Custody and keys

Who can move what, and what stops them.

Apps and their users

Each app keeps its own custody model for its users' wallets and describes it in its own documentation. The modules do not take control of a user's wallet.

The Yield Engine's pool

Key	Where it is	What it can do
Master key for the pool's trading account	Off-server	Move funds out of the trading account
Trading key	Zirodelta's server	Place, change and cancel orders only. The exchange rejects withdrawals signed with it.

Payouts from the pool are batched and need a co-signature from the off-server key. If Zirodelta's servers were fully compromised, an attacker could trade the pool badly, but could not withdraw from it.

Operational keys

Some modules need keys on Zirodelta's servers to do their job, for example to mint and burn wzdUSD as shares are locked and redeemed, or to fill loans from the treasury. These keys hold the system's own roles, not users' wallets. Their activity is on public networks and will be covered by the transparency page as each module goes live.