What Is a One-Time Rescue Authorization?
Understand how EIP-712 one-time rescue authorizations work in Guardian Rescue. Nonces, deadlines, operator binding, and security properties.
The Problem with Ongoing Permissions
Most DeFi protocols require infinite token approvals or ongoing contract permissions. This creates systemic risk — if the contract is compromised, all approved funds are at risk.
How One-Time Authorization Works
Guardian Rescue uses a structured EIP-712 typed data message that specifies exact parameters: which asset to repay, how much, which operator can execute, and by when. You sign this message, authorizing exactly one rescue.
Security Properties
Each authorization has a unique nonce tied to the on-chain contract, a 1-hour deadline, and an operator address that cannot be changed. The signature cannot be reused, replayed, or modified. It's signed, not submitted — no gas cost.
What Happens After Signing
After signing, the authorization is stored and validated. The runner (or operator) checks all safety conditions before submitting the rescue transaction. If conditions are not met, the authorization expires harmlessly.