In part 4 of DeFi Explained we try to make sense of self-custody: How it lowers risks and how you can distinguish custody from self-custody.
Smart contracts have a curious, unique feature. Unlike traditional businesses, smart contract based applications (DApps) let you store your funds while letting you keep full control.
This self-custody (sometimes non-custody) simply means that no third party can take your funds, be it a hacker or the actual custodian, while the smart contract can still use your funds for lending, exchanges etc. Self-custody is therefore also perceived as making applications ‘more decentralized’.
Let’s take a step back and try to understand what self-custody means. We want to start right at the beginning - with wallets and private keys - and then dive deeper into smart contracts. (Check out our articles with context on Synthetic Tokens or Margin Trading.)
Self-custodial wallets
To use blockchain applications you need wallets, some of which hold funds for you (i.e. in custody) and some of which are a tool for you to hold and control your funds yourself (i.e. self-custody).
Self-custodial wallets come in all forms: desktop wallets, mobile wallets, hardware wallets.
Custodial wallets mostly have an email login to an interface with a third-party custodian that holds your tokens for you. Just like with online banking.
With wallets, self-custody is simple. Self-custody is like putting cash under your pillow while custody is like a bank account.
Only that, instead of cash, you’d put a 12-word Mnemonic under your pillow.
Note that due to ERC20’s approve function, having tokens shown in your non-custodial wallet might still mean that smart contracts can control them. If curious, read more about that topic in our blog post here.
In the end, some people choose to hold their tokens at a ‘bank’-like third party. Mostly for convenience. Some prefer to take care of their own security and hold tokens in self-custody.
Self-custody in DApps
We saw that wallets are either a custodian or a tool for self-custody. With DApps it’s a little bit more different, but not too much so.
DApps are basically applications built on smart contracts with various functions. While lending DApps - for example - need your funds to be stored in a smart contract, other kinds of DApps simply allow for the exchange of funds.
Therefore, we define the following 3 kinds of DApps with respect to custody.
- DApps that do not hold any tokens: e.g. atomic token swaps
- DApps that hold tokens and have admin or update functionality: e.g. some DEXs such as
- DApps that hold tokens while allowing for self-custody: e.g. Uniswap
Let’s look at our 3 categories from above and explain how self-custody matters for each one.
The first case, i.e. DApps that use tokens but don’t hold tokens, are interesting by themselves.
Let's take for example 0x Project’s exchange contract (see) that provides ‘atomic’ token swaps. Atomicity in this case means that a trade either goes through - and both sides receive the tokens - or the trade fails for both sides - and no token has left either wallet. No custody is needed. No third party involved.
Now, some DApp use cases demand holding funds in a smart contract. That might be exchanges, lending protocols or simply smart contract wallets.
Custodian and self-custody smart contracts are mostly the same, except for one functionality: Admin keys. Admin keys might be able to update different parameters such as interest rates up to fully take control of user funds.
As admin keys are an easy way to - also in an emergency - change critical functions and parameters, some projects use timelocks and multi-signature wallets to lower risks of the custodianship.
Ultimately though, having no admin keys is the only way to make a smart contract - and therefore DApp - fully self-custodial for the user.
Or as one StackExchange user puts it: If it were possible [to change a value in a smart contract,] nobody would trust smart contracts.
As with wallets, self-custody in a smart contract makes for a more secure DApp.
Smart contracts have a lot of risks, such as financial and code risks (see). Self-custody means one attack vector less.
Summary
A huge benefit of smart contract based applications (DApps) is that applications are able to allow users self-custody of funds. Self-custody means that ultimately, only the users are able to move the funds.
A simple example is ERC20 tokens. The standard ERC20 token contract has no functionality to be updated by an admin. Instead, the user who holds a specific token, will be able to decide when and how to move it. At any time.
An example of a real application is Uniswap whose smart contracts (see) have an administrator. Funds that a user puts into a Uniswap pool stay there until the user decides to take it out.
Self-custody is a curious phenomenon that makes computer programs into pieces of infrastructure that simply do what you tell them.