> For the complete documentation index, see [llms.txt](https://docs.bloxchain.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bloxchain.app/platform-bloxchain.app/use-cases/vault.md).

# Vault & custody

**Audience:** Admin · **Time:** \~60 min (testnet)

Hold assets in an Account workspace with **governed withdrawals** — custody without a single hot key that can drain funds.

## What you build

| Piece          | Recommendation                                                           |
| -------------- | ------------------------------------------------------------------------ |
| **Operations** | Withdraw / transfer-out schemas your vault exposes                       |
| **Roles**      | `Custodian Requester`, `Compliance Approver`                             |
| **Workflow**   | Meta request + approve (or **Time-delay** for production cooling period) |
| **Allowlist**  | Approved withdrawal destinations only                                    |

Simpler outbound-only flow: [Treasury & transfers](/platform-bloxchain.app/use-cases/treasury.md).

***

## Prerequisites

* Account workspace from [deploy](/platform-bloxchain.app/contracts/deploy.md) (SimpleVault-style) or [import](/platform-bloxchain.app/contracts/import.md).
* Owner + two operator wallets for request / approve separation.

***

## Step 1 — Security baseline

**Deployment → Security** ([Security settings](/platform-bloxchain.app/overview-1/security-settings.md))

| Setting         | Recommendation                                                                                    |
| --------------- | ------------------------------------------------------------------------------------------------- |
| **Owner**       | Custody admin                                                                                     |
| **Recovery**    | Document holder — test on testnet per [Recovery & incidents](/platform-bloxchain.app/recovery.md) |
| **Timelock**    | Pair with **Time-delay** workflow preset for production withdrawals                               |
| **Broadcaster** | Optional — separate finalize gas from compliance signer                                           |

***

## Step 2 — Register withdrawal operations

**Deployment → Operations → Register** ([Operations](/platform-bloxchain.app/overview-1/operations.md))

Register **only** function schemas your vault contract actually exposes. Examples:

### Native withdrawal (if vault pays ETH out)

| Field                 | Value                                        |
| --------------------- | -------------------------------------------- |
| Operation name        | `Vault Withdraw Native`                      |
| Function signature    | `__bloxchain_native_transfer__()`            |
| Workflow capabilities | **Meta request + approve** or **Time-delay** |

### ERC20 / custom withdraw

| Field                 | Value                                                                         |
| --------------------- | ----------------------------------------------------------------------------- |
| Operation name        | `Vault Withdraw`                                                              |
| Function signature    | Your vault ABI (e.g. `withdraw(address,uint256)` or guarded `execute(bytes)`) |
| Workflow capabilities | **Meta request + approve**                                                    |

**Sign** → **Execute** each registration.

> Internal calls where `target == address(this)` may not need contract-target allowlisting — see [Guard controller](/protocol/guard-controller.md). Token payouts still require **contract targets** for the token address.

***

## Step 3 — Create roles

**Deployment → Roles** ([Roles & members](/platform-bloxchain.app/overview-1/roles-and-members.md))

| Role name             | Purpose                                                                                            |
| --------------------- | -------------------------------------------------------------------------------------------------- |
| `Custodian Requester` | Initiates withdrawal requests                                                                      |
| `Compliance Approver` | Reviews and approves — **not** the same wallet as requester                                        |
| `Read-only Auditor`   | Optional — no request permission; view [History](/platform-bloxchain.app/overview/history.md) only |

Assign wallets under **Members**.

***

## Step 4 — Grant permissions

Per withdrawal operation ([Permissions](/platform-bloxchain.app/overview-1/permissions.md)):

| Role                | Pending Request | Sign and approve request | Finalize approved request |
| ------------------- | :-------------: | :----------------------: | :-----------------------: |
| Custodian Requester |        ✓        |             —            |             —             |
| Compliance Approver |        —        |             ✓            |             ✓             |
| Read-only Auditor   |        —        |             —            |             —             |

Stricter than treasury: never grant **Pending Request** and **Sign and approve request** to the same role in production.

***

## Step 5 — Allowlists

**Allowlists** ([Allowlists](/platform-bloxchain.app/overview-1/allowlists.md))

| List                         | What to add                                           |
| ---------------------------- | ----------------------------------------------------- |
| **Recipients** (native)      | Cold storage, exchange deposit, or treasury EOAs only |
| **Contract targets** (ERC20) | Token contract addresses the vault may send           |

Do not leave lists empty in production — denied by default.

***

## Step 6 — Connect your application

* If a **module contract** submits requests, add its address as a **member** on `Custodian Requester` ([Connect your application](/platform-bloxchain.app/overview-1/connect-your-application.md)).
* Whitelist every token the vault can pay out.
* SDK `contractAddress` = Account workspace tab address.

***

## Step 7 — Test

1. **Custodian** → [Submit request](/platform-bloxchain.app/overview/submit-request.md) — withdrawal to allowlisted address.
2. **Compliance** → [Approve and sign](/platform-bloxchain.app/overview/approve-and-sign.md).
3. Confirm balance change and [History](/platform-bloxchain.app/overview/history.md).
4. Retry with a **non-allowlisted** recipient — expect on-chain rejection.

***

## Checklist

* [ ] Withdraw schemas registered and visible in Operations
* [ ] Requester / approver separation enforced in permissions
* [ ] Withdrawal destinations allowlisted
* [ ] Recovery tested on disposable testnet contract
* [ ] [Account pattern](/protocol/account-pattern.md) understood for composed vault logic

## Related

* [Treasury & transfers](/platform-bloxchain.app/use-cases/treasury.md) · [Use cases](/platform-bloxchain.app/use-cases.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bloxchain.app/platform-bloxchain.app/use-cases/vault.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.