How Backsies works
Every outgoing transfer waits in the Backsies vault for a short window. Until it ends, you can take it back, and the funds go to a safe address you registered in advance.
Three ways in, one vault
All three entry points meet in the same vault, and the vault’s code never changes. The Undo RPC runs off-chain and never touches the vault.
| Layer | How it works | Setup | When |
|---|---|---|---|
| Undo RPC | Add the Backsies RPC URL to your wallet. Signed transactions are held before they’re broadcast. | 1 minute | Phase 1 |
| Backsies Account | With EIP-7702 your existing address behaves like a smart account. Vault Mode opens an ERC-4337 account. | 2 minutes | Phase 2 |
| bUSDG | Deposit USDG, get bUSDG. Every transfer enters the window, in any wallet. | No setup | Phase 3 |
Every transfer ends one of two ways
A queued transfer is released when its window ends, or cancelled before then by you or a guardian. Released and cancelled are final. Release is permissionless: the Backsies keeper triggers it, and if the keeper ever stops, the recipient can trigger it themselves.
- Queued
- Amount
- 5.00 ETH
- Window
- 5 min
- Status
- QUEUED
You can still take it back - Released
- Amount
- 5.00 ETH
- To
- Recipient
- Status
- RELEASED
Time is up. Anyone can trigger it. - Cancelled
- Amount
- 5.00 ETH
- To
- Safe address
- Status
- CANCELLED
You or a guardian cancelled
Your safe address
Cancelled funds never go back to the sending address. They go to a safe address you registered in advance: a cold wallet or a second wallet. If you haven’t set one, transfers aren’t queued at all.
Changing the safe address takes 48 hours, and your current safe address can abort the change. So even if someone steals your key and presses cancel, the funds still land somewhere they can’t reach.
The window fits the risk
The waiting time comes from the transfer itself. 0 minutes to an address on your allowlist. 5 minutes for a small amount to a new address. 24 hours for a large amount to a suspicious contract. Never more than 72 hours. Spending approvals to unknown contracts enter the window too.
The recipient can’t shorten it
If a recipient could pay to receive early, a drainer would always pay. Only two things skip the window:
- Express approval. You approve with a second factor (a passkey, a guardian or a hardware wallet) and pay a small fee.
- Verified recipients. Exchanges and merchants join the Backsies registry with a stake; transfers to them go through instantly.
What it can’t do (yet)
The Undo RPC and 7702 mode protect you from bad transactions you sign yourself. Full protection against a stolen key only comes with Vault Mode, the ERC-4337 smart account planned for Phase 2.
| Threat | Undo RPC now | Vault Mode Phase 2 |
|---|---|---|
| Transfer signed on a phishing site | Stops | Stops |
| Malicious approval | Stops | Stops |
| Off-chain permit signature (EIP-2612, Permit2) | Warns | Stops |
| Wrong address or amount | Stops | Stops |
| Seed phrase theft | Can’t stop | Stops |
| Backsies server goes down | Transactions wait | Unaffected |
Known limits
- Someone with your key can broadcast through a different RPC. For a cancelled transfer, the app suggests a zero-value self-transfer with the same nonce, which voids the signed one.
- Permit signatures never pass through a contract. The Undo RPC scans them and warns you, but can’t block them.
- In 7702 mode, a stolen key can point your account at a different contract and switch the protection off. Vault Mode is the answer for serious balances.
- A sender could cancel after receiving goods. Merchants can register as verified recipients, or accept payment once the window ends.