Breaking Watchman: Pushing the Limits on Federated Hot Wallet Security
summary
A federated hot wallet for Liquid uses an 11-of-15 multisig with a long time‑lock emergency backup and processes peg-outs in 15-minute round‑robin rounds where proposals are assembled, checked, HSM‑authorized and broadcast. Deposits are detected via merkle proofs from the sidechain, peg-outs require tracking to avoid double payouts, and a 100‑confirmation policy plus a conflict tracker prevents shallow reorg losses. Implementation exists, exposes many edge cases (malleability, mempool churn, testnet instability), and plans add dynamic membership and stronger HSM roles.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:37Overview
- 1:25Automated Hot Wallet
- 2:28Hot Wallet Architecture
- 3:20Scanning State
- 3:55Special Inputs
- 4:37Special Burn Output
- 5:09Donations
- 5:55Pegout
- 6:21Claim Script
- 6:31Change Address
- 7:35Roundrobin
- 12:07Malleability
- 13:31Testnets
- 14:52Future Work
- 16:32Extra Security
- 17:03HSM
- 17:27Peg Authorization
- 18:37Other ideas
- 19:37Summary
- 20:22Thermite
related talks
34mWallets Working Session
19mThe Last Wallet You'll Ever Open
27mBeyond Self Custody: Building Your Sovereignty Stack
31mPanel 2: Hard things we forget to talk about
14mAdvanced On-chain Security: Multisig & More
19mWhy Multisig is Important – And How to do it Right
27mMulti Vendor Multisig
15mWallets: How Cold It Can Get?