papers/lux-ats-architecture/sections/04-non-custodial-mpc-custody.tex

\section{Non-Custodial MPC Custody}
\label{sec:mpc}

\subsection{Threshold Signing Architecture}

The central innovation of this ATS is non-custodial operation through MPC threshold signing. The \texttt{luxfi/mpc} library implements a 2-of-3 threshold scheme based on the GG20 protocol for ECDSA and FROST for EdDSA signatures.

Three key shares are distributed:

\begin{enumerate}[nosep]
  \item \textbf{Investor share}: Held on the investor's device, never transmitted to the platform.
  \item \textbf{Platform share}: Held by the ATS in an HSM-backed enclave, used only upon authenticated instruction.
  \item \textbf{Recovery share}: Held by a regulated custodian (e.g., a qualified custodian under the Investment Advisers Act), used only for key recovery.
\end{enumerate}

Any 2 of these 3 shares can produce a valid signature. The platform alone cannot move assets. The investor alone cannot bypass compliance checks. Both must cooperate for a transfer to execute.

\begin{definition}[Non-Custodial ATS]
An ATS is \emph{non-custodial} if for every asset transfer $\tau$, the platform's key share alone is insufficient to produce a valid signature $\sigma$ authorizing $\tau$. Formally, for threshold $t = 2$ and platform share index $i_p$, the signing function $\textsf{Sign}(\{s_{i_p}\}, m) = \bot$ for any message $m$.
\end{definition}

\subsection{Transfer Flow}

A securities transfer proceeds through the following steps:

\begin{algorithm}[H]
\caption{Non-custodial securities transfer.}
\label{alg:transfer}
\begin{algorithmic}[1]
\Require Order $o$, buyer $B$, seller $S$, security token $T$
\Ensure Atomic settlement on Lux EVM
\State ATS verifies $B$ passes KYC/AML and accreditation checks
\State ATS verifies $S$ holds sufficient $T$ in partition $p$
\State ATS verifies transfer satisfies all restriction rules on $T$
\State ATS constructs settlement transaction $\textsf{tx}$
\State ATS requests MPC partial signature from $S$ (investor share)
\State $S$ reviews $\textsf{tx}$ details on device, provides partial signature $\sigma_S$
\State ATS provides platform partial signature $\sigma_P$
\State $\sigma \gets \textsf{Combine}(\sigma_S, \sigma_P)$ \Comment{Valid 2-of-3 threshold signature}
\State ATS submits signed $\textsf{tx}$ to Lux EVM
\State Lux EVM executes atomic transfer: $T$ from $S \to B$, payment from $B \to S$
\State Settlement confirmed in same block (T+0)
\end{algorithmic}
\end{algorithm}

\subsection{Security Properties}

\begin{theorem}[Platform Non-Access]
Under the 2-of-3 threshold scheme, the platform cannot unilaterally transfer any investor asset, even if the platform's HSM is fully compromised.
\end{theorem}

\begin{proof}
The platform holds exactly one key share $s_P$. A valid signature requires $t = 2$ shares. Compromising $s_P$ yields only one share. The adversary must additionally compromise either the investor's device (share $s_I$) or the recovery custodian (share $s_R$). By assumption, these are independent security domains. The platform alone is insufficient.
\end{proof}

\begin{theorem}[Regulatory Compliance]
The MPC architecture preserves the platform's ability to enforce transfer restrictions and comply with regulatory orders, despite being non-custodial.
\end{theorem}

\begin{proof}
The platform's share is required for any 2-of-3 signature involving the platform. The platform will only provide its partial signature when the transfer satisfies all compliance checks (KYC/AML, accreditation, transfer restrictions, court orders). If a regulatory order prohibits a transfer, the platform withholds its share, making the transfer impossible through the normal (investor + platform) signing path. The recovery custodian share exists solely for key recovery under legally defined circumstances and cannot be used for trading.
\end{proof}