mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekayandHanzo Dev
70f6883235
A July commit removed eight papers on the premise "no license — DEX/non-custodial only". That premise is wrong: Lux operates an ATS, a broker-dealer, a transfer agent and a bank, and this material is resold at lux.financial. The merge that brought main in preserved the removal because the commit stated a reason, which is how a stale reason outlives the fact it rested on. Back, at the versions main carried — main never received the removal, so its copies are the later ones: the ATS architecture, the security-token standard, smart order routing, institutional custody, MPC custody, post-quantum securities, the SSB partnership and the CoinBridge brief. 83 files. Co-authored-by: Hanzo Dev <[email protected]>
92 lines
3.7 KiB
TeX
92 lines
3.7 KiB
TeX
\section{Executive Summary}
|
|
|
|
\label{sec:exec}
|
|
%% =====================================================================
|
|
|
|
A fund with eight billion dollars of Bitcoin and Ether under management
|
|
operates at a tier where the loss of any single key, the compromise
|
|
of any single jurisdiction, or the failure of any single counterparty
|
|
must not produce material loss. Off-the-shelf custody arrangements
|
|
(single-custodian trust, two-of-three multisig published on-chain,
|
|
single-cloud HSM) do not meet this bar. This paper specifies a
|
|
custody architecture that does.
|
|
|
|
\subsection{Headline Architecture}
|
|
|
|
The portfolio is split across three signing tiers, each with its own
|
|
threshold structure, latency target, and cost basis. Table~\ref{tab:overview}
|
|
summarises the layout.
|
|
|
|
\begin{table}[h]
|
|
\centering
|
|
\small
|
|
\begin{tabular}{lrrrl}
|
|
\toprule
|
|
\textbf{Tier} & \textbf{Allocation} & \textbf{Notional} &
|
|
\textbf{Threshold} & \textbf{Signing latency} \\
|
|
\midrule
|
|
Cold & 95\% & \$7.6B & 3-of-5 MPC & 1--24 h (airgapped) \\
|
|
Warm & 4\% & \$320M & 2-of-3 MPC & sub-second \\
|
|
Hot & 1\% & \$80M & 2-of-2 MPC + 24 h time-lock & sub-second \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{Three-tier custody overview.}
|
|
\label{tab:overview}
|
|
\end{table}
|
|
|
|
All three tiers use threshold ECDSA over secp256k1 (CGGMP21
|
|
\cite{cggmp21}) so that Bitcoin and Ethereum see a single canonical
|
|
signature on every transaction. The custody policy is invisible to
|
|
the chain.
|
|
|
|
\subsection{Properties Achieved}
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item \textbf{No single point of failure.} No custodian, cloud
|
|
provider, jurisdiction, ops team, or HSM vendor can unilaterally move
|
|
assets. The minimum collusion required is three independent parties
|
|
(cold) or two independent parties (warm/hot), and even then only after
|
|
hardware-attested policy approval.
|
|
|
|
\item \textbf{No on-chain custody footprint.} Threshold signing emits
|
|
single canonical signatures on Bitcoin (P2WPKH) and Ethereum
|
|
(secp256k1 ECDSA). The wallet is indistinguishable from a single-key
|
|
wallet on chain. No Gnosis Safe, no P2WSH multisig, no policy
|
|
disclosure.
|
|
|
|
\item \textbf{Geographic redundancy.} The five cold-tier shares are
|
|
distributed across three continents and at least four legal
|
|
jurisdictions; loss of any two physical sites still permits signing.
|
|
|
|
\item \textbf{Vendor-diverse hardware.} Five distinct HSM vendor lines
|
|
(Thales, Utimaco, Marvell-via-AWS, Marvell-via-GCP, Yubico) so that
|
|
any single firmware vulnerability, supply-chain attack, or vendor
|
|
insolvency reduces availability but never authority.
|
|
|
|
\item \textbf{Post-quantum hedge.} Lux Triple Consensus (LP-020
|
|
\cite{lp020}) layers BLS, Pulsar (lattice), and ML-DSA (lattice)
|
|
on the chain layer; the custody chain (M-Chain, LP-006 \cite{lp006})
|
|
records all signing approvals such that an adversary breaking ECDSA
|
|
in 2030+ cannot rewrite custody history.
|
|
|
|
\item \textbf{Audit-ready compliance.} The construction maps directly
|
|
to SOC 2 Type II, ISO 27001:2022, CCSS Level 3, FIPS 140-2 Level 3
|
|
(Level 4 physical on Utimaco), MiCA, MAS PSN02, and NYDFS BitLicense
|
|
or OCC trust charter requirements (depending on domicile).
|
|
|
|
\item \textbf{Operationally cheap.} All-in cost approximately 1.5--2
|
|
basis points of AUM annually, against a typical institutional
|
|
custody charge of 5--12 bps from incumbents.
|
|
\end{enumerate}
|
|
|
|
\subsection{What This Document Is Not}
|
|
|
|
This is not a sales document and not a marketing comparison. It is
|
|
a reference architecture: every threshold parameter, HSM choice,
|
|
and ceremony procedure is specified so that an external auditor can
|
|
verify implementation against the design. Where vendor pricing is
|
|
public it is cited; where pricing is confidential the figure is given
|
|
as an industry-typical estimate with that caveat.
|
|
|
|
%% =====================================================================
|