KCC20

Protocol · TTT Phase 6

The Sovereign Thread

DApps request. Wallets authorize. Users decide. Kaspa settles.

VEYRA is the signing protocol for the Kaspa application layer. It is the rule that a dApp may ask this wallet to move coins, and may never hold the key that does it. TTT, KasDistro, Nilla, COOK Agent, and any site on sdk.js knock on this boundary. Scorpion is the open wallet that answers.

Three rooms

The application prepares unsigned work: a KRON buy, a KKDAG send, a vault lock, a vProg turn. The wallet holds the Schnorr key — PIN on this device, or KasWare / Kaspire if you turned that on in Settings. The network is Kaspa L1. Settlement is a verified transaction, not a balance in someone else’s app.

When those rooms collapse, the dApp becomes a custodian. VEYRA refuses that collapse. This PWA is the wallet room. TTT is an application. Kaspa is the settlement.

Request is not authority

A site saying “sign this” is a proposal. A signature is consent. Connect selects this wallet; it does not hand the dApp a standing right to spend. Each Connect, Sign, Send, and Broadcast opens an Approve sheet. Reject is a valid result. Approving one PSKT does not approve the next.

After Connect the popup closes on purpose so reads stay silent (getAccounts, getUtxoEntries, getBalance). A later sign reopens the sheet. The dApp never receives seed, PIN, or hex.

What this wallet signs

You (or the dApp) build the unsigned transaction. Scorpion signs only the listed P2PK funding inputs — the KAS coins that pay fees and, for KCC-20, the buyer’s funding input. Covenant cells, KRON curve/pool, and inventory inputs already carry their own witnesses. signInputs.index is the global slot in tx.inputs[]. SIGHASH_ALL on this build.

buyKron is wallet-built: the PWA quotes and assembles the covenant tx, then you Pay with PIN or an extension. sendToken moves a bag you already hold. Neither path sends your key off this origin.

Bring your own signer

PIN is the in-app signer. KasWare and Kaspire are desktop extensions with the same job: they pop, you Approve, keys stay in the extension. You → Settings turns one of them on. Only one extension signer is active at a time. iPhone has no Chrome extension; PIN is the signer there.

Agents knock too

COOK Agent, Home TRADE, and Scorpion chat may quote, route, and assemble. They stop at the Approve sheet. If this tab is locked, the loop stops. An agent that can prepare a fill without being able to sign it is safe to leave running. An agent that owned the key would not be VEYRA.

KCC-20 and the rest of the stack

A KCC-20 token is a covenant UTXO with rules, not a line in a contract’s storage. The wallet authorizes the owner’s funding input. The covenant checks the transfer. Kaspa includes the tx. KCC-01 / KCC-02 / KCC-20 in kaspanet/kccs are still drafts as conventions. The KRON path in this app is the live token transfer we already ship.

vProgs is a prototype runtime. The tic-tac-toe lane in Apps is a TN10 guest demo. DAGKnight is future consensus. VEYRA does not wait on them. It works on Kaspa L1 as it runs today.

For builders

Pin https://kcc-20-wallet.vercel.app/sdk.js?v=174. Require window.kcc20.sdkVersion === '174'. Call Connect from a user click. Read window.kcc20.veyra or request('veyra') for this protocol (silent). Docs: docs.html. Discovery: kaspa:announceProvider, rdns app.kcc20.wallet. Do not overwrite a real window.kasware.

Fork this wallet

Scorpion is MIT-licensed so people do not start from a blank page. Clone github.com/mrzeku2000XTTT/KCC20-wallet. Keep the signing boundary. Change origin, rdns, branding, and trusted iframe origins. Implement the same window.kcc20 surface so dApps do not fork. Guide: FORK.md on this origin.

Your wallet. Your keys. Your signature. VEYRA is the thread that carries it.

Full page · Markdown · Fork guide · SDK