How it works
QUIVER does one thing: it holds tokens and hands them over on a schedule. Everything below is enforced by the contract, not by us.
The mechanism
A stream is an escrow with a clock. You deposit the full amount up front and set three timestamps: start, an optional cliff, and end. From start to end, the vested amount grows linearly, second by second. The recipient can withdraw the vested part at any moment, in one go or in slices.
Nothing needs to run for this to work. There's no keeper bot, no cron, no monthly transfer to remember. Vesting is a pure function of the clock. The contract computes it the instant someone asks.
A cliff doesn't pause the accrual, it gates the withdrawal. With a 4-year stream and a 1-year cliff, nothing is withdrawable for a year, then 25% unlocks at once, because it had been accruing all along.
The NFT decision
Every stream is minted as an ERC-721 to the recipient. This isn't decoration: the NFT is the claim. ownerOf(id) is the only address that can withdraw, so transferring the token transfers the future income, with no custom logic, no migration function, no permission from the sender.
It buys three things for free: your vesting is visible in any wallet, it's sellable on any NFT marketplace, and it composes as collateral anywhere ERC-721 is understood. An employee who needs liquidity today can sell four years of patience to someone who has it.
The card renders on-chain, computed at read time from the contract's own state. No server, no IPFS pin to lapse. It shows the real progress whenever a wallet loads it.
Who can do what
What cancelling actually does
Cancelling is not a clawback. The vested portion stays owed to the holder. They can still withdraw it afterwards. Only the unvested remainder returns to the sender, and the stream stops accruing at that instant.
If you want to prove you can't change your mind, create the stream non-cancelable, or call renounceCancellater. That's a one-way door, on purpose.
The boring guarantees
- Streams are isolated. Each one can only ever pay out its own deposit, so no stream can drain another's escrow. Proven by a fuzz test.
- Never over-pays. Across every schedule and every moment, the total paid out can't exceed what was deposited.
- Fee-on-transfer safe. The deposit is measured by actual balance received, so the contract never promises tokens it doesn't hold.
- The fee is capped in code at 0.01 ETH and applies only at creation. Withdrawing is free, forever, and changing the fee can't touch an existing stream.
- The owner's reach stops at the fee and the treasury. Escrowed tokens are unreachable by design. There is no admin withdraw.
What it costs
Creating a stream costs a flat fee in ETH, plus gas. Withdrawing costs only gas, and it's cheap, around 56k, roughly a token transfer. Creation is heavier (~325k) because the contract indexes the stream on both sides so this site needs no backend at all.
The words we use
- Stream
- One escrowed grant with a schedule. Minted as an ERC-721 to the recipient. The token is the claim.
- Sender
- Whoever funded the stream. Can cancel it if it was created cancelable, and can give that right up. Never withdraws.
- Recipient
- Whoever holds the NFT right now, which is not always who it was minted to. Only they can withdraw.
- Cliff
- A timestamp before which nothing is withdrawable. It gates the withdrawal, it does not pause the accrual.
- Vested
- What time has released so far, withdrawn or not. Grows every second between start and end.
- Withdrawable
- Vested minus already withdrawn. What you can take right now.
- Cancelable
- Whether the sender can still stop the stream. Once renounced, it is false forever.
- Tradable
- Because the stream is an ERC-721, selling the NFT sells the remaining schedule. No permission needed.
Questions people actually ask
›Can you take my tokens?
No. There is no admin withdraw in the contract. The owner can set the creation fee, under a cap written into the code, and the treasury address. That is the whole surface.
›What happens if this site goes down?
Nothing to your stream. The schedule and the funds are in the contract. Both dashboards are rebuilt from plain eth_call, so anyone can read or withdraw with a block explorer and no frontend at all.
›Can I cancel after I promised not to?
Only if you kept the right. Create the stream non-cancelable, or call renounceCancel later, and cancelling reverts forever. That is the point of it.
›If I cancel, do I get everything back?
No, and that is deliberate. The vested part stays owed to the recipient. Only the unvested remainder returns to you.
›Does it work with a multisig or a treasury?
Yes, as long as the contract implements onERC721Received. If it does not, creation reverts on purpose: such a contract could never withdraw or transfer, so the tokens would be stranded. The form checks this before you sign.
›What about a token that taxes transfers?
Handled. The deposit is measured by the balance actually received, so the stream only ever promises what the contract really holds.
Honest limits
Not audited by a third party.What it does have: 129 tests, fuzz invariants proven over 50,000 stateful calls, and fork tests against real tokens on the live chain. Two independent security reviews, each of which found and fixed real bugs. No admin withdraw anywhere in the code. That is a lot of evidence, and it still isn't an audit. Read the code before you trust it with size.
The contract is deployed at 0x2866D49f364a70383591a958354A89F6BDf050f2 ↗. Verify it yourself.
Ready?
create a stream