Clean history: check a Satchel's signatures before you buy

The problem: a signature outlives the sale

A Satchel is an NFT on NEAR that controls its own Bitcoin, Ethereum and Solana addresses. Its owner asks the contract to sign a transaction, and NEAR's signer network makes the signature.

A signature is only bytes. Whoever holds it can broadcast it later. Say a seller signs a transaction that sends every coin to their own address, keeps it, and lists the Satchel for sale. The buyer pays. The seller then broadcasts the old transaction, and the coins are gone.

The NFT changed hands correctly, and the coins left anyway. Clean history exists to rule that out before the buyer pays.

What the contract writes down

Before NEAR's signer network signs anything, the Satchel contract records exactly what it is about to sign. That is the Ethereum network and nonce, the Bitcoin coin being spent, the Solana blockhash, or the full text of a message.

It signs only plain ETH and USDC transfers, standard Bitcoin spends, plain SOL transfers and plain-text messages. It refuses raw hashes and every other kind of request. A request that timed out stays on the record too, because a timed-out request can still produce a valid signature.

Together these records are the Satchel's history. You can read them on the Activity tab of any Satchel.

How the buyer's browser checks each signature

The browser reads every record and asks one question on the chain it belongs to: can this signature still move the coins?

The browser also checks that the Ethereum address has no delegated code and that the Solana account is a plain wallet. Each record gets a status such as Used, Expired, Unused or Can't verify.

Buy turns on only when no old signature can move the coins. The check runs again right before the purchase.

The quiet period

A Satchel can be listed for sale only after 250 blocks, about 2 min 20 s, with no new signature. This is the quiet period. It makes sure the history a buyer reads is not still changing.

While a Satchel is for sale it is paused: it can't sign, and only a purchase or an accepted offer can move it. So the history stays fixed while the buyer checks it.

There is no wait after listing. Anyone can buy a listed Satchel right away.

Who runs the check

The buyer's browser runs the check, not the contract. A NEAR contract can't see Bitcoin, Ethereum or Solana, so it can't enforce the result. The Buy button stays off until the browser's own check passes.

The sale page also shows the server's check as a hint, labelled as the server's. It is there for readers without JavaScript. Only the browser's result turns Buy on.

Gifts skip this check. Giving a Satchel doesn't wait for it, so give only to someone you trust.

What clean history does not cover

Clean history is a check on past signatures. It is not a guarantee, and Satchel is new and hasn't been audited.

• Signatures made after you buy. Those are yours to control.
• Tokens other than USDC, and any chain or address Satchel doesn't support.
• NEAR's signer network. You still trust it, and enough colluding nodes could sign anything.
• Bitcoin reorgs. A deep enough reorg could undo a spend the check counted as confirmed.
• Data providers. For Bitcoin and Ethereum two must agree, and the page says when only one answered.

See it on a Satchel

Open the sale page of a listed Satchel from the Market. The record lists each signature with its status, and two panels explain how Satchel checks it and what it doesn't cover.

Satchel #4 is the demo built to fail. Its only record is an Ethereum transaction signed with a future nonce and never sent. It could still move the coins one day, so it stays Unused and Buy stays off.

For more, read the questions and the contract facts.

Questions and answers