Account + controller
The intent is tied to one smart-account address and one controller H160.
SECURITY MODEL
Trust less.
Sign exactly.
TWIX treats wallet interoperability as an authorization problem. Signed bytes, domain separation, nonce lanes, generation boundaries and explicit policies matter more than UI convenience.
SIGNED BOUNDARIES
What the relayer cannot change.
For controller execution, security-sensitive intent fields are part of the MetaMask-signed canonical message.
Action + value
Recipient, denomination and amount are signed rather than supplied by the relayer later.
Relay economics
Relay fee and optional exact relayer are included in authorization boundaries.
Replay domain
Chain ID, namespace, generation, nonce and expiry prevent cross-context reuse.
Spend accounting
Native action funds and relay fees are aggregated before policy evaluation.
Generic Wasm sessions blocked
Session keys cannot use generic Wasm in v0.2 because native spend meters cannot reason about arbitrary contract-internal value.
CUSTODY BOUNDARY
The factory cannot migrate your account.
Individual Code-719 Meta Accounts are instantiated with no Wasm admin. The factory manages future templates, not upgrade authority over existing accounts.
Factory lifecycle authority is deliberately separated from existing account custody.That choice also means a deployed account cannot be patched through ordinary Wasm migration if a bug is later found. Experimental accounts should therefore hold only disposable test value.
RECOVERY MODEL
Recovery is intentionally expensive in signatures and time.
When configured, guardian recovery requires both authorization by the guardian and acceptance by the new controller, followed by the enforced delay before permissionless execution.
Guardiansign recovery schedule
+
New controllersign acceptance
→
Delay14,400 blocks minimum
OPEN REVIEW
Security claims should be attacked.
The full source and observed mainnet test matrix are published for peer review. Pending cases stay labeled pending until they are actually observed.