Stabledash Live · Oct 5 · 47 min

Should You Trust Code or Institutions With Your Money?

With Nassim Eddequiouaq

Key takeaways

Stepan Simkin says Squads Multisig secures billions in value and moves billions of stablecoins through its infrastructure every month.
Nassim Eddequiouaq of Bastion argues that non-custodial wallets carry much the same trust risks as a regulated custodian, because users still trust developers, firmware and cloud credentials.
Simkin says a license would not have stopped the Paylink bridge exploit and calls for building better systems, while saying both custody models need to coexist.

Watch the episode

0:00Founders of Bastion and Squads introduce themselves1 of 11

Summary

The founders of Squads and Bastion disagree on whether immutable code or legal liability protects user assets better, though both say the two models should exist side by side.

Stepan Simkin, co-founder and CEO of Squads, says its Squads Multisig product secures billions in value and moves billions of stablecoins every month. He debated Nassim Eddequiouaq, founder of Bastion, on whether regulated custody or self-custody should hold users' money.

Two models of custody

Bastion offers regulated stablecoin infrastructure for enterprises, and Eddequiouaq says it serves Sony through Sony Bank. Squads started in 2021 building programmable, self-custodial financial account infrastructure for Solana. Simkin says that about a year ago it began building Altitude, a global operating account for businesses that connects to local payment rails and issues corporate cards. He thanked Stabledash for being a customer.

“The worst security is the the security that no one uses because it's it has too much friction.”

Nassim Eddequiouaq

Non-custodial is not trustless

Nassim Eddequiouaq argues that users of non-custodial wallets "still trust wallet developers," hardware makers, firmware, smart contracts and the developers' AWS credentials. Possessing access, he says, does not guarantee exclusive control over assets. He pointed to a past wallet logging flaw in which credentials were pushed to an off-chain server, leading to hacks of self-custodial wallet users. If trust is modeled deeply enough, he says, the guarantees come out the same as with a regulated custodian.

Immutable code, open interfaces

Stepan Simkin says the two programs behind Squads Multisig are immutable, with no admin functions on-chain, and can be used through the main UI, a local interface or UIs hosted by other providers. He expects the test for self-custody to become the ability to export keys and access assets no matter what happens with the front end. He adds that smart contract exploits happened every month back in '21, and attackers are now moving up the stack toward credentials and employees.

Liability as an incentive

Bastion has obtained OCC conditional approval for a trust bank, which Eddequiouaq says means fully segregated client assets and a fiduciary duty that makes the company legally liable. He argues that this incentive structure makes secure operations more likely. He also says each layer of abstraction between users and the cryptography adds counterparty risk.

The bridge exploit

Host Drew Rogers raised the exploit of Paylink's bridge contract on Ethereum. Eddequiouaq described bridges as counterparties in the flow of funds. Simkin replied that licenses would not have prevented it, because "a bug in a smart contract is a bug in a smart contract," and said no regulator will oversee a team's operational security for it.

Simkin expects hacks to keep happening but says each one improves the systems, and that over the last five years crypto has been regulating itself by developing standards. Even so, he says both models need to exist side by side because every approach has trade-offs.

Altitude, Luca, Paylink, and Coinbase come up most.

Ask AI about this conversation

More from Stabledash Live

Get the lineup before every live show, plus the newsletter’s short reads.