How to Evaluate Dual-Control MPC Custody and Verifiable Attestations

Separate transaction control from balance verification

Corporate custody due diligence must answer two different questions: who can move the assets, and how can finance verify that the assets exist? MPC can distribute cryptographic signing authority, but it does not automatically create dual approval between independent employees. Similarly, an onchain wallet balance proves that tokens were present at an address; it does not by itself prove ownership, customer allocation, unencumbered status or complete liabilities.

The evidence required depends on the custody model. A company using its own MPC vault can usually reconcile known wallet addresses directly. A company using omnibus custody must rely more heavily on the provider’s internal ledger, liability reporting and independent assurance.

Document the model by legal entity, product and network. A provider may use segregated addresses for one asset but omnibus wallets for another. Marketing terms such as “institutional custody” or “MPC wallet” do not resolve those differences.

What dual-control MPC should mean

MPC and dual control operate at different layers. MPC allows multiple key shares to participate in producing a valid blockchain signature without reconstructing the full private key. Dual control is the business requirement that no single person can authorize and complete a sensitive action. A platform can use MPC while still allowing one administrator to initiate, approve or recover a wallet.

Finance should identify both the cryptographic signing threshold and the human approval rule. A 2-of-3 share threshold does not establish dual control if one person controls two shares, or if a privileged administrator can lower the threshold without independent approval.

Test the control rather than the label

• Quorum: Record the number of approvals and signing shares required. Identify who holds each role, device or recovery factor.
• Separation of duties: Determine whether a payment creator can approve the same payment and whether administrators can act as transaction approvers.
• Scope: Check transfers, asset conversions, new destinations, smart-contract interactions, network changes and recovery events.
• Administration: Require equivalent protection for adding users, changing roles, replacing devices and reducing the quorum.
• Continuity: Understand what happens when an approver leaves, loses access or is unavailable at period-end.

Run a controlled test in a non-production environment or with a low-value transaction. Initiate a payment, attempt to release it with insufficient approval, obtain the required approval and export the event history. Repeat the exercise for a role change and a recovery request. The evidence should show the initiator, approvers, timestamps, transaction details, resulting blockchain transaction identifier and rejected actions.

Stablerail applies approvals and signing quorum to corporate USDC and USDT treasury operations and performs sanctions and address screening before send. It also provides exportable audit evidence; finance should still reconcile those records to bank, blockchain and general-ledger data under its own close procedures.

Define what the attestation actually claims

The word attestation is used loosely. It may refer to a provider-signed data record, a proof-of-reserves snapshot or a report issued by an independent accounting practitioner. These are not interchangeable. Due diligence should identify the responsible party, stated criteria, observation time, covered entities and exclusions.

A PDF statement can be useful evidence, but a structured, digitally signed record is easier to verify and reproduce. A credible snapshot should include:

• A unique record identifier and schema or format version.
• The relevant legal entity, customer account, vault or wallet identifier.
• The network, wallet address, token contract, raw quantity and decimal precision.
• The block or slot number, block hash and observation timestamp.
• Any customer liability amount included in the stated coverage calculation.
• Excluded, pledged, borrowed or otherwise encumbered assets.
• The signature algorithm, signing-key identifier and digital signature.
• A reference to the methodology and any independent assurance report.

Historical snapshots matter because a current wallet balance cannot reproduce a prior month-end position. The provider should make previous records available, while finance should retain the signed payload, verification key information, methodology and assurance report used for each close.

How to verify signed reserve data

1. Validate the signature and signing key

Obtain the verification key or certificate through an authenticated channel separate from the signed payload. Confirm the expected owner, fingerprint, validity period, permitted use and revocation process. Reproduce the specified serialization and hash before validating the signature. Reject records with missing required fields, unsupported schema versions, revoked keys or failed signatures.

Key rotation deserves its own test. A new signing key should be announced through an established authenticated channel; a payload cannot establish trust merely by including the new key that signs it.

2. Establish wallet control and attribution

An address and balance do not prove that the reporting entity controls the wallet. One method is a fresh challenge containing a finance-generated nonce, entity identifier and expiry time. The provider signs the challenge using the wallet or completes a specified onchain transaction.

MPC and smart-contract wallets may not support ordinary message signing. In that case, follow a documented method that verifies the wallet contract, authorized signer set or an onchain action. For third-party custody, obtain evidence connecting the controlled addresses to the correct legal entity, not merely to a product name.

3. Recalculate balances independently

Query an independent node or blockchain data source at the stated block or slot. Historical verification may require access to archived state. Validate the token contract or mint address rather than relying on the symbol “USDC” or “USDT,” because unrelated tokens can use the same ticker.

Apply network-specific handling. EVM networks use token contracts and wallet balances, while Solana token accounts and Tron address conventions require different queries. Identify assets held in smart contracts, bridges or pending transactions rather than assuming every balance resides in a standard wallet.

4. Apply a consistent cutoff

Use an exact block or slot, not only a wall-clock time. Confirm that the referenced block remains canonical and satisfies the company’s documented confirmation or finality rule. For period-end reporting, define the cutoff in advance and apply it consistently to onchain assets, in-flight transfers and liabilities. Otherwise, timing differences can create an apparent surplus or shortfall.

Validate liabilities when a third party holds the assets

Proof of reserves demonstrates control of specified assets at a point in time. It does not necessarily establish that all customer obligations were included, that reserves were unencumbered or that the provider could meet obligations outside the snapshot.

A Merkle-tree commitment may let a customer verify that its balance appears in a committed liability dataset without revealing other balances. That is useful inclusion evidence, but it cannot prove that undisclosed accounts were not omitted. Independent procedures should address ledger completeness, negative balances, related-party accounts, off-ledger obligations and reconciliation to the custodian’s books.

Calculate coverage using eligible assets divided by included liabilities at consistent timestamps. Review coverage by asset and legal entity, not only in aggregate. A surplus in another token should not automatically offset a USDC or USDT shortfall unless the methodology, legal rights and treasury policy explicitly permit it.

Treat claims of an “onchain audit” as monitoring unless an independent auditor has issued a report identifying the scope, criteria, period and conclusion. Proof of reserves can strengthen custody oversight, but it is not a substitute for audited financial statements or broader counterparty diligence.

Finance-team diligence checklist

1. Map each legal entity, custody model, network, token contract and wallet type.
2. Demonstrate dual approval for payments, administrative changes and recovery.
3. Confirm that no individual controls enough roles, shares or recovery factors to bypass the quorum.
4. Verify wallet control and legal-entity attribution using a fresh challenge or documented alternative.
5. Recalculate balances at the reported block using an independent data source.
6. Test liability completeness, encumbrances and withdrawal rights for third-party custody.
7. Retain signed snapshots, key records, audit logs, assurance reports and reconciliation workpapers.
8. Repeat the assessment after material product, signer, wallet, methodology or legal-entity changes.

The final decision should reflect both control design and reproducible evidence. A strong custody arrangement prevents unilateral movement through normal and emergency paths, while a strong verification process lets finance independently reconstruct what was held, where it was held and what obligations those assets were expected to cover.