[account], globalEpoch))

The proof is the key's EIP-191 signature of those 32 bytes ("\x19Ethereum Signed Message:\n32" || digest): 65 bytes, low s, v 27 or 28 (0 and 1 are accepted). The wallet then sends it with setKey(key, proof) or inside deposit(pusdAmount, gasToKey, key, proof), which can also fund the key's gas in the same transaction.

import { encodeAbiParameters, parseAbiParameters, keccak256 } from "viem";
import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";

const key = privateKeyToAccount(generatePrivateKey()); // keep the private key safe

// ADD a key under the epochs in force: the bank computes the digest for you.
const digest = await client.readContract({
  address: bank, abi: bankAbi, functionName: "keyDigest", args: [account, key.address],
});
const proof = await key.signMessage({ message: { raw: digest } }); // EIP-191, 32 bytes

// REPLACE every key of the account: the same digest under keyEpoch + 1.
const [epoch, global] = await Promise.all([
  client.readContract({ address: bank, abi: bankAbi, functionName: "keyEpoch", args: [account] }),
  client.readContract({ address: bank, abi: bankAbi, functionName: "globalEpoch" }),
]);
const nextDigest = keccak256(encodeAbiParameters(
  parseAbiParameters("string, uint256, address, address, address, uint64, uint64"),
  ["SENDIT/key-proof/v1", 78270n, bank, account, key.address, epoch + 1n, global],
));
const replaceProof = await key.signMessage({ message: { raw: nextDigest } });

Epochs: add or replace

A proof is checked against one of two epoch pairs, and which one decides what happens:

• Current epochs: ADD. The key joins the account's live keys; every other key stays live (one key per device).
• keyEpoch + 1: REPLACE. The bank revokes first (the epoch moves on, every key ends, KeyRevoked), then registers the key under the new epoch.

revokeKey() ends every key of the account; rotateKey(newKey, proof) revokes and registers in one transaction, with a proof under the new epoch. invalidateAllKeys() moves globalEpoch and ends every key on the bank. keyOf(account) is only the key registered last, where the deposit's gas goes.

Caps

A key's pUSD and ETH outflows to third parties (send, refuel, and pulls by a capped venue, which today is the spot router) count against per-account daily caps over a fixed 24-hour window from the first charged outflow. Perps, the vault and copy are uncapped, launched tokens too, and wallet-signed calls are never charged. The contract's defaults are 10,000 pUSD and 5 ETH a day; the testnet deploy turned them off (UNCAPPED, read defaultCaps()). An account sets its own with setKeyCaps from its wallet: 0 means the default.

Pause

setPaused(true) stops venue pull and move, and key-signed send and refuel. It never stops withdraw, withdrawTo, push (so positions still close and payouts land), deposits, key registration and revocation, or a wallet's or a contract's own send (a copy account pays its copier through send). The pUSD exchange honours the bank's pause for both of its doors.

Venues and the 24-hour delay

A venue can debit any account through the sender it passes, so venues are the bank's trust root. Adding one is proposeVenue, then activateVenue after VENUE_DELAY (24 hours): a VenueProposed event gives every account a day to withdraw first. listVenueNow skips the wait only before the bank's very first credit. removeVenue is immediate, and a removed venue can still push.

Functions and events