Staged Commitments Sharing

Staged Commitments Sharing

This describes how to share staged commitments (off-chain drafts) so two parties can review and share a commitment before anything is written on-chain.

Why staged?

• Zero on-chain cost to draft and share.
• Clean Twitter/OG previews without relying on client-side JS.
• Prefills the Create form for fast conversion.

URL format

A staged share link uses a single query param:

https://lockitin.xyz/?stage=<base64url(deflate(JSON))>

The payload is JSON, optionally deflate-compressed client-side. If compression is not available, the payload is base64url of the plain JSON string.

Payload schema (v1)

Short keys keep links small:

{
  "v": 1,
  "s": "Statement text...",
  "a": "10000000",
  "b": "10000000",
  "ra": 1767139200,
  "ta": "0x0000000000000000000000000000000000000000",
  "c": "0xCreatorAddress",
  "tag": "0x...bytes32",
  "exp": 1767744000,
  "ts": 1767130000,
  "sig": "0x..."
}

Fields:

• v: schema version (1)
• s: statement text
• a, b: amounts in USDC base units (6 decimals)
• ra: resolveAfter Unix timestamp (seconds)
• ta: target acceptor (optional; zero address for public)
• c: creator wallet (optional; used for verification display)
• tag: optional bytes32 tag
• exp: expiry timestamp (optional)
• ts: created timestamp (optional; used to infer exp if missing)
• sig: optional signature (EIP-191) over the canonical payload hash

Validation rules

Server and client validate before showing staged data:

• Statement must be non-empty and <= 500 characters.
• a and b must be numeric strings (base units).
• Minimum stake: 5 USDC per side (5,000,000 base units).
• ra must be in the future (for sharing in UI).
• Expired if exp <= now or ra <= now.

If exp is missing and ts is present, expiry is inferred as ts + 7 days.

Signature (verified vs unverified)

Staged links can be shared without a signature (Unverified). If a signature is present and valid, the UI marks it Verified.

Canonical payload (for hashing and signing):

• JSON string containing only keys in this order:

v, s, a, b, ra, ta, c, tag, exp, ts

• sig is excluded from the hash.

Message to sign:

LockItIn Staged Commitment
Hash: <keccak256(canonical_json)>

Verification uses EIP-191 (personal_sign).

OG/Twitter meta

index.php renders OG meta tags for staged links when:

• User agent is a crawler, or
• ?preview=1 or ?meta=1 is present.

Titles include a staged indicator (Challenge or Expired), and use the site OG image for consistent previews.

Client behavior

When a staged link is opened:

• The Create form is prefilled with statement, amounts, target acceptor, and resolution time.
• A staged banner appears with status (Verified or Unverified, Open or Private, expiry).
• The user can create the commitment normally from the prefilled draft.

Security limits

Stage decoding is capped to prevent abuse:

• Stage param length: 4096 chars max
• Inflated JSON: 8192 chars max

Next steps (optional)

• Add /api/staged + DB-backed short slugs (/s/<slug>)
• Require signatures for any persisted or featured staged commitments
• Add a Staged filter in Explore