Vault Security: What a Manager Can and Cannot Do

1The one rule

The manager can stake your coins. The manager cannot move your coins.

That is enforced by the Divi blockchain, not by the manager's honesty, not by their software, not by a contract. A dishonest manager with a modified wallet still cannot take them. The only key that can send vault coins anywhere is the owner key. Keep it.

2Why: the script, line by line

Every vault output on the chain carries this script (from decompose a vault):

OP_IF
    <owner key hash>
OP_ELSE
    OP_REQUIRE_COINSTAKE
    <manager key hash>
OP_ENDIF
OP_OVER OP_HASH160 OP_EQUALVERIFY OP_CHECKSIG

Whoever spends the output chooses a branch. The owner branch asks for a signature from the owner key, in any transaction. The manager branch asks for a signature from the manager key and runs OP_REQUIRE_COINSTAKE, which fails unless the spending transaction is a coinstake: the first transaction of a proof-of-stake block, whose outputs by consensus must return the staked coins to the same script plus the reward. Every node checks this before accepting a block. A coinstake that pays a vault input to a different address is an invalid block, and the network rejects it.

Source: the OP_REQUIRE_COINSTAKE handler in script/StackManager.cpp of Divi Core; the vault script builder in script/StakingVaultScript.cpp.

3What a manager can do

Stake the vault coins and mint blocks with them. The reward lands in the vault, so it also belongs to the owner.
Stop staking them, at any time, by turning the node off or running removevault. Your coins sit idle until you move them or another manager adds them.
See the vault's balance and transactions. Vaults are public on the chain anyway.
Take a fee only if you agree to send one. Nothing in the script pays the manager. Any fee is a separate arrangement you pay with an ordinary transaction, or by letting the manager keep a vault where they are the owner.

4What a manager cannot do (proved)

On 2026-10-21 we ran a Divi Core manager holding 20 of its own tDIVI plus 170 in other people's vaults, and an IronDivi manager holding 50 own plus 219 vaulted, and told each one to take the vault coins. Every attempt failed:

Attempt	Divi Core manager	IronDivi manager
Send 100 to another address	Insufficient funds: 10000000000(total requested) is greater than 1999990080(total available)	Only signed 0 of 1 inputs
reclaimvaultfunds 1	Insufficient funds: … greater than 0(total available)	No vault funds available to reclaim (no owner keys found for any vaults)
debitvaultbyname from the owner's vault	Vault owner key is unknown: ownership=0 address=y8PL…5Ut5Aj	not yet implemented
Move the vault to a different manager	Impossible. A new vault needs a fundvault transaction signed by the owner. The manager can only point the old vault at nothing.

These are wallet-level refusals; the wallet will not even build the transaction. A manager who patched their wallet to build one anyway would have it rejected by every node because the signature check cannot pass without the owner key, and the coinstake branch cannot pass outside a coinstake. Full transcript in the folder for this page.

Two more things a manager cannot do:

Stop you from taking your coins back. reclaimvaultfunds and debitvaultbyname need only the owner key and work whether the manager is online, offline, or gone.
Lock your coins for a period. There is no time lock in the script. "Vaulting" is not a bond.

5What you, the owner, must protect

The owner key's recovery phrase. Lose it and nobody, not the manager, not Divi, can recover the vault. Keep it in a password manager: Proton Pass ↗ is free; 1Password, Bitwarden, Dashlane, Keeper and Apple Passwords also work. Never show it on screen, never type it into a website.
The owner wallet can be cold. It does not need to run. Fund the vault, verify in the explorer, and shut it down. Start it only to reclaim or debit.
Do not let the manager generate the owner address. If a manager "helps" by running fundvault on their machine with coins you sent them, the owner key is in their wallet and they own the vault. Fund from your own wallet only, with an address you generated (getnewaddress) or an address you already hold.
Check the encoding before funding. The owner half must be yours. Run validateaddress on the first address: "ismine": true on the wallet you control.

6Checks before trusting a manager

Ask for one address, nothing else. A manager never needs your phrase, your wallet file, or your RPC password.
Fund a small vault first, wait a block, and look it up in Explorer 2.0: type vault, addresses [you, manager].
Reclaim it. If the coins come back, you have proved the whole loop on that chain with that manager.
Then fund the real amount in a new vault.

7Going to mainnet

The script is identical on mainnet; only the address prefix changes (D instead of x/y). What changes for you is that mistakes cost real coins:

Practise every command on testnet first (this page and the ones before it are all testnet).
Remember that a partial reclaimvaultfunds moves the remainder to a plain address and stops it staking (details). Use debitvaultbyname if you want to keep the rest vaulted.
Mainnet coins need 20 confirmations before a new vault output can stake, and coin-age weight starts over after any move.

Still unsure? Ask the Divi chatbot.