Skip to content
orangecheck
Get started

Custody

OrangeCheck holds every role during bring-up, custodian included.

On purpose: the system is proved before anyone else takes a role in it. Each row is read live, with what replaces it and what flips it.

Who holds what, today

  • Your sign-in key
    Held byYou, with a bitcoin wallet · OrangeCheck, with email
    Replaced byYour own wallet, when you sign in with a wallet that signs BIP-322
  • Your accrued balance
    Held byOrangeCheckNothing has accrued yet · no event bills for real
    Replaced byA federation of independent guardians, then your own keys, when a federation can be joined and the rail settles into it
  • The paying rail
    Held byNobody yetNo sats can move
    Replaced byThe federation's own Lightning gateway, when a federation runs its own gateway
  • The key that signs settlements
    Held byOrangeCheck's executor
    Replaced byA federation's guardian threshold, when settlement moves to a Fedimint federation
  • Guardian seats
    Held byNo guardian seats yet
    Replaced byIndependent operators, in more than one jurisdiction, when a seat's operator key belongs to someone else
  • Envelope signing
    Held byOrangeCheck, always
    Replaced byStays with OrangeCheck — the signature is what you check; a project may co-sign beside it

What you can check yourself

Fetch any envelope's signed bytes and check its signature, with no help from us. See one checked.

A valid envelope proves a site recorded that it owes you an amount, and that orangecheck signed the record. It is not a claim on funds, and there is no solvency proof yet.

OC Testnet (bootstrap): every criterion it has to meet

Custody posture, not live yet

OC Testnet (bootstrap) · live for settlement · nothing to join · no real sats move until the rail settles

Bootstrap

OC-operated custody during bring-up. OrangeCheck holds the seats, and the balance, until independent operators take them.

Any single operator can currently move funds. This is custody, not self-custody, and there is no sweep out of it yet — graduation opens when a federation is bound and settling. Signing in with your own Bitcoin key is self-custody of your KEY today; it does not move your accrued sats.

OrangeCheck operates the guardian seats during bring-up. Treat this as custody operated by OrangeCheck.

Threshold
1-of-1
Distinct operator keys
0
Smallest colluding set
0
Trust anchor
OrangeCheck (bootstrap operator)

Every criterion, derived from the seat roster and the signed charter.

  • ≥4 guardian seats filled (verified)0/1 seats populated; production BFT floor is 4 (tolerates 1 fault). §1.1
  • threshold is a true majority (verified)1-of-1: 1 > ⌊1/2⌋ = 0. §1.2
  • every seat a distinct operator key (declared)0 distinct key(s) across 0 seat(s) — a count of the roster, not a proof of who holds them. 0/0 seat(s) have proved possession. §1.3/§1A
  • charter hash published (verified)no valid 64-hex charter_hash on the row yet. §1.4
  • charter ratified by the guardians (verified)0/1 operator signature(s) match the current charter hash. §1.4
  • Lightning gateway run by a non-OC party (tracked by hand)the Lightning gateway is OC-provisioned today — honestly unmet. §1.5
  • OrangeCheck holds zero seats (declared)Assumed OC-operated during bring-up. No seat has produced evidence of an independent operator, and the absence of an OC hosting record is not evidence of independence. §1.6
  • distinct legal entities, ≥3 jurisdictions (attested)no signed operator-independence attestation yet. §1.3
  • on-chain exit clause in the charter (verified)no charter to carry the exit clause yet. §1.7
  • ongoing attestation is fresh (verified)no independence attestation to age. §1A

Guardian membership is fixed once keys are generated. Going further means a new federation, a fresh ceremony and moving users to it, not an upgrade in place.

What orangecheck stores is on Security. The mechanics are on How it works. The protocol is at docs.ochk.io/me/custody.

Where this goes

From us, to a federation, to you.

Graduation to your own keys is not live: no federation is bound yet.

  1. Now

    orangecheck holds it

    While the system is proved, orangecheck runs every role and holds what you earn.

  2. Next

    A federation holds it

    Independent guardians take the balance, so no single party, orangecheck included, can move it alone.

  3. Then

    You hold it

    It moves into keys you hold yourself.