How branch limit orders work

TL;DR — buy branches at a price you set, automatically, trustlessly and permissionlessly, without monitoring the auction yourself. It uses MetaMask's Delegation Frameworkdocs.metamask.io ↗: pre-signed permissions that can only be used when the conditions you set are met — the price must be at or below your target, and inside your deadline.

What is a branch limit order?

New branches are sold at auction twice a day. The price starts high and then falls along a curve until someone buys. To buy one yourself, you have to watch the auction and buy at the moment the price suits you.

A branch limit order lets you buy at a price you choose, automatically and permissionlessly. You set the most you'll pay and a deadline, and if an auction gets there, the branch is bought for you, automatically.

Charters are soulbound, so they can't be moved to another wallet, and the auction only sells to the Charter's owner.

At banker.tools, you sign a permission for one specific purchase, containing four parameters:

• Which Charter the branch is for
• Number of licences
• At or below x price
• Deadline, after which the order cannot be executed and expires

We hold that permission and submit it when all criteria are met. Nothing leaves your wallet until a transaction is approved. Your account is still the buyer, banker.tools cannot modify the order — it is already signed and sealed — and your private key never leaves your wallet.

This is the only way to buy branches trustlessly, without handing someone your private key, which you should never do.

What an order cannot do

The question worth asking isn't whether we're honest. It's what we could do if we weren't — if our key got stolen tonight, or if we decided to take everything. Here's the answer. Each line is blocked by a contract, and the right-hand column is the error you'd get back if we tried.

So the only thing your order lets us do is buy the branch you asked for, for the Charter you named, at or below your price, once, before your deadline. That's the whole of it. Even if we turned out to be crooked, or got hacked, we still couldn't do more than that with what you signed.

Nothing of yours is ever in our hands

Most disasters in crypto happen because a service was holding people's money when it decided not to give it back. We never hold anything, so there's nothing for us to run off with.

• You never deposit anything. There's no vault or pool, and you have no balance with us. Your STANDARD stays in your Charter until the auction takes it, in exchange for the branch.
• Your Charter never moves. Your address holds it before, during and after. We couldn't move it if we wanted to.
• We haven't written any contracts. Nothing of ours sits between you and your money. That means there 's no admin key, no upgrade switch, no pause button and no treasury — the things a rug pull normally needs.
• If we disappear, you lose nothing. Your order expires on its own and your Charter stays where it always was. There's nothing of yours to get stuck anywhere.

What you actually sign

Two messages. They're not transactions, so they cost no gas and send nothing. Nothing appears on chain until a branch is actually bought. Your wallet shows you both messages before you sign.

1. The purchase. A single call to the auction, with your Charter number, how many licences, and your maximum price written into it. It's one exact call, not a range or a general permission.
2. The fee. Permission to take 0.01 ETH (roughly $27), and only at the same moment as that purchase.

An order can cover up to 3 licences, which is the auction's own limit for one Charter, and can run for up to 30 days.

What the account switch does to your Charter

Nothing at all. This is the step people worry about most, and they're right to check it, so here it is. An ordinary account can't hold a rule, so before your address can hold your order it has to become what MetaMask calls a smart account. It's a setting on your own account. Nothing is transferred.

• Your address stays the same, so the auction still sees the Charter as yours.
• No STANDARD is sent, nothing is approved, and your pending balance isn't touched.
• Your recovery phrase still controls the account. MetaMask say plainly that it's still an ordinary account underneath.
• The switch gives us nothing. It gives your account a new ability; it doesn't give anyone permission to use it.
• You can switch back whenever you want, from the same menu.

Your wallet will show you the switch, and then a transaction sending 0 ETH from your address to your own address. The switch can't be sent on its own, so it has to travel with a transaction, and we use the emptiest one there is. You might have nothing to do at all — new MetaMask accounts are already set up this way.

Who enforces your order

MetaMask's contracts do, not us. They're MetaMask's code, deployed by MetaMask, and we use them unchanged. Cyfrin and Consensys Diligence have audited them and published their reports next to the source. Every refusal in the table above is one of those contracts, and each one is a short file you can read.

We haven't written any contracts. All we run is a program that watches the price and submits your order when it's met, and that program gets the same refusals anyone else would.

How to check all of this yourself

• Read the permission before you sign. Your wallet shows you the whole thing, including the Charter number and your maximum price.
• Read the contracts. Every address is listed under contracts, and the ones doing the enforcing are open source: read them heregithub.com ↗.
• Read the audits. Published in the same repository: delegation-framework/auditsgithub.com ↗.
• Watch it get refused. We run a test against the live contracts that tries each of these in turn and checks that every one is blocked. It's described under security.

Two things we won't claim. This site's own code isn't public at the moment. And while every contract that enforces your order has been audited, nobody independent has audited the way we've put them together. Neither of those lets us take your Charter — that's what the list above is about — but you should know both before you decide.

What an order costs

The fee is 0.01 ETH per order (roughly $27), and you only pay it if the order actually buys a branch. We cover the gas, including on attempts that fail. There's no subscription and no percentage.

A MetaMask contract takes the fee, not us. It happens inside the same transaction that buys the branch, and the contract checks the money arrived — if it didn't, the branch purchase is cancelled too. So you can't be charged without getting the branch, and we can't take the branch without paying ourselves the fee.

The branch itself is separate, and it isn't paid in ETH. It comes out of your Charter's pending balance in Standard Reserve, at whatever price the auction is charging — which will be at or below your limit, because the auction won't sell above it.

Who pays for the gas

Can banker.tools change your order?

No. Nothing about it can be changed — not the price, not the Charter, not the number of licences, and not the fee. You sign an order, we hold it, and when an auction reaches your price we submit it exactly as you signed it. If we altered any part of it, the contracts would refuse the whole thing.

That covers the fee too. If we put our price up, the new price only applies to orders signed after the change. An order you set today will be charged 0.01 ETH whatever we do afterwards.

If the purchase fails — the auction sold out first, or your Charter can't cover the price — then nothing happens. You pay nothing, we pay the gas for the failed attempt, and your order stays standing until it expires.

Can you cancel your order?

Yes, at any time, from your own wallet. Only you can cancel it — we can't, and nobody else can either. It costs one transaction's gas and nothing else. There's no fee for cancelling.

You can also leave it alone and let it expire. The deadline is part of the order, so it stops working on its own whether we're still here or not. Switching your account back to an ordinary one stops every order at once.

To change an order you replace it, because a signed permission can't be edited. That's also what makes it safe to leave one standing. The order desk handles both steps for you: you sign the new order, then send one transaction to cancel the old one.

Everything that can go wrong

Next: what we could do if we were dishonest