The full 10-state machine behind every funded transaction.
Below is the canonical escrow lifecycle on DUNE — from buyer offer acceptance to seller fund release. Every state transition writes to a hash-chained audit log. Click any state to expand the underlying transition logic and audit entry.
Why a state machine.
Escrow on DUNE is not "money goes in, money comes out." It's a finite-state automaton with explicit transitions, named actors, validated preconditions, and tamper-evident audit trail. Every state and every transition is auditable independently.
This means: regulators can verify it, PwC can audit it, buyers and sellers can trace every step of their transaction, and disputes can be resolved with the full state history visible to the independent Dispute Officer.
01
INITIATED
Buyer accepts an offer on a listing. Escrow record created. Listing locks to this transaction.
BUYER
T+0
T+0
Buyer is at T2 identity tier or higher. Listing is in PUBLISHED state. Lister has accepted the offer terms. Buyer has confirmed contact details and chosen funding rail.
tx_id: esc_91f3d7c0
listing: lst_882a4f
buyer: usr_a83e (T3)
amount: 185000000 NGN
timestamp: 2026-05-23T14:22:08Z
prev_hash: 0x4f2c7e...
02
FUNDED
Buyer wires funds to Zenith Trust Account NGN-7842. Webhook confirms credit. Buyer notified.
BUYER · BANK
T+24h
T+24h
Zenith webhook fires on credit to NGN-7842. Reference code on the wire matches the escrow ID. Amount matches the agreed transaction value within 0.1% tolerance. If FX (USD/GBP/USDC funding), conversion locked at CBN-published rate at moment of credit.
tx_id: esc_91f3d7c0
bank_ref: ZBR-2026-052348-71
amount_received: 185000000 NGN
funding_rail: NGN_BANK_TRANSFER
03
INSPECTION_PENDING
Inspection window opens. Buyer (or Concierge inspector) schedules a physical visit.
BUYER
T+48h
T+48h
Default 5 business day window for inspection scheduling. Buyer can extend once. If no inspection scheduled within the window, automatic transition to DISPUTED state with cause "buyer-inactivity."
If buyer is diaspora-flagged (passport identity, foreign-source funding), Concierge inspection auto-suggested with available inspector roster shown. Buyer can opt for self-inspection if they have a local representative.
04
INSPECTION_PASSED
Buyer confirms inspection acceptable. Certified report archived. Title transfer begins.
BUYER · INSPECTOR
T+5d
T+5d
Certified inspection report uploaded. Minimum 30 geo-stamped photos, condition ratings across 14 categories, inspector sign-off. For Concierge inspections, live walkthrough recording also archived to Evidence Vault.
If inspection reveals defects beyond the listing description, buyer can transition to INSPECTION_FAILED → routes to dispute or refund based on materiality.
05
TITLE_TRANSFER_PENDING
Legal partner files at registry. Tracking number issued. Buyer monitors progress.
LEGAL PARTNER
T+10d
T+10d
For transactions ≥ ₦50M, O.J | Richards prepares the Deed of Assignment, files at the State Lands Registry, and provides a tracking number. Median filing-to-registration is 5–10 business days in Lagos State.
Buyer sees registry tracking number, filing date, and current registry status. Notifications fire on every status change. Diaspora buyers have full visibility into the same data Lagos buyers see.
06
PENDING_RELEASE
Title registered in buyer's name. Operator A initiates fund release.
OPERATOR A
T+15d
T+15d
Operator A logs in with YubiKey or equivalent hardware key. Reviews transaction record. Confirms registry status. Initiates release. Audit log captures operator identity, session ID, IP address.
After Operator A initiation, a 15-minute cooldown period blocks release. During cooldown, transaction visible in compliance review queue. Allows automated checks to fire (fraud signal review, dispute check, sanctions screen).
07
DUAL_APPROVAL_PENDING
Operator B (distinct user, hardware key) confirms release within session window.
OPERATOR B
T+15d
T+15d
Operator B must be a different user than Operator A. Different authenticated session, different IP address, different hardware key. System enforces this — single-operator attempts fail at the auth layer with an audit entry.
Operator B has 24 hours from Operator A initiation to confirm. If not confirmed, transaction returns to PENDING_RELEASE and requires fresh Operator A initiation. Audit log records the timeout.
08
RELEASED
Funds release to seller agent wallet, then bank account within 1 business day. Audit chain commits.
PLATFORM
T+16d
T+16d
DUNE escrow fee (0.4% standard, lower for higher Trust Score) deducted at this point. Remainder routed to seller's Agent Wallet. Visible immediately; transferable to seller's bank account within one business day.
Listing transitions to SOLD state. Trust Score recalculation queued for both parties. Hash-chain final entry committed. Receipt issued (PDF and email). Transaction archived to Evidence Vault with 5+ year retention.
A1
DISPUTED
Either party opens a dispute. Escrow freezes immediately. Dispute Officer assigned within 24h.
EITHER PARTY
BRANCH
BRANCH
Escrow freezes in under 60 seconds of dispute opening. No release possible. Operator A and B blocked from taking action on this transaction. Notification fires to Compliance Lead.
Independent Dispute Officer (structurally separated from escrow ops) assigned within 24 hours. DO reviews evidence from both sides, may request additional documentation, schedules resolution within 5 business days. Resolution: refund, partial release, or proceed.
A2
REFUNDED
Inspection failed, or dispute resolved for buyer. Funds return to original payment source.
PLATFORM
BRANCH
BRANCH
Refund requires dual-control approval identical to release flow. Funds return to original payment source within 48 business hours. FX-funded transactions return in original currency at the rate locked at funding.
Listing returns to PUBLISHED state unless flagged for review. Trust Score impact for each party depending on dispute outcome and fault attribution. Evidence Vault retains full transaction record for 5+ years.
What if something goes wrong
Dispute opening
Either party can open a dispute at any state between FUNDED and DUAL_APPROVAL_PENDING. The dispute filing immediately freezes escrow and routes to an independent Dispute Officer. The DO is structurally separated from escrow operations — different reporting line, different physical workspace, different incentive structure.
Resolution outcomes
Three possible DO resolutions: refund (funds return to buyer), partial release (split based on materiality of defect), or proceed (dispute dismissed, transaction continues normally). Resolution typically reached within 5 business days. Either party can appeal to a senior Dispute Officer panel.