How it works
Five states, six roles, and one rule that decides everything else: the person being paid never has to sign.
The lifecycle
An escrow is created with its parties, its amount, its milestones and its release rules. Nothing is locked yet, and nothing is binding.
The depositor funds it. At that moment the terms become immutable, including the complete fee schedule, so what they signed is what will happen.
The service provider marks a milestone delivered. The approver confirms the condition is met, and that approval is recorded on chain and cannot be withdrawn.
Release moves the funds to the receiver, with every fee routed in the same transaction. There is no separate settlement run and no reconciliation window.
When it does not go that way
A deadline that passes without approval refunds the depositor. Either party can raise a dispute before release. Both sides can also agree to unwind, in which case the funds go back and no fee is charged.
Roles
Our role names follow Trustless Work, which is becoming the common vocabulary for escrow APIs. If you have integrated with them, you can read our documentation without relearning anything. A single address can hold several roles, and your platform decides the mapping when the escrow is created.
| Role | What it can do |
|---|---|
| Depositor | Funds the escrow and receives refunds. Cannot release. |
| Approver | Approves a milestone and can raise a dispute. Cannot release. |
| Service provider | Marks milestone progress and attaches evidence. Can raise a dispute. |
| Release signer | Executes release once approval conditions are met. Cannot approve. |
| Receiver | Receives the funds. Signs nothing. |
| Dispute resolver | Splits a disputed amount between the two sides. Optional. |
Approval and release are separate
They are also separate from status. An approval can legitimately arrive before a status update, so release depends on the approval state rather than on a status label. Conflating the three is where escrow designs usually go wrong, and it is why the approver and the release signer are different roles rather than one.
Roles are addresses, not credentials
We hold full addresses rather than payment credentials, so being paid through Hokan does not strip your staking rights. A role can also be held by a script, which is how a DAO or a multisig can act as an approver or a resolver rather than delegating to one person’s key.
Disputes
Escrow without a dispute process is just a timelock. But a resolver who can move funds anywhere is a custodian wearing a different hat, so ours is bounded by the contract instead of by terms of service.
It can only pay the two addresses already in the escrow
Not a third address, not itself, not us, and not an address supplied when the transaction is built. A different destination fails validation outright.
Ignoring a dispute costs it the fee
The resolution window opens when the dispute is raised. Once it expires, a fallback path opens that anyone can execute, settling to the outcome the parties chose at creation. The dispute fee is charged on the resolution path only.
The resolver defaults to you, not to us. You hold the customer relationship and the context that makes a fair decision possible. We supply the machinery that stops it being abused.
We call this expert determination rather than arbitration. Arbitration is a term with statutory duties attached that a platform decision cannot meet, and using it loosely creates an expectation nobody can honour.
Integrating
Every write operation follows the same shape. You describe what you want, we validate it and build the complete transaction, and you get back unsigned CBOR. Your wallet signs it and it goes to chain. You can inspect every byte before signing, which is what makes the fee disclosure real rather than a page in a contract.
State changes arrive as signed webhooks, delivered at least once with idempotency keys so processing the same event twice is safe.
Our SDK handles the parts that are genuinely annoying: merging a wallet witness set into a stored transaction body, partial signing when several parties are involved, sourcing collateral, and turning an expired intent into an error you can act on.