02 — Custody, settlement, proof
Key management, smart contract systems, settlement and indexing built to hold up under audit and under adversaries.
On-chain infrastructure has two audiences that are rarely served by the same design: auditors, who need every state transition to be explicable months later, and attackers, who need one unchecked assumption. Systems that satisfy only the first get drained; systems that satisfy only the second cannot be operated by a regulated institution.
We build for both. Keys live in hardware or an enclave with a documented ceremony. Contracts are specified before they are written, tested against their invariants rather than their happy path, and deployed with a rehearsed rollback. State is indexed independently of the chain client so that reconciliation does not depend on a single node telling the truth.
Common questions
How do you make on-chain systems auditable?
By indexing state independently of the chain client and writing an append-only, hash-chained record of every privileged action. An auditor needs to reconstruct what the system believed at a point in time without trusting the node that served the data, so reconciliation runs against at least two independent sources that must agree.
Is a multisig enough for institutional custody?
Rarely on its own. A multisig distributes signing authority but does not address key generation, operator vetting, transaction policy, or what happens when a signer is unavailable or compromised. Institutional custody needs a documented ceremony, hardware-backed keys, policy enforcement before signing, and a rehearsed recovery path.
What should a smart contract audit cover beyond the code?
Upgrade authority, oracle dependencies, economic assumptions under stress, and the operational path for pausing or unwinding. Most large losses are not novel compiler bugs; they are correct code operating on an assumption that stopped holding, or an upgrade key held in a way nobody documented.
Next capability
Stablecoin platforms
Bring us the hard part.
Forty-five minutes with the people who would actually run the build.