Covenant, from zero.
Never touched Stacks, a crypto wallet, or a smart contract before? Perfect. This page walks you from a blank machine to a real, auditable conditional-treasury transaction on the Stacks testnet — every click explained.
1. What is Covenant?
Covenant is a conditional treasury platform. Money is deposited into a shared vault and only moves when a real-world condition is verifiably met — a milestone being delivered, a payroll check-in happening, an insurance incident being declared.
Think of it as programmable escrow. Instead of trusting one person to hold funds and “do the right thing,” the rules for how money is locked, split, and released are enforced on-chain and recorded on a public ledger anyone can audit.
2. What is FlowVault?
FlowVault is a programmable asset-routing layer on Stacks. It provides a single contract (flowvault-v2) with per-wallet routing rules. When you deposit tokens, FlowVault can automatically:
- Lock an amount until a future block height (a time-lock).
- Split an amount to another address on deposit (auto-routing).
- Hold the remainder as your withdrawable balance.
Covenant uses these primitives — set-routing-rules, deposit, withdraw — as the on-chain engine underneath every vault type.
3. The escrow custodian pattern (read this)
Here’s the honest, important design detail. FlowVault’s routing rules are fixed at the moment of deposit, and withdraw always pays the depositor back. So the contract cannot natively branch “if the milestone succeeds send here, otherwise refund there.”
Covenant solves this at the application layer with a per-program escrow custodian:
set-routing-rules + deposit, locking the pool until the first milestone’s deadline block.withdraws and pays that milestone amount to the builder, then re-locks the remainder until the next deadline. If the deadline passed un-attested, the remaining pool is returned to the grantor and the program ends. No manual “release” button.Every one of those steps produces a real transaction id with a clickable Stacks explorer link, so the whole lifecycle is auditable.
4. One-time setup (about 10 minutes)
ST… address, and request STX. This is play money — it has no real value.ST… address.git clone <your-repo-url> cd covenant npm install cp .env.example .env # then edit values (see below) npm run db:push # local SQLite; for Vercel use Turso (step 7) npm run devOpen http://localhost:3000.
.env, set STACKS_PRIVATE_KEY to the private key of a separate funded testnet account — this is the escrow custodian. It is read only on the server and never shipped to the browser.NEXT_PUBLIC_FLOWVAULT_NETWORK=testnet NEXT_PUBLIC_FLOWVAULT_CONTRACT_ADDRESS=STD7QG84VQQ0C35SZM2EYTHZV4M8FQ0R7YNSQWPD NEXT_PUBLIC_FLOWVAULT_CONTRACT_NAME=flowvault-v2 NEXT_PUBLIC_FLOWVAULT_TOKEN_CONTRACT_ADDRESS=ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM NEXT_PUBLIC_FLOWVAULT_TOKEN_CONTRACT_NAME=usdcx STACKS_PRIVATE_KEY=your_custodian_private_key_here DATABASE_URL="file:./dev.db"
turso auth signup turso db create covenant turso db shell covenant < schema.sql # creates all tables # In Vercel -> Settings -> Environment Variables: TURSO_DATABASE_URL (turso db show covenant --url) TURSO_AUTH_TOKEN (turso db tokens create covenant) STACKS_PRIVATE_KEY (your funded custodian key)When
TURSO_DATABASE_URL is set it is used automatically; otherwise the app falls back to the local file.No custom smart contract is deployed by you — Covenant consumes the already-deployed flowvault-v2contract. The only “deployment” you do is funding the custodian account. See the custodian pattern above.
5. Full walkthrough (real transactions)
That’s a complete milestone-grant cycle on real testnet infrastructure — exactly what a demo video should show.
6. The vault types
The Milestone-Based Grant is the flagship — a grantor-funded pool disbursed milestone-by-milestone to one builder as independent judges verify each milestone. The other three are secondary behaviors built on the same escrow + FlowVault primitives. All execute real on-chain USDCx transfers.
A grantor locks a pool; each milestone’s payment auto-releases to the awarded builder when judges attest it met, or returns to the grantor if it lapses.
Each contributor check-in releases a real USDCx payment; a missed check-in claws the remainder back to the payer.
Split percentages computed automatically from each participant’s reputation, then paid out pro-rata on-chain.
Pooled premiums pay the claimant on a declared incident, or refund/roll on expiry — all real transfers.
7. Troubleshooting
“STACKS_PRIVATE_KEY is required” — set the key in .env and restart npm run dev.
A transaction fails — the sending wallet (yours or the custodian) is out of USDCx or STX gas. Top up from the faucet.
My address didn’t appear after connecting — hard refresh (Ctrl/Cmd + Shift + R) and connect again.
Balance looks stale — Stacks needs a few seconds to confirm; click Check Balance again after the tx confirms in the explorer.