shielded custody
three load-bearing controls for autonomous systems that touch capital.
Split-key custody so no single party holds the full key. On-chain policy so the rules cannot be bypassed. Verifiable history so actions stay reconstructable after the fact.
The three layers
Split-Key Custody
FROST 2-of-3 threshold + 2PC-MPC via Ika
One secp256k1 dWallet. Agent holds one key share. Ika network holds the other. The full private key never exists in any single location. Compromise one side and you get nothing.
FROST 2-of-3secp256k1P2TR Taproot
On-Chain Policy
Sui Move contract
Per-transaction limits. Daily caps. Recipient whitelist. Emergency freeze. Enforced by the Sui validator set, not by client code. The agent cannot bypass the rules even if compromised.
SpendPolicyMove
Verifiable History
ZAP1 attestation protocol
Every operation committed to a BLAKE2b Merkle tree. Roots anchored on Zcash mainnet. Same root verifiable on Ethereum, Arbitrum, Base, Hyperliquid, and NEAR. 127 leaves, 6 mainnet anchors.
BLAKE2b6 mainnet chains
How we compare
| Feature |
Frontier Compute |
Coinbase AgentKit |
Lit Protocol |
Fireblocks |
| Split-key MPC |
Yes (Ika dWallet) |
No (custodial) |
Yes (TSS) |
Yes (MPC-CMP) |
| On-chain policy |
Yes (Sui Move) |
No |
Partial (PKPs) |
Off-chain only |
| Zcash support |
Yes (transparent + ZIP 246) |
No |
No |
Limited |
| Bitcoin P2TR |
Yes (Taproot sighash) |
No |
Yes |
Yes |
| Attestation proofs |
Yes (BLAKE2b, 6 mainnet chains) |
No |
No |
No |
| Open source |
Yes (MIT, 22 repos) |
Yes |
Partial |
No |
| Self-hostable |
Yes |
No |
No |
No |
Flow
1
createWallet()
DKG generates a split-key dWallet on the Ika network. You save the encryption seed.
2
setPolicy()
Deploy spend rules as a Sui Move contract. Limits, whitelist, freeze controls.
3
sign()
2PC-MPC signing. Presign + approve. Neither party sees the full key at any point.
4
broadcastTx()
Transaction hits the target chain. Zcash, Bitcoin, or Ethereum mainnet.
5
attest()
Operation recorded in ZAP1 Merkle tree. Anchored on Zcash. Verifiable on 6 mainnet chains.
Supported chains
Zcash transparent (ZIP 244 + ZIP 246 v6 sighash)
Bitcoin (P2TR Taproot)
Ethereum/EVM (KECCAK256)
Same dWallet signs for all three. One DKG, one key share, three chain families. Zcash shielded (Orchard) uses RedPallas on the Pallas curve, which Ika does not currently support. Transparent ZEC works today. ZcashRelay.sol provides a Zcash light client on Ethereum for header verification.
Install
# 54 exports. 2,900+ downloads/month.
npm install @frontiercompute/zcash-ika
import { createWallet, sign, setPolicy } from '@frontiercompute/zcash-ika';
const wallet = await createWallet(config, 'zcash-transparent');
await setPolicy(config, wallet.id, { maxPerTx: 100000, maxDaily: 500000 });
const sig = await sign(config, {
messageHash, walletId: wallet.id,
chain: 'zcash-transparent',
encryptionSeed: wallet.encryptionSeed
});
Pricing
Free
All packages, crates, MCP access, verify page, and 5 attestation leaves per day.
$0
Builder
API key, 100 attestation leaves per day, auto-anchoring, webhooks, email support, and a usage dashboard.
Operator
Unlimited leaves, cross-chain verification, priority anchoring, custom event types, webhook delivery, and a 99.5% SLA.
Custody
Managed dWallet, multi-chain signing, Sui Move policy enforcement, FROST signing for shielded Zcash, compliance reporting, and custom integration support.
Links