Architecture
Current Architecture
House of Stake leases NEAR top-level namespace accounts as transferable NFTs. A leased name is a real NEAR account running the hos-wallet contract, with zero access keys. Ownership lives in contract state, and the owner operates the account from a wallet they already control.
The registry mints each name as a NEP-171 token and records the owner. The leased account also records its owner, so both records must agree. Authority flows through tla-registry to hos-extension to hos-wallet; the extension accepts force_transfer only from the registry.
The owner sends a transaction from an account already under their control and calls the leased wallet. The wallet checks that the caller is an enabled extension, that the lease is active, and that the account is not frozen. It then runs the requested supported action with the leased account as predecessor. Nothing signs on behalf of the leased account.
Component Responsibilities
| Component | Responsibility |
| Frontend | Search, rental, marketplace, account management, and recovery setup |
| The House of Stake backend | Orders, payments, product state, recovery orchestration, and operational records |
| TLA registry | NEP-171 names, leases, owners, pricing, treasury, and lifecycle |
| Registrar | Creates leased sub-accounts under the TLA root |
| Wallet implementation deployer | Publishes the shared hos-wallet implementation |
| Wallet | Holds the account’s control set and runs supported actions with zero access keys |
| Extension | Authority for leased wallets, ownership rotation, and expiry sweeps |
| Recovery | Verified request, timelock, independent approval, and owner updates |
| Indexer and services | Mirror chain state, run product workflows, and keep recovery watcher services separate |
Operation Flow
- The owner sends a transaction from an account named in the leased wallet’s control set.
- The owner’s wallet calls
w_execute_extensionwith the exact supported actions. - The leased wallet checks extension membership, caller authority, lease state, and freeze state.
- The actions execute with the leased account as predecessor.
The external action vocabulary contains Transfer, FunctionCall, and DeterministicStateInit. AddKey, DeleteKey, DeleteAccount, and DeployContract do not exist in the accepted action set. Native validator registration is also excluded because it requires a key.
Ownership Transfer & Recovery
Sale, direct transfer, and recovery update the owner recorded by the wallet and registry. Every live-name transfer requires the predecessor to be the current owner, so an administrator cannot move it directly. Recovery also checks that the expected owner is still current before applying the update.
Recovery requires an attestation, a timelock, and a watcher quorum approving the specific destination. If the account changes before completion, the recovery is cancelled instead of replacing the newer account state.