No vault. On purpose.
If the gift sat in a contract we controlled, this would be custody with nicer type. It does not. The link is the key.
No custody.
No contract or address of ours ever holds a gift. If we cannot touch it, we cannot lose it for you, and we cannot freeze it.
The fragment is the vault.
The secret lives in the URL fragment and in the sender's browser only. Never transmit it. Never log it. Never store it server-side.
CSPRNG, or it is not a gift.
Keys are generated with a cryptographically secure generator in the browser. Not from time, a counter, or a phrase you type.
Gas travels with the token.
Compose will not call a gift ready until the sweep can pay for itself, with a 3x margin against a later gas spike.
Same two facts, both sides.
Anyone with the link can claim it. The sender can reclaim it until it is claimed.
Exact suffix, never a substring.
Fakes on this chain can contain the words Robinhood Token. We match the giftable address list and an exact name ending.