Retail banking without custody

The recovery phrase is the reason self-custody remained a specialist product for fifteen years. Twelve words that cannot be reset, cannot be supported, and transfer the full consequence of an error to someone who has never made one. Any product intending to hold a person's primary balance has to remove it. The two obvious removals, holding the keys centrally or concealing them in the client, are custody and negligence respectively.

The system uses hardware key management instead. Signing keys are generated inside a hardware security module and never leave it. The customer authenticates through a passkey or an established identity provider, and the enclave signs on their instruction. Customers who prefer to bring their own wallet connect one; external wallets are a first-class path, not a degraded one.

What distinguishes this from custody with better presentation is that the root signer is immutable. Later delegation can extend an account's capabilities but cannot replace the signer that owns it. The property is verifiable on-chain by the customer, which makes it a characteristic of the system, not an undertaking by its operator.

Every concept a customer is required to understand is a point of attrition. Gas is the most severe: a balance that cannot be spent for want of a second asset the customer has never heard of. Token approvals follow, presenting a permission request in terms almost nobody can evaluate. Network selection is third, and exists only because the software declined to determine the answer itself.

All three are resolved beneath the interface. A self-hosted relayer funds gas and batches execution, selecting whichever gasless primitive the token actually supports across three signature standards instead of assuming one. Deposits and swaps resolve to a single signature instead of the approve-then-execute pair, so no standing permission is ever granted. The router selects the chain and the interface does not raise the question.

A relayer that funds gas on behalf of others is a hot wallet exposed to the public internet. It validates the specific call it is sponsoring instead of forwarding arbitrary calldata, and a sponsorship budget breaker bounds the loss if that validation proves incomplete. Designing for the case in which one's own reasoning was wrong is most of what separates infrastructure from demonstration.

When an application displays a savings rate, the customer is owed an answer to one question: in the event of the operator's failure, what remains. In most yield products the accurate answer is a claim against the operator, and the rate is the operator's to revise or default upon.

Here the balance is a share position in an ERC-4626 vault deployed over an established lending market, denominated in dollars on one network and euros on another. Redemption executes directly against the contract without the operator's cooperation, servers or continued existence. The rate is not set by the operator; it is the market rate, read from the market.

Vault code is where errors become permanent, so the deployment discipline is deliberately slow. The standard's known share-inflation and donation edge cases are tested explicitly. Fee assertions execute against a fork of live chain state, not a fixture. The complete deposit, accrual and withdrawal cycle is proven against real market conditions before a deployment script exists.

Funds must arrive from and return to a bank account over the domestic rail the customer already uses: ACH and wire, SEPA, Faster Payments, SPEI, PIX. Acquiring direct access to those is a multi-year, capital-bound programme. Accessing them through a licensed provider takes weeks.

The provider relationship is not the interesting decision, since every programme of this type has one. The interesting decision is what remains on the operator's side of the boundary. The ledger, the customer record, the transaction history and the compliance evidence are held internally. The provider settles funds; it does not hold the authoritative record of the business. That distinction is invisible at launch and decisive at the point the programme outgrows the provider, or the provider revises its appetite for the category.

The same reasoning keeps the licence path open rather than foreclosed. A rented licence is the correct first position for most programmes. It becomes the wrong permanent position once the economics of owned permissions exceed the provider's margin, and an architecture that treated the provider as the product cannot make that transition at all.

The audience divides cleanly. The majority want a bank and are actively disadvantaged by exposure to an address or a health factor. A minority want the underlying machinery, and are correctly insulted by a simplified view.

Both are served from one codebase and one persisted mode flag applied to the same components. The default mode presents no addresses, hashes, gas or networks, and a single all-in fee line. The alternate mode surfaces per-chain balances, addresses, transaction hashes, position health and vault share counts in place, never as a separate flow, screen or application.

The rule that preserves the arrangement is that a disclosure leak in the simple mode and a missing control in the expert mode are defects of equal severity. Weight them differently and the abstraction begins to diverge from the machinery it represents, producing two products under one name within a year.

Every value governing funds, access or state is re-derived server-side. Amounts, prices, fees, entitlements and permissions are recomputed from authoritative sources rather than accepted from the caller, because a mobile client is a proposal and anything it transmits can be forged by a sufficiently motivated party.

Fees are computed from the input side of the transaction against actual cost, comprising gas, signing and the platform component. A transaction whose fee would not cover its execution cost is declined rather than silently subsidised. Every mutating path carries idempotency and replay protection, since the alternative to designing for the retry is discovering it during one.

Compliance-relevant events are written to an append-only, hash-chained audit record. The cryptography is not the point; the point is that a question raised two years later about what occurred and when has an answer that can be verified rather than asserted. The system fails closed throughout: where the rate limiter's backing store is unreachable, the answer is no.