EIP-712 messages
The ROBVault's EIP-712 domain retains its deployed identifier, version 1, on chain 4663. Transfers and unshields are typed structs with an owner, a destination, an amount, a fee, a per-owner nonce and a deadline.
Submission
Anyone can submit a valid signature. The ROBVault checks it, increments the nonce, pays the submitter the signed fee in shares, and performs the action. A signature can be used once and expires at its deadline.
Bound follow-ups
An unshield can bind an extra hash — for the ROBRouter, the sale terms. When set, only the destination contract may submit it, so a sale cannot be front-run with different terms.