Commit
The owner commits a padded set of one-use permissions. The unused supplier list stays off-chain.
STRK20 Confidential delegated procurement
VOW
Let an agent approve a purchase. Never let it redirect the money.
VOW gives an operator constrained authority to reserve an owner-approved purchase while the contract keeps custody and binds collection to the intended supplier, token, cap, and destination note.
Evidence before claims. Vault 0x641ca5237870312273ed2cd693372ee49e103d5c585af6185324f3662e15227, class 0x3c85f692be0a2280bc85fc9802019121a8b52ef4de0db9273c3806f7355ce14, is deployed by 0x3f3cc7727c66634967621dc8d4697f1bfd6c29f81757496a4783bf5c90deb89 and bound to pool 0x40337b1af3c663e86e333bab5a4b28da8d4652a15a69beee2b677776ffe812a. One 0.1 STRK reservation is open with zero paid; no collection is claimed and 0 of 5 release gates pass.
A purchase path with no redirect field.
Authority narrows at every step. Each participant receives only the capability needed for its role.
Reserve
The operator selects an already-approved permission. It cannot replace the supplier, token, cap, or deadline.
Authorize
The supplier signs the exact collection terms with a local claim key that never leaves its browser.
Collect
The contract releases the reserved amount only through the pinned STRK20 pool and exact destination-bound note.
Separation you can inspect.
The contract owns the escrow. The operator never receives custody, and the supplier signs only the collection it expects.
Owner
Commits the permission set, funds the mandate, and retains recovery authority.
Operator
May reserve a committed purchase. Holds neither the funds nor a general spending key.
Supplier
Authorizes one exact collection into its signed STRK20 note.
Public verifier
Checks the receipt, events, pool deposit, state, and token-pull trace without a wallet.
Privacy boundary Commit the set, reveal the selected purchase
Unused permissions do not become a public procurement plan.
The chain receives a commitment root. A selected permission becomes public when used, while unused supplier permissions remain in the owner’s encrypted local backup.
Read the privacy boundarypadded permission slots in the local VowVault model
use per permission, with expiry that never rearms it
separate accounting totals: funded, available, reserved, paid, reclaimed
generic calls, upgrade paths, or admin sweeps
Release truth
The interface says exactly what the evidence proves.
Verified on mainnet VowVault class and deployment, plus one controlled 0.1 STRK funded reservation that remains open with zero paid.
Tested locally Contract invariants, encodings, reviews, journals, and receipt checks.
Still pending Supplier collection, note-credit proof, and all five release gates. Deployment and reservation alone pass none.