undo.finance
The recoverable stablecoin

Money with an undo button

Wrap USDC into gUSD on Base. If your wallet is drained, the drain freezes within a block and recovery is arbitrated, timelocked, and public.

Try the demo →How it works
Deployed on BaseTESTNET Base mainnetSOON

Every stage on-chain, in the open.

BLOCK #23,681,009WATCHING · gUSDACTIVE FREEZES · 0TOTAL WRAPPED · 4,832 gUSDLAST RECOVERY · 6 H AGOTIMELOCK · 14 DAYSWATCHTOWER · UPCHAIN · BASE-SEPOLIABLOCK #23,681,009WATCHING · gUSDACTIVE FREEZES · 0TOTAL WRAPPED · 4,832 gUSDLAST RECOVERY · 6 H AGOTIMELOCK · 14 DAYSWATCHTOWER · UPCHAIN · BASE-SEPOLIABLOCK #23,681,009WATCHING · gUSDACTIVE FREEZES · 0TOTAL WRAPPED · 4,832 gUSDLAST RECOVERY · 6 H AGOTIMELOCK · 14 DAYSWATCHTOWER · UPCHAIN · BASE-SEPOLIABLOCK #23,681,009WATCHING · gUSDACTIVE FREEZES · 0TOTAL WRAPPED · 4,832 gUSDLAST RECOVERY · 6 H AGOTIMELOCK · 14 DAYSWATCHTOWER · UPCHAIN · BASE-SEPOLIA
How it works

Protection that runs in the background

No new habits. No new key rituals. You use gUSD like any other stablecoin. The rest happens on-chain, quietly.

01

Wrap USDC into gUSD

1:1 exchange. Your USDC sits in a vault; you get gUSD, a B20 native token on Base with recovery primitives built into its policy layer.

02

We watch every transfer

An always-on watchtower runs Tier-1 heuristics on every gUSD transfer. Ambiguous cases escalate to a Tier-2 model. Fail-closed.

03

Drains freeze. You recover.

If a drain fires, the destination is frozen within a block. File a dual-signature claim from a fresh wallet. Arbitration + a 14-day timelock returns the funds.

Every stage lands
on-chain.

The safety layers

Every guarantee, enforced on-chain

No off-chain promises. Each primitive is a discrete contract with a public interface and a bounded surface of authority.

72 H
auto-expiry

Freeze-only watchtower

The sentinel's only power is adding an address to a blocklist. It cannot mint, burn, seize, or pause.

2 KEYS
required

Dual-signature claim

Recovery needs a signature from the drained wallet AND a fresh payout wallet. A thief cannot redirect.

14 D
counter-claim window

14-day timelock

Verdicts don't execute for 14 days. Contested claims are heard on-chain before any burn or mint runs.

1 : 1
USDC backing

Vault invariant

AegisVault holds 1 USDC per gUSD. Proved across 51,200 stateful fuzz calls with zero reverts.

The replay

A drain, played forward

Six scenes. Two wallets. One dual-signature claim. Watch each account's state change as the recovery unfolds.

HOW UNDO WORKS·INCIDENT · JULI-A17
ILLUSTRATIVE SCENARIO ON TESTNET
Juli · 0x8a4…e21f
primary wallet
4,800gUSD
POSSESSION SIGDESTINATION SIG
CLAIM · IDLE
DAY 0DAY 14
counterpartyDrainer · 0xd3ad…beef
0gUSD
T + 0s
Juli holds gUSD. Wrapped, protected, ordinary.

Recovery, finally in your favor

Every year, billions leave wallets that were compromised for reasons that had nothing to do with intent. Undo turns irreversible into optional.

73/73
Foundry tests
51,200
Invariant calls
< 1 block
Freeze latency
14 days
Recovery timelock

Nothing about your safety is proprietary.

Security

Your funds. Your keys. Always.

Undo is non-custodial by design. We route the wrap; we cannot move your money.

Non-custodial by design

Your gUSD lives in your own wallet. The vault holds USDC 1:1 but cannot spend it.

No god contract

Four discrete contracts. No single account holds both freeze and mint authority.

Recovery is arbitrated

An independent panel signs on-chain verdicts. Rules encoded, not vibes.

Unwrap any time

Redeem gUSD back to USDC whenever you're not frozen. No penalties, no lockups.

FAQ

Questions, answered

  • The watchtower can only freeze. It cannot seize, mint, burn, or move your funds. Freezes are rate-limited and auto-expire in 72 hours. If a freeze is wrong, you appeal through the same on-chain arbitration path used for recovery.

Your recovery starts with one wrap

Free on testnet. Try the whole flow with test USDC.

Try the demo ↗Wrap USDC