papers/lux-threshold-ux/sections/06-treasury-management.tex

\section{Treasury Management}
\label{sec:treasury}

Multi-party spend authorization is the most natural application of
threshold signatures. The product framing: ``Payments above \$X require
approval from Y of Z signers.''

\subsection{Tiered Spend Policies}

\begin{definition}[Tiered Spend Policy]
A tiered spend policy $\mathcal{T} = \{(\ell_1, t_1), (\ell_2, t_2), \ldots, (\ell_k, t_k)\}$
defines spending tiers where $\ell_i$ is the maximum transaction amount for
tier $i$ and $t_i$ is the required approval threshold. Tiers are ordered:
$\ell_1 < \ell_2 < \cdots < \ell_k$ and $t_1 \leq t_2 \leq \cdots \leq t_k$.
\end{definition}

A typical configuration for a startup:

\begin{table}[H]
\centering
\caption{Example tiered spend policy for a three-person founding team.}
\label{tab:tiers}
\begin{tabular}{lrl}
\toprule
\textbf{Tier} & \textbf{Amount} & \textbf{Approval} \\
\midrule
Petty cash & $\leq$ \$500 & 1 of 3 (any founder) \\
Operating expense & $\leq$ \$10,000 & 2 of 3 \\
Capital expenditure & $\leq$ \$100,000 & 3 of 3 \\
Extraordinary & $>$ \$100,000 & 3 of 3 + 24h time lock \\
\bottomrule
\end{tabular}
\end{table}

The user sees a payment approval screen: ``This payment of \$15,000 requires
approval from 2 of 3 signers. Alice has approved. Waiting for Bob or Carol.''
They do not see FROST partial signatures or Lagrange interpolation.

\subsection{Time Locks and Velocity Limits}

High-value actions include additional safeguards:

\begin{enumerate}
    \item \textbf{Time lock.} After $t$ approvals are collected, execution
    is delayed by $\Delta t_{\text{lock}}$ (e.g., 24 hours). During this
    window, any signer can veto, canceling the transaction. This prevents
    compromised signers from executing irreversible transactions before
    the compromise is detected.

    \item \textbf{Velocity limit.} Total spend within a rolling window $W$
    is capped at $V_{\max}$:
    \begin{equation}
        \sum_{\substack{tx \in \text{window}(t, W)}} \mathsf{amount}(tx) \leq V_{\max}
    \end{equation}
    If the limit is reached, all further transactions require the highest
    approval tier regardless of individual transaction size.
\end{enumerate}

\begin{proposition}[Time Lock Defense Against Key Compromise]
If an adversary compromises $t$ signer keys at time $t_0$, the time lock
ensures that no unauthorized transaction executes before $t_0 + \Delta t_{\text{lock}}$.
If any honest signer detects the compromise within $\Delta t_{\text{lock}}$
and exercises their veto, the adversary gains nothing. The expected loss
under key compromise is therefore:
\begin{equation}
    \mathbb{E}[\text{loss}] = V_{\max} \cdot \Pr[\text{no honest signer detects within } \Delta t_{\text{lock}}]
\end{equation}
For $\Delta t_{\text{lock}} = 24\text{h}$ and $n - t \geq 1$ honest signers
with continuous monitoring, $\Pr[\text{no detection}] \to 0$.
\end{proposition}