Card roles and limits
who can approve what, and what that really protects.
Each paired card has a role. Owner and Backup cards approve anything; a Spender card approves coin payments up to a daily limit per network. These are rules of the app on one phone. They are not written on the card and not enforced on the blockchain.
01Require the card
In NFC Crypto, open the Card tab → Require the card. It is off until you turn it on. Two switches:
| Switch | What it does |
|---|---|
| To open the app | After Face ID or the passcode, the app asks for a paired card: at start, after every lock, and after more than 30 seconds in the background. Watch-only wallets are never asked. |
| For payments and swaps | Sends, swaps, approval changes, speed-up and cancel, WalletConnect requests and message signatures all need a card tap. A tap allows signing for 90 seconds, long enough for a flow that signs twice (approve, then swap). |
The check sits in two places: where the user starts the action, and inside every signer (EVM, Solana, Bitcoin, typed data, dApp messages, in lib/core/nfc/nfc_signing_guard.dart). A code path that forgot to ask for the card fails instead of signing. A test (test/nfc_signing_guard_test.dart) fails if a new signer is added without the guard.
While any requirement is on, showing or exporting the recovery phrase, pairing another card, turning a requirement off and removing a card also need a card.
02The three roles
| Role | Approves | Changes the card setup |
|---|---|---|
| Owner | Any transaction; showing the recovery phrase | Yes: pair cards, change roles and limits, remove a card, turn protection off |
| Backup | Any transaction; showing the recovery phrase | No |
| Spender | Native-coin payments within its daily limit | No |
- The first card you pair is the Owner. Later cards join as Backup.
- The last Owner card cannot be changed to another role or removed while other cards remain. Removing the very last card is allowed and turns protection off.
- While a card is required, setup changes ask for an Owner card. With nothing required, the phone holder already has full control, so no card is asked.
- Cards paired before roles existed are treated as Owner cards.
To change a role: Card tab → tap the card (or its menu → Change role).
03Spending limits (Spender cards)
- One daily limit per network, in that network's coin: ETH, POL, BNB, AVAX, SOL or BTC. The USD value is shown next to it when a price is known.
- The window is a rolling 24 hours, not a calendar day.
- A Spender tap approves a coin payment when the amount plus what this card approved in the last 24 hours is at most the limit.
- Over the limit, on a network with no limit, or for anything other than a plain coin payment (tokens, swaps, dApp requests, approval changes), the app asks for an Owner or Backup card instead.
- A payment counts from the moment the card approves it, even if sending then fails. Owner and Backup approvals never use a Spender's limit.
- The card history records which card and role approved, or was refused, for each transaction.
To set a limit: open the Spender card from the Card tab and tap a network in its daily limits list. Source: lib/core/nfc/nfc_spend_policy.dart.
04What roles and limits are not
Roles and limits are stored in the app's preferences on the phone where the cards were paired. They are not on the card and not on the blockchain. They do not bind another wallet app that holds the same recovery phrase, and they only apply while the card is required for payments. A rooted or jailbroken phone can change app preferences.
Use them to stop mistakes and casual overspending, for example a card for a family member or a till. Do not sell them as protection against the person who holds the wallet's recovery phrase.
05Lost card
- Recovery phrase: entering three words of the recovery phrase (the app picks which ones) turns the requirement off at once. After three wrong answers, each next try waits longer: 1, 2, 4 … minutes, up to a day.
- 72-hour switch-off: or ask for the requirement to turn off after 72 hours. The wait is measured in network time (HTTPS
Dateheaders), so changing the phone's clock does not skip it. Tapping any paired card cancels the wait. - There is no passcode-only way out. The card exists to stop someone who has the passcode.
- Lost the Owner card: turn protection off with the recovery phrase, then change roles without a card.
Source: lib/core/nfc/nfc_card_gate.dart, lib/core/nfc/trusted_time.dart, lib/features/nfc/nfc_card_gate_ui.dart.
06Roles in CryptoCard Wallet
CryptoCard Wallet has the same three roles, printed on the card art, with a few differences because there the card holds the wallet:
- The first card of a wallet is its Owner. A clone made in the app is a Backup by default; you pick the role while cloning. A clone of a Spender card is always a Spender with the same limits.
- Over the limit, the Spender card's phrase is dropped and the app asks for an Owner or Backup card tap plus its PIN; that card signs. Sends approved that way do not count against the Spender's limit. The amount sent counts, not the network fee.
- Changing a role or a limit, removing the wallet from the phone while limits are in use, and showing the phrase need an Owner or Backup card.
- Once a wallet has a Spender card, a card the phone has never seen joins as a Spender with no limit, so a copy made in another app cannot get around the rules.
Every CryptoCard card holds the same encrypted phrase. Someone with a Spender card and its PIN can open the full wallet in another app, or reinstall this one. Give a Spender card only to someone you would trust with the wallet.
07How this was checked
Roles, limits and the card requirement are covered by unit and widget tests in both apps. Pairing, opening the app, confirming a payment and the phrase backup were also tested with real NFC cards; roles and limits rely on the automated tests. Test your own build with real cards before you sell, using the checklist in Build and release.