Authority & custody matrix

Version 1.0.0.

Cofferline is non-custodial of your wallet and its keys: it never holds the owner key of, or takes custody of, your connected smart account, and it executes only within an owner-signed, expiring, on-chain-revocable delegation.

Some product modes have separately enumerated exceptions where the platform DOES hold funds or authority — prepaid fee balances are platform-held USDC, and a hosted Polymarket signer is held authority over your funder Safe. For every transaction surface this page states what Cofferline holds, what that authority allows, the maximum exposure, and how you revoke it. It is also served machine-readably at /legal/custody.json.

Wallet sign-in (SIWE identity)

• Cofferline holds: Nothing that moves value. A SHA-256 hash of each session/API-key token; the wallet signature itself is verified and discarded.
• Authority it confers: Proves identity for API access. Moves no funds and signs no transaction.
• Bound by: cryptographic / venue-scoped
• Maximum exposure: API access as you, until keys are revoked — no ability to move funds or sign on-chain.
• You keep custody of: Your wallet and its keys.
• How you take it back: Revoke the API keys it minted (DELETE /v1/keys/{id}); sessions expire on their own (24h). No on-chain step, no Cofferline cooperation needed.
• Third-party / venue custody: None.
• On suspension / termination: Sessions and keys are revocable/expiring; no funds are implicated.

Session-key delegation (core treasury: conversions, gas top-ups)

• Cofferline holds: The executor signing key (generated and held inside a hardware TEE at a key-management service — never in application compute). It can act ONLY inside a session key installed on YOUR own ERC-4337 (Kernel) smart account.
• Authority it confers: Execute an owner-allowlisted set of (target, selector) calls with a per-call native-value cap, a hard expiry (≤90 days), and an optional op-count rate limit. Funds stay in your account throughout.
• Bound by: cryptographic / venue-scoped
• Maximum exposure: Bounded on-chain by the account's CallPolicy AND a signer-side policy: worst case is a swap through an allowlisted venue router with hostile calldata, capped per swap by the approve cap (USD-stables) or the token balance (non-stables), and cumulatively by the grant's rate limit where set, else by expiry and your revocation. transfer is never granted; an approve to a non-venue spender fails in the account itself.
• You keep custody of: Your smart account, its owner key, and all funds in it.
• How you take it back: Revoke the delegation on-chain from your owner key at any time — it is your own transaction and NEVER requires Cofferline's cooperation.
• Third-party / venue custody: Venues (CoW Protocol, ParaSwap) execute the swap; a TEE key-management service holds the executor key.
• On suspension / termination: Suspension/termination stops Cofferline from acting; your delegation and funds are untouched and you revoke on-chain independently.

Direct x402 fee (EIP-3009 exact-amount USDC payment)

• Cofferline holds: After settlement, the paid USDC lands in the treasury EOA (EXECUTOR_ADDRESS). This is a fee paid TO the platform, not custody of your wallet.
• Authority it confers: Move exactly the signed amount, once, to the treasury payTo address. The authorization is single-use (nonce) and exact-value.
• Bound by: cryptographic / venue-scoped
• Maximum exposure: The one exact amount you signed for. A replay cannot double-charge (nonce).
• You keep custody of: Your wallet; you choose each amount and each signature.
• How you take it back: Sign cancelAuthorization on-chain before it settles — unilateral, no Cofferline permission needed.
• Third-party / venue custody: None beyond the USDC contract and the chain.
• On suspension / termination: A settled fee is a completed payment; unsettled authorizations you can cancel.

Prepaid balance (platform-held service deposit)

• Cofferline holds: REAL USDC. A top-up settles on-chain into the treasury EOA (EXECUTOR_ADDRESS) FIRST, then credits an internal balance. That internal balance is a service credit the platform administers — platform-held funds, not a segregated custody account. There is no omnibus account over your wallet and no sweep path, but the prepaid float itself is money the platform holds.
• Authority it confers: Debit your internal balance for metered fees at the published pricing.
• Bound by: application policy only
• Maximum exposure: The prepaid balance you have funded. It is spent only on your own metered usage; it cannot be moved to a third party.
• You keep custody of: A claim to the service credit (refund/redemption terms are stated in the Terms).
• How you take it back: Stop topping up. You do not pre-authorize the platform to pull more than each signed top-up; disposition of a remaining balance on termination is governed by the Terms.
• Third-party / venue custody: None; funds sit in the platform treasury.
• On suspension / termination: Remaining prepaid balance is handled per the Terms' termination clause. It is platform-held throughout, so recovering it depends on the platform, not an on-chain revocation.

Auto-topup authorizations (pre-signed bearer arrows)

• Cofferline holds: A set of fixed-value, fixed-recipient (the treasury) EIP-3009 signatures, each usable exactly once, with its own expiry.
• Authority it confers: When your balance drops below your threshold, settle the next pre-signed authorization to pull that fixed amount of your USDC into the treasury. Capped at a per-calendar-month maximum (default 10).
• Bound by: mixed (per-item cryptographic, timing app-controlled)
• Maximum exposure: The sum of the outstanding authorizations you pre-signed, bounded by their per-arrow value and expiry and the monthly cap. Each arrow can only ever move payer USDC to the treasury — it is a payment instrument, not custody.
• You keep custody of: Your wallet; you pre-sign each arrow and control cancellation on-chain.
• How you take it back: Cancel any outstanding nonce on-chain via cancelAuthorization (unilateral). NOTE: DELETE /v1/balance/auto-topup removes the stored authorizations from Cofferline but does NOT revoke them cryptographically — the response returns the exact CancelAuthorization calldata for each outstanding nonce, which you submit on-chain.
• Third-party / venue custody: None beyond the USDC contract and the chain.
• On suspension / termination: Stored arrows are deleted on rule removal; any already broadcast is a completed payment. Cancel unspent nonces on-chain to be certain they can never settle.

Transaction coordinator (sealed signed-transaction envelope)

• Cofferline holds: An AEAD-sealed envelope of an already-SIGNED transaction (encrypted at rest like the venue credential, compacted to a hash tombstone after the audit window). Sealed because a signed-but-unconfirmed transaction is broadcastable by anyone.
• Authority it confers: Rebroadcast that EXACT signed transaction for its one authorized effect. It cannot be altered to authorize any different effect — the signature commits to the exact call.
• Bound by: cryptographic / venue-scoped
• Maximum exposure: Exactly the one effect the transaction was already signed for. The envelope confers no ability to sign anything new.
• You keep custody of: The account the transaction acts on; the effect is one you (or your delegation) already authorized.
• How you take it back: Standard on-chain means for a pending transaction (e.g. nonce replacement) apply; the effect is bounded to what was signed.
• Third-party / venue custody: The chain.
• On suspension / termination: Envelopes are tombstoned to a hash after the audit window.

Polymarket hosted credential (held authority — the weakest bound)

• Cofferline holds: A sealed (AES-256-GCM, tenant+venue-bound AAD) trade-signer key that, by Polymarket's own wallet model, is the 1-of-1 OWNER of your funder Safe. Write-only — no endpoint returns it — in the single venue_credentials table.
• Authority it confers: Cofferline confines its use to orders, authenticated reads, and collateral wrap — but that confinement is APPLICATION POLICY, not a cryptographic bound. The key itself can sign execTransaction against the funder Safe for anything: transfers, approvals, owner changes.
• Bound by: application policy only
• Maximum exposure: Full control of that ONE funder Safe, bounded only by what it holds, IF the sealed store is compromised (database AND sealing key together). This is disclosed, accepted trust model parity with every Polymarket integrator — mitigated by a dedicated funder, per-use audit + volume alerting, and rotation.
• You keep custody of: Your funder Safe and its collateral (until a compromise) — and always the ability to rotate its owner yourself.
• How you take it back: Revoke via API (zeroes the ciphertext — helps before theft, never after). Rotate the signer with the swapOwner calldata from GET /v1/pm/credentials/{id}/rotation, which YOU execute from your funder Safe — Cofferline can never submit it. Keep only working trading balances in a dedicated funder.
• Third-party / venue custody: Polymarket / the funder Safe on Polygon.
• On suspension / termination: Revocation zeroes the material. An already-exfiltrated key is out of Cofferline's control — rotate the Safe owner to be safe. Order transmission is dev-gated in production.

Polymarket funder collateral

• Cofferline holds: Nothing directly — collateral stays in your own funder Safe. But note the Polymarket signer above IS that Safe's owner key, so the held-authority exposure of that row reaches this collateral.
• Authority it confers: None on the collateral directly; only via the funder Safe's owner signer (the row above).
• Bound by: application policy only
• Maximum exposure: As per the Polymarket hosted credential row — full Safe control on a store compromise.
• You keep custody of: The funder Safe and its collateral.
• How you take it back: Rotate the Safe owner (see the Polymarket credential row); move balances to a fresh funder.
• Third-party / venue custody: Polymarket / the funder Safe on Polygon.
• On suspension / termination: Collateral is yours in your Safe; rotate the owner if a credential was ever held.

Platform treasury / relay EOA (Cofferline's own funds)

• Cofferline holds: The treasury/executor EOA (EXECUTOR_ADDRESS) and the platform's own funds in it. It receives x402 fees and prepaid deposits, pays gas, and relays collateral wraps and payment settlement. The signing key is TEE-held at a key-management service and policy-locked to exactly those shapes.
• Authority it confers: Spend the platform's OWN funds and relay the allowlisted transaction shapes. It CANNOT move funds out of your accounts — no signature exists that would let it, and the on-chain session-key scope plus the signer-side policy reject anything else.
• Bound by: cryptographic / venue-scoped
• Maximum exposure: This is custody — of the PLATFORM'S own treasury, not of your wallet. Your delegated accounts and funder Safes are outside its reach.
• You keep custody of: Your own wallet/accounts — this row is platform-owned funds, not yours.
• How you take it back: Not applicable — these are the platform's funds. Your protection is that the treasury key has no authority over your accounts.
• Third-party / venue custody: A TEE key-management service (holds the key); the chain.
• On suspension / termination: Platform-internal.

This matrix is part of, and consistent with, the Terms.