Definition
What is protected self-custody?
Protected self-custody means no single party can move your funds. Not the app you are using, not the network that co-signs, and not us.
It is not another word for self-custody. Self-custody says who holds the key. This says how many parties it takes to use it, and the answer is more than one.
How it works, and which accounts have it.
The protocol has two account types and they do not make the same promise. Saying otherwise would make this page the fifth surface to get it wrong.
The Wallet Protocol’s Squid Mode: two parties, both required
A signature needs our secure enclave and the Ika validator network together. Neither side can produce one alone, and the key is never assembled in one place. This is the account type protected self-custody describes.
If our infrastructure is compromised, an attacker still cannot sign. If Ika is compromised, the same holds. Both would have to fall at once.
Standard accounts: one enclave
Signing happens inside a secure enclave. There is no seed phrase and no key on your device to lose or leak, and a policy you set is enforced before anything is signed.
This is self-custody with the loss and phishing problems removed. It is not protected self-custody, because one party completes the signature. We say so here rather than let the stronger claim cover both.
The two things it gets confused with.
What it does not do.
- It does not stop a policy you authorised from being used exactly as you wrote it. If you allow an agent to spend $100 a day, it can spend $100 a day.
- It does not make a transaction reversible. Two parties signing is still signing.
- It does not remove your responsibility for what you approve. It removes the case where somebody else approves for you.
- It does not apply to standard accounts, which one enclave signs. That distinction is the whole reason this page names both.
Squid Mode settles on Sui, so it needs SUI for Sui gas and IKA for the network fee. Worth knowing before you integrate rather than after.