Cuvex Sovereign Authorization / Architecture
A separate trust domain
above digital-asset custody.
Custody and authorization are different security domains.
Reference architecture
01 · Custody Domain
Wallets · MPC/HSM · Asset Keys · Blockchain Signing · Execution
Transaction Proposal
Cuvex Independent Trust Boundary
02 · Connector
Vendor authentication · transaction acquisition · correlation
03 · Normalizer
Vendor representation → canonical transaction intent
04 · PSTT-I
Canonical institutional authorization object
05 · Offline Policy
Independent verification outside original control plane
06 · Human Verification
Asset · network · amount · destination · policy · quorum
07 · Cryptographic Authorization
Independent authorization evidence
Return to Custody Domain
08 · Custodian Continues
Native blockchain signing · execution
FIREBLOCKS-FIRST.
VENDOR-NEUTRAL BY DESIGN
OFFLINE HUMAN VERIFICATION
CRYPTOGRAPHIC TRANSACTION BINDING
Architectural lesson · BYBIT 2025
Key security ≠ authorization context security.
The incident demonstrates why a cold wallet, multisig, and legitimate signers do not necessarily eliminate the risk that the context under which a transaction is authorized may be compromised.
Verify the intent again, outside the original control plane.
Security objectives
01
Transaction binding
Authorization(A) cannot authorize Transaction(B).
02
Independent verification
Reconstruct the effective operation outside the source system.
03
Human-verifiable intent
Display the economic effect rather than an abstract identifier.
04
Mandatory enforcement
Protected workflows require the configured Cuvex quorum.
05
Fail closed
A protected operation cannot silently downgrade.
06
Fail closed
Verify cryptographic evidence, not only a database status.
Threat model
Assume the online
environment can fail.
COMPONENT
ASSUMPTION
REQUIRED PROPERTY
Operator workstation
Potentially compromised
Cannot silently redefine authorized intent
Gateway
Potentially compromised
Cannot forge offline authorization
Coordinator
Untrusted courier
Transport only
USB / file transport
Untrusted
Independent validation
Vendor metadata
Untrusted until validated
Derive the actual operation
Layer 01 · Connector
The Connector knows the custodian. The Cuvex Core does not.
authenticate()
fetch_transaction() verify_vendor_source() obtain_transaction_data()
normalize()
correlate()
submit_authorization()
submit_rejection()
get_execution_status()
Layer 02 · Normalization
Do not trust the label.
Derive the effect.
UNTRUSTED DESCRIPTION
"Send 10M USDC
to Treasury B"
DERIVED INTENT
chain_id
token_contract
source
destination
amount
nonce
calldata
operation_type
Vendor-neutral by design
YOUR FINAL AUTHORITY SHOULD NOT BE TIED TO YOUR CUSTODIAN.
Layer 03 · PSTT-I
One canonical authorization language.
Layer 03 · PSTT-I
One canonical authorization language.
Conceptual object model
Bind what
matters.
header
authorization_id
institution_id
environment
created_at
expires_at
security_epoch
subject
operation_type
chain_id
asset_contract
source
destination
amount
calldata_hash
vendor_binding
vendor_id
external_transaction_id vendor_payload_hash
policy_context
policy_id
policy_version
policy_hash
required_quorum
required_roles
Display commitment
What you see
is what you authorize.
Machine intent and human display must describe the same critical operation.
Online policy
Should this operation require Cuvex?
IF amount >
5M REQUIRE CUVEX
Offline policy
Is this device allowed to authorize it?
chain == ETHEREUMasset == APPROVED_USDCamount <= 20Msecurity_epoch >= 10role == TREASURY
Cryptographic separation
Two domains.
Two keys.
Two responsibilities.
AUTHORIZATION DOMAIN
Cuvex institutional credential
ML-DSA-65 architecture target.
ASSET DOMAIN
Custodian MPC / HSM
Blockchain-native transaction signing.
Physical trust boundary
Cuvex BIT.
Sin hardware Bluetooth ni NFC. USB-C funciona como puente de archivos. No existe una sesión operativa en vivo App - Device.
​
Transport = untrusted courier.
Offline device pipeline
Receive untrusted request
Strict decode + schema validation
Recompute authorization ID
Verify vendor binding
Recompute display commitment
Apply offline policy
Render trusted intent
Physical human confirmation
Generate cryptographic authorization
Secure wipe
Segregation of duties
Authorization quorum.
Not blockchain multisig.
AUTHORIZERS
CFO
CISO
TREASURY
POLICY A
2 OF 3
POLICY B
1 TREASURY
+
1 SECURITY
ALL AUTHORIZE THE SAME
authorization_id
Fireblocks reference integration
Fireblocks-first.
Not Fireblocks-dependent.
Fireblocks reference integration
Fireblocks-first.
Not Fireblocks-dependent.
Deployment transparency
Fireblocks-first.
Not Fireblocks-dependent.
Level 0
Observe
Authorization(A) cannot authorize Transaction(B).
Level 1
Customer Gate
Reconstruct the effective operation outside the source system.
Level 2
Custodian Native Gate
Display the economic effect rather than an abstract identifier.
Level 3
Defense in Depth
Custodian Gate + Cuvex + on-chain restrictions.
Failure semantics
Fail closed.
IF policy == CUVEX_REQUIRED
​
AND valid_quorum == FALSE
​
THEN
​
PROTECTED_EXECUTION = BLOCKED
PoC security requirements
Don't demonstrate features.
Demonstrate failure resistance.
ATTACK
MUTATION
EXPECTED RESULT
Destination substitution
A → B
Original authorization invalid
Amount substitution
1M → 10M
New authorization required
Vendor transaction reuse
Tx A → Tx B
Vendor binding mismatch
Replay
Completed bundle reused
Reject
Duplicate signer
Same credential twice
Quorum not reached
Missing quorum
1 of required 2
No protected execution
Design rules
-
Assume the host can lie.
-
Assume transport is compromised.
-
Recompute what matters.
-
Display the actual intent.
-
Bind the authorization.
-
Fail closed.