Every admin key gets a lighthouse.
Promise depositors 24 hours of notice before any upgrade. Back it with a USDC bond on NEAR that your admin key can't reach. Break the promise, and the bond pays them.
follow the light
Timelocks protect depositors until a team switches them off for speed. Fair Warning keeps the speed, and makes skipping the warning expensive.
The notice clock runs on Base blocks.
An announced upgrade starts the clock. Base adds a block about every 0.2 seconds, so 24 hours of notice is 432,000 of them. Depositors can leave at any point before the hand comes round.
Follow the light from a silent upgrade to the depositors.
Scroll to move one breach through the system. Every step is a real contract call, and the hash is the one the NEAR MPC network signs.
What the admin key can't do.
Each of these is a rule in the NEAR contract, and each rule has a sandbox test.
Touch the bond.
[a]It lives on NEAR. Withdrawals wait out a notice period plus Base finality, freeze while a case is open, and need a full-access key.
Fake an announcement.
[b]A defence counts only if the MPC network finds the real Announce log on Base, at least the promised notice before the change.
Reroute a payout.
[c]Depositors sign claims with the wallet they deposited from. A relayer can submit them, never redirect them, and each one pays once.
Punish an honest team.
[d]Announced upgrades are defended automatically, and a false reporter’s bond goes to whoever defended.