Security

HourGlass moves real ERC-20 value under delegated authority. This page states plainly what the protocol guarantees and what it does not.

On-chain enforcement is the only guarantee

Every charge is bounded by a caveat evaluated on-chain by the Delegation Framework. HourGlass deploys no custom enforcer — the caveats are MetaMask's audited contracts. There is no backend that can be bypassed to over-charge: if a redemption would exceed the signed bound, the transaction reverts.

A caveat is a cap, not a meter. It bounds the maximum the receiver can pull; it does not verify off-chain facts like "how many charges were due." Within the cap, the receiver decides when to draw.

Subscriptions: per-period cap

For a subscription the bound is erc20PeriodTransfer: at most periodAmount per periodDuration, resetting each period. Worst case within the signed terms, the receiver pulls the full periodAmount every period until revoked. Set periodAmount no higher than the real obligation.

Streams: rate cap, and the unbounded maxAmount

For a stream the bound is erc20Streaming: the amount available is initialAmount + amountPerSecond × elapsed, clamped by maxAmount.

HourGlass neutralizes maxAmount to the maximum uint256, so there is no total lifetime ceiling. The protections that remain are:

• The rate. The receiver can never claim faster than amountPerSecond allows, regardless of how long the stream runs.
• Revocation. The payer can disableDelegation at any time; after that no further claim succeeds. With no total cap, revoke is the off-ramp that bounds exposure — the practical maximum loss is amountPerSecond × (time until the payer revokes).

Set the rate to the real obligation and treat the funded balance in the Safe as the true exposure, since the caveat ceiling is intentionally not binding.

Agent mandates: bounded action, not bounded outcome

An Agent DeFi mandate delegates a market action to an agent, which changes what the caveats can promise.

Enforced on-chain. The call surface (which contract, which method), the exact calldata where it is knowable, the maximum spend, the minimum received, who may redeem, how many times, and for how long. A buggy, offline, or compromised agent cannot overspend, call another contract, redeem twice, or move funds out of the Safe. Actions run as the Safe and the proceeds return to the Safe.

Not enforced. That the strategy is profitable, or that the agent acts on time — or at all. The chain guarantees no cadence. A mandate bounds operational risk; market risk and agent punctuality stay with you.

Two specific limits worth reading before signing:

• The compound mandate is not pinned to a single position and does not cap the amounts it reinvests. It cannot withdraw principal — decreaseLiquidity and burn are out of scope — but it is a broader authority than the deposit plan.
• The hosted agent means HourGlass holds the agent's key. Your treasury stays bounded by the caveats, but the agent wallet itself is not protected — fund it for one redeem and no more. Run the agent yourself if you need the non-custodial property end to end.

Aqua is bounded by an allowance, not a caveat

The Aqua rail is not a delegation. There is no caveat and nothing to disableDelegation; a shipped strategy is backed by a standing ERC-20 allowance from the Safe, and any taker may swap against it. That allowance is shared across every strategy the Safe has shipped over that token, and the app leaves 10× headroom by default so the strategy keeps filling. Treat the allowance as the exposure, and dock a strategy to release its share.

Non-custodial

Funds never leave the payer's Safe until a charge executes, and a charge can only move tokens within the caveat's bound. HourGlass holds no keys to the payer's funds. The one exception is the hosted agent, which holds a gas-only key — see above.

Discovery adds no trust

HourGlass publishes each signed delegation to the Intuition graph so it can be discovered. That publisher is an indexer, not a trusted party:

• It holds no keys to your funds — non-custodial, as above.
• It cannot forge or alter a delegation; only the payer's EIP-712 signature, checked on-chain, makes one valid.
• It cannot block a charge — a receiver can always import the signed delegation and redeem on-chain without it.

If the publisher or Intuition is unavailable, both sides keep using HourGlass; only auto-discovery is lost. The source of truth is the signature and the DelegationManager, never the index.

Signatures and replay

Each agreement is a single EIP-712 delegation. Replay protection comes from the EIP-712 domain (chain id + the DelegationManager as verifying contract) and the delegation salt = keccak256(terms). The salt binds the signature to the exact IPFS-pinned agreement; a signature is never valid across chains or across different terms.

Self-deployed enforcer instances

For analytics, HourGlass routes delegations to its own deployed instances of MetaMask's audited enforcers (unmodified bytecode, new address). This changes the emitter address of the caveat events but not the security logic. The integrity requirement: any such instance must be byte-identical to the audited release, and the deployed address is part of the signed caveat — so the signature covers it and it cannot be swapped after signing.

The full enforcer suite — 37 instances — is deployed on Ethereum mainnet and Base under the CREATE2 salt bytes32("OURGLASS"), each with verified source on Etherscan and Basescan. Because the address derives from the salt and the bytecode alone, a given enforcer sits at the same address on both chains. Ten of them carry the caveats HourGlass delegations actually use today — three for the payment rails, the rest for the Agent DeFi mandates — and the remainder exist so a future delegation shape needs no new deployment. Every address is listed in Deployments, along with how to recompute it and check the bytecode yourself.

Deploying an enforcer grants HourGlass no authority: enforcers hold no funds, are not whitelisted by the DelegationManager, and cannot be upgraded. A malicious instance would be a different address, and therefore a different signature — one you never signed.