The dead man's switch is a small program running on Solana. It holds a handful of facts about you and enforces one rule: an heir may only take over after a provable, uninterrupted silence.
What the program stores
Your inheritance account, on-chain and public
- Owner
- Your wallet address
- Heir
- The single address you nominated
- Heir confirmed
- Whether they have accepted the role
- Last heartbeat
- Timestamp of your most recent activity
- Inactivity timer
- How long silence must last before a claim
- Challenge window
- How long after a claim before it can finalize
- Claim status
- None, challenge active, or finalized
All of it is public. Anyone can read it, including your heir — which is the point. They can verify their position without asking anyone's permission, and without you having to be trusted to tell the truth.
Nothing secret is on-chain. The vault's keys are not there; the chain holds only the condition under which they may be reassembled.
The four states
Alive. The normal state. Your last heartbeat is recent, no claim exists. The heir can see the configuration and can do nothing with it.
Lapsed. Your last heartbeat is older than the inactivity timer. Nothing has happened yet — the state simply means a claim has become possible. Opening the app here still resets everything.
Challenge active. Your heir has opened a claim. A countdown is running. Any activity by you cancels the claim outright and restarts the full inactivity timer.
Finalized. The window closed without you. The heir can now withdraw the deposited assets and the Legacy Vault becomes readable to them.
Who can do what
| Action | Who | When |
|---|---|---|
| Set up, change heir, change timers | Owner | Any time before finalization |
| Deposit assets | Owner | Any time before finalization |
| Heartbeat | Owner | Any time |
| Accept the heir role | Heir | Once, at any point before a claim |
| Start a claim | Heir | Only after the inactivity timer has elapsed |
| Cancel a claim | Owner | During the challenge window |
| Finalize a claim | Heir | Only after the challenge window closes |
| Withdraw the estate | Heir | Only after finalization |
Every one of those is checked by the program on every attempt. There is no path that skips a check, because there is no privileged caller — not the heir, not you, not us.
Two things that make accidents very hard
Your heir must accept first. An heir who has never signed a confirmation cannot start a claim at all, no matter how long you are silent. A mistyped address therefore locks the estate rather than losing it to a stranger. See choosing your heir.
Any activity cancels a live claim. Not a special "I'm alive" button — any owner action. Opening the app, sending a transaction, changing a setting. The program treats all of them as proof of life and clears the claim.
What a false trigger would actually require
Missing both warnings, then missing the entire challenge window, having not opened the app once for over a year. Every stage is designed so that a single moment of attention undoes the whole thing.
Where time comes from
From Solana's own clock, read by the program at the moment each instruction runs. Not from our servers, not from your phone. Neither we nor a compromised device can make the timer appear to have run out sooner than it has.
Read what enforces inheritance for the trust model in full, including the parts that are not yet on-chain.