What your signature authorizes
Your Bitcoin signature commits to a specific transaction: the BTC it spends, the amounts it pays and the destinations it uses. An operator cannot turn that approval into a different payout later.
This lets you authorize a loan’s permitted outcomes in advance while retaining a separate signature for changes you initiate yourself.
Approve the outcomes, keep the key
| Authorization | What it permits |
|---|---|
| Liquidation coverage | Fixed settlements under the agreed price and debt conditions, including protection for the remaining vault. |
| Release and lapse | Separate ways to close an eligible position, accounting for whether debt remains. |
| Partial withdrawal | The chosen payout and the new vault that continues backing the loan. |
| Payout returns and vault vetoes | Fixed protective transactions that guardians can complete under their required conditions. |
The package of pre-authorized transactions is called a chequebook. A wallet may group their review, but each signature still has its own purpose. The demo’s two liquidation-grid signatures are separate from the other lifecycle approvals.
Your private key and secret signing nonces stay inside your signer. They are never supplied to the webpage or protocol backend.
Veto approvals
What you sign: three veto transactions for this Bitcoin deposit, in one wallet prompt with a supported batching wallet. Other wallets request the same approvals separately.
What they do: let the guardians block an unauthorized vault spend through fixed protective transactions that return the BTC to a vault controlled by your key.
What they do not do: share your Bitcoin key, move your BTC when you sign, or give anyone unrestricted spending authority. Guardians can only complete these specific transactions under their committed conditions.
Nothing is broadcast and no network fee is paid at this signing step. You only sign; the approvals are available if guardian intervention is needed later.
Diagram text
flowchart TD
V["Your Bitcoin vault"] --> Q["Pre-authorized settlement plus matching event authorization"]
V --> W["New withdrawal approved by you and the protocol"]
V --> E["Customer recovery after the Bitcoin timelock"]
V --> R["Pre-authorized protective re-vault completed by guardians"]A conditional signature stays conditional
Each cheque binds your approval to both a transaction and its oracle event. Protocol participants prepare their contribution through threshold signing. The matching oracle authorization completes the cheque; the protocol’s ordinary signing key cannot replace that event condition.
That is why a covered liquidation can proceed while you are offline, but the executor cannot select new amounts or recipients. It must use an outcome you already authorized.
Your signature fixes the permitted transaction. Independent guardians check whether its settlement is justified and can reverse an invalid protected payout through its pre-authorized return. Customer authorization and guardian enforcement provide complementary protections.
Changing the loan can require new approval
A partial withdrawal creates a new remainder vault. You approve the withdrawal and the replacement transactions needed to protect that exact remainder before the protocol completes the spend.
Repayment itself is an Ethereum action. It reduces debt without a new Bitcoin signature first. Changes beyond the currently covered terms can require fresh coverage, as explained in Keeping coverage current.
Recovery and protective returns
Recovery approvals cover repayment and the expiry of the loan’s approvals. An expiry settlement accounts for any outstanding debt before returning the remaining BTC.
An eligible unspent vault has a customer-only escape after its Bitcoin timelock. Guardians cannot substitute their own signature for yours on that path.
A vault veto instead uses a customer-pre-signed re-vault transaction together with the council threshold and a delay. The fixed return destination is protected by your signature. Its limited template inventory does not give the council unlimited authority to move or re-lock collateral.
These are different from a payout’s protected settlement process. Recovery explains which path applies to the output holding your BTC.
Review what is fixed
Production signing must make the transaction, recipients, fees, remaining collateral and recovery terms independently reviewable. Confirm the supported wallet and signing mode for your deployment; the supervised demo has a disclosed transaction-review concession and PSBT signing inputs.
Construction changes apply to newly created outputs. They cannot rewrite a signature or the script already locking an existing vault. Integrators can use Verify your position for the construction and transaction checks behind this review.