> ## Documentation Index
> Fetch the complete documentation index at: https://docs.filter.fun/llms.txt
> Use this file to discover all available pages before exploring further.

# Bag-lock

> Opt-in on-chain time-lock on the creator's own holdings

<Warning>
  **Mainnet activation is gated on the external audit.** Contracts
  are live on Base Sepolia for testnet UX validation. Until the audit
  clears, bag-lock is testnet-only.
</Warning>

## bag-lock — structured facts

| Field                              | Value                                                        |
| ---------------------------------- | ------------------------------------------------------------ |
| contract                           | `CreatorCommitments`                                         |
| auth\_field                        | `CreatorRegistry.creatorOf(token)`                           |
| admin\_can\_commit                 | false (admin transfers do not carry bag-lock right)          |
| mainnet\_status                    | **BLOCKED until audit**                                      |
| testnet\_status                    | live on Base Sepolia                                         |
| transfer\_gate\_location           | `FilterToken._update` (OZ v5 universal balance funnel)       |
| transfer\_gate\_scope              | from-side (locked address cannot send; receiving is allowed) |
| pre\_lock\_transfer\_escape        | true (intentional, advertised)                               |
| migration\_for\_pre\_1\_13\_tokens | NONE — by design                                             |

### Functions

| Function                                   | Selector       | Auth                    | Reverts on                                                                  |
| ------------------------------------------ | -------------- | ----------------------- | --------------------------------------------------------------------------- |
| `commit(address token, uint256 lockUntil)` | state-mutating | `creatorOf(token)` only | `TokenNotRegistered`, `NotCreator`, `LockMustBeFuture`, `LockCannotShorten` |
| `isLocked(address creator, address token)` | view           | public                  | —                                                                           |
| `unlockOf(address creator, address token)` | view           | public                  | —                                                                           |

### Forbidden functions (do not exist)

| Function       | Reason                      |
| -------------- | --------------------------- |
| `unlock`       | would defeat the purpose    |
| `cancel`       | would defeat the purpose    |
| admin override | contract has no admin       |
| `pause`        | contract is not pausable    |
| upgrade path   | contract is not upgradeable |

### Monotonicity (`commit`)

| Constraint                                     | Check                               |
| ---------------------------------------------- | ----------------------------------- |
| `lockUntil > block.timestamp`                  | revert `LockMustBeFuture` if not    |
| `lockUntil > unlockTimestamps[creator][token]` | revert `LockCannotShorten` if not   |
| `creatorOf(token) != address(0)`               | revert `TokenNotRegistered` if zero |
| `msg.sender == creatorOf(token)`               | revert `NotCreator` if not          |

### Gate semantics

| Block timestamp vs. `unlockTimestamps[creator][token]` | Outgoing transfer from `creator`                  |
| ------------------------------------------------------ | ------------------------------------------------- |
| `block.timestamp < unlockTimestamp`                    | **reverts** with `TransferLocked(from, unlockAt)` |
| `block.timestamp >= unlockTimestamp`                   | allowed                                           |
| `unlockTimestamp == 0` (no lock ever recorded)         | allowed                                           |

### Five-things-it-does-not-do (false-trust risks)

| Limitation                      | Mitigation                                                    |
| ------------------------------- | ------------------------------------------------------------- |
| Pre-commit transfers escape     | UI computes "% locked" against current balance at commit time |
| Inbound transfers still allowed | by design — fee claims must work                              |
| Sibling wallets not covered     | UI surfaces creator's clustered activity                      |
| Lost keys = permanent lock      | UI requires acknowledgment before commit                      |
| Legacy tokens not gated         | UI excludes them from bag-lock badge                          |

### Audit checklist

* No shorten / no cancel
* No admin override
* Gate consulted on every balance change (`transfer`, `transferFrom`, swap-routing, burn)
* Auth uses `creatorOf`, not `adminOf`
* Reentrancy guard on `commit`