The Vault Protocol
Pay Money settles on a general-purpose privacy vault rather than a bespoke escrow contract. The vault enforces structure and knows nothing about value; what a token means, and what conserving it requires, belongs to the kind that defines it. These pages document that design.
Everything in this section is a published design, not running software. Where a page describes a mechanism it describes what the protocol specifies, and where something is unbuilt or uncertain it says so rather than leaving the reader to assume.
- Resources, Kinds and the Completeness Invariant
Why the proof layer refuses to know what a balance is, and what it checks instead.
- Accounts, Multisig and Social Recovery
An account is an authority policy, not a credential: single key, m-of-n threshold, or guardian recovery — all three curve-free.
- What Is Post-Quantum Here, and What Is Not
The vault layer is curve-free. Two elliptic-curve dependencies remain — the bank attestation and the mailbox — and both are named rather than glossed.
Frequently Asked Questions
Why does the protocol not check that balances add up?
Because it cannot know what a balance is. The proof layer enforces structure — nothing duplicated, nothing silently dropped, and every kind shown every one of its own resources — and each kind enforces its own conservation rule on top. That is the split Ethereum already makes: the EVM guarantees one contract cannot write another's storage, and each contract guarantees its own supply invariant.
What is a kind?
A kind is to this vault what a contract is to Ethereum. It defines a value type together with the rule that value obeys when it moves. A fungible token, a non-fungible one, an offer and an account are all kinds; they differ in their conservation circuit, not in the machinery underneath.
Are any assets built into the protocol?
No. There is no genesis-blessed asset list. A kind's identity is a hash of its own logic, so anyone can define one — which makes canonical identity a social fact, published as a kind list, in the same way that "real" USDC is a social fact rather than something Ethereum enforces.
Can the deployed contract be upgraded or paused?
No. It has three functions and no admin, pause or upgrade key. That forecloses the largest class of exploit in bridge and vault history, a compromised administrator — and it equally means nothing can be reversed by anyone, including us. A new version is a new deployment, not a migration.
Who settles batches, and what stops them censoring a trade?
An aggregator, chosen per epoch from a bonded set by a hash-based verifiable random function, so the role rotates without a trusted randomness beacon and without elliptic curves. A settlement nobody will include can be forced through by an on-chain deadline any participant can trigger, so liveness does not rest on the aggregator's goodwill.