Standards

What a careful setup looks like. No law requires this. It is the minimum we hold every project to, published so anyone can hold us to it too.

Under $100,000 held

A waiting period of at least 24 hours before any change lands.

$100,000 to $1 million

48 hours, and a group of at least 2 of 3 signers.

Over $1 million

72 hours or more, and at least 3 of 5 signers.

Code that cannot be changed and holds no admin powers

Needs none of this.

Where this comes from

Security groups publish checklists for smart contracts: the EEA EthTrust Security Levels, the OWASP Smart Contract Top 10, the Smart Contract Security Verification Standard, and the Rekt Test's twelve questions. All of them ask about key control and upgrades. None of them set a waiting period in hours. This page does, so the risk word on a card has a stated bar behind it.

The rule itself

Start at Moderate. One wallet in control: up two. No waiting period: up two. Under 24 hours: up one. One wallet can pause: up one. Over $1 million held: up one. A group of at least 3 of 5: down one. 72 hours or more: down one. Code that cannot change and holds no admin power: Lowest, whatever the signer count. Nothing held today: Lower at most. The rule is a file with a published hash and a dated history.