Signing Authority Is the Real Custody Layer

Custody in DeFi is usually discussed as a question of where assets sit. The larger custody question is authority: who can move funds, who can upgrade contracts, and who can pause markets. A protocol can hold strong technical safeguards and still carry unresolved custody risk if the signing path is unclear.

Two questions frame the whole subject, and the distance between them separates a basic reading from a real analysis. The first is who holds the keys. The second is what those keys can authorise.

Multisigs are where most reviews stop. They are genuinely valuable — shared authorisation reduces single-signer dependency — but a multisig is one part of the custody model, not the model itself. Are the signers actually independent? How are the keys stored? Which contracts can that multisig reach? The custody question starts with the multisig. It does not end there.

Timelocks add the temporal dimension: where a multisig governs who approves, a timelock governs when approval can become execution, creating a reaction window before a sensitive action goes live. Their value is entirely a function of implementation — which actions actually route through them, who can queue and execute, and whether anyone is monitoring the queue at all. A timelock nobody watches is a delay, not a control.

Signatures prove intent, not safety. A signature authorises a message, so the next question is always the message: typed data, a permit, an offchain authorisation? A strong hash protects the message that was actually signed, and nothing more. Cryptography proves integrity; continuity review asks whether the authorised action was bounded, reviewable, and tied to the right custody domain.

That word — domain — carries the argument. A protocol contains many: the treasury Safe, the emergency pause authority, the oracle updater, the bridge operator, the governance timelock. Each has its own authority and its own blast radius, and the risk compounds where one domain appears across several critical paths at once. A single Safe that controls treasury, upgrades, oracle configuration, and emergency pause is not four controls; it is one control wearing four labels. This is why a project map matters, and why it has to show where authority repeats and where control paths converge rather than simply listing contracts.

The article extends the same logic through the signing interface — a signer with excellent key custody can still approve a dangerous action if the transaction builder presented incomplete context — through modules, guards, session keys, relayers, and keepers as alternate execution routes, and through cross-chain systems, where an action may be authorised on one chain and executed on another.

It closes on the distinction between observable and evidential authority. A public call can confirm a specific fact; operating evidence explains the control behind it. The full text is on Paragraph.