Card authorization

Each card carries a secure chip that holds its key; some cards generate it on the chip. Two card types are supported: one protected by a PIN, one without a PIN.

LIMITATION

Cards without a PIN work like cash: whoever finds one can spend what is on its own wallet.

Only ChimpDAO's admin can register a card, with one call to the card registry (mint). The call needs two signatures: the admin's, and an attestation from the card's chip over this exact call (the registry, the function, the card's public key and the terms it is registered under, with an optional token URI) and a per-card nonce. This proves the physical card was present.

In that one call the registry creates the card's token, deploys the card's own wallet and makes that wallet the token's permanent owner. The token has no transfer function: it never leaves the card's wallet. A card that is not registered is refused by the app.

The owner taps the card and chooses a PIN (on cards that have one). Before anything is paid, the app has the card sign a random challenge and checks the signature on the phone (proof of possession). Then two transactions follow, both paid by ChimpDAO: the Main account is deployed with this card as its founding card (no card signature needed), and the card signs set_owner, which points its own wallet at that account.

A second card joins an account in two taps: the new card points its own wallet at the account (set_owner), then a card already on the account approves add_card. Any card of the account can authorise any payment from the Main account (one of n).

A card is removed from its account with remove_card, approved by any card of that account, including the card that leaves. A lost card is removed by another card of the same account. The contract refuses to remove the last card: an account with no card could never authorise anything again.

A removed card keeps its own wallet and what is on it: that wallet only obeys its card. ChimpDAO's admin can also take back a card's token (clawback), a central escape hatch of the registry.

A card with a PIN locks itself after three wrong PINs, like a bank card. The lock is in the chip, so signing never has to ask a central registry for permission, and ChimpDAO has no switch that freezes a card.

A card without a PIN has no lock. Until another card removes it, a lost card stays a valid signer of its Main account.

An opt-in lock at network level, chosen by the cardholder, is being considered. It does not exist today.

The contract tests run with a software chip. What they check, and what they do not check yet: