Wallet architectureWallet Architecture
Mullet's custody follows three principles — separated cold / warm / hot tiers, multi-signature thresholds and on-chain verifiability. This page walks through where user funds flow from deposit to withdrawal, and why we think this design strikes a reasonable balance between a CEX and a DEX.
Mullet's custody follows three principles: separated cold / warm / hot tiers, multi-signature thresholds and on-chain verifiability. This page walks through where user funds flow from deposit to withdrawal, and why we think this design strikes a reasonable balance between a CEX and a DEX.
The overall architecture
Mullet's wallet system has three tiers — hot (2%) · warm (6%) · cold (92%). The vast majority of funds sit offline in cold storage, with only a small hot balance kept for day-to-day transfers.
The hot tier
The hot wallet is the only pool connected to Mullet's backend in real time. It handles day-to-day deposits and withdrawals and margin scheduling for the off-chain execution system.
- Size: no more than 2% of assets under management
- Scheduling: automated, with any single withdrawal above $100K triggering manual review
- Encryption: private keys are stored AES-256 encrypted with keys held in AWS KMS, and signing happens inside an Intel SGX enclave
- Monitoring: any outflow above 100K USDC requires manual confirmation by the SOC team
- Circuit breaker: an abnormal outflow rate pauses the hot wallet automatically, and unlocking requires a human
The warm tier
The warm wallet buffers between hot and cold. When the hot balance drops below its threshold, the warm tier tops it up on a schedule.
- Size: 6% of AUM
- Multi-sig: 2-of-3 threshold
- Time lock: any proposal to move warm funds executes after a minimum 24-hour delay
- Separate signer set: completely different from the hot wallet signers, to prevent collusion
The cold tier
Cold storage is the final vault for Mullet funds, holding 92% of user assets.
- Size: 92% of AUM
- Multi-sig: 3-of-5 threshold plus manual review, with signers spread across three time zones
- Offline signing: signing takes place in a physically air-gapped environment
- 72h time lock: at least 72 hours from proposal to execution, giving the community a window to review
- Geographic backups: key shares (Shamir's Secret Sharing) are stored in three separate locations
Transparency commitment: the cold wallet addresses are fully public and their balances can be checked live on Solscan. Cold wallet movements are published on-chain — anyone can verify them independently with a Solana block explorer.
Segregation of user funds
Mullet keeps three types of account strictly apart:
| Account type | Source of funds | Purpose | Can it be touched? |
|---|---|---|---|
| User custody account | User deposits | Clearing margin / withdrawals | Never drawn on by the platform |
| Platform operations | Fee income | Salaries / servers / marketing | Only the CFO can move it |
| Insurance fund | Clearing fees + retained profit | Backstop in extreme conditions | Only the liquidation engine can trigger it |
All three are completely separate on-chain, with different addresses and different multi-sig structures. Even if Mullet's operating account were compromised, user funds would be untouched.
The self-custody route
If you'd rather Mullet didn't hold your funds, you can switch to wallet-connect mode at any time:
- Withdraw everything to a self-custody wallet such as Phantom or Backpack
- Log out of the email account and log in with your wallet instead
- All trading funds are sent from your wallet directly to the Mullet address
- The margin behind your positions always belongs to your wallet address
The philosophy: the custodial wallet is a convenience layer for people who aren't comfortable managing private keys. We designed the architecture on the assumption that any user might switch to self-custody at any moment, and the whole system has to support that switch without losing any state.