Broker FinanceBroker.DocsLaunch app

Custody & keys

Broker Finance separates the keys that move money from the keys that change the system. Operational signing is bounded and can be rotated; governance authority is held offline in a cold multisig.

Hot / cold key separationOperational hot keys sign fills and hedges but are bounded by caps; governance capabilities (upgrade and admin) are held offline in a cold multisig.Operational · hot · boundedGovernance · cold · offlineBroker keyfills · mint / burnHedge keybuy / hold underlyingBounded by caps + kill switch$50 / trade · $500 / day · Ika dWallet targetCold multisigheld offline, off the serversUpgradeCapupgrade codeAdminCapallowlists
A compromised hot key can move at most the capped hedge amount. Upgrading code or changing allowlists requires the cold multisig — a different key entirely.

Operational keys (hot)

Two keys do the day-to-day work, and both are bounded by hard limits:

  • Broker key (Sui) — the only address allowed to fill orders. It signs mints/burns and receives the quote USDC. It must be in the on-chain broker allowlist.
  • Hedge key (Solana) — buys and sells the real underlying to keep the book delta-neutral, and holds it in custody.

Hedging is capped per trade and per rolling day (the launch runs a small $50 / $500 limit), and there is a remote kill switch. So even if a hot key were compromised, the blast radius is bounded by those caps rather than the whole treasury.

Custody: hot wallet → Ika dWallet

The launch holds reserves in a bounded hot Solana wallet with the address published. The target is an Ika 2PC-MPC dWallet: signing is split across the Ika network so no single machine ever holds the full key, and every signature is gated by an on-chain policy — a destination allowlist plus per-transaction and rolling-window notional caps. That lets the broker custody and move assets across chains without a bridge, under rules anyone can read.

Governance keys (cold)

The capabilities that can change the system live in a cold multisig, off the operational path:

  • UpgradeCap (one per package) — authorizes upgrading a contract’s code.
  • AdminCap — controls the broker / quote / bro-asset allowlists and treasury registration.

These never touch the servers. A compromised hot key can move at most the capped hedge amount; it cannot upgrade a package, re-point an allowlist, or drain the treasury — those require the cold multisig. Display-only capabilities (coin metadata) are kept warmer for convenience, since their worst case is a wrong icon.

Why two chains

The customer-facing side — orders, escrow, mint/burn — settles on Sui. The real underlying lives on its native chain (SOL and the xStocks are all on Solana), so the hedge and custody settle there. The two sides are reconciled by the 1:1 backing invariant rather than a bridge; see Proof of reserve.