SOTA Operator Stack
A DeFi-native blueprint for high-decentralisation Ethereum operators and treasury teams: YubiKey identity, hardened hosts, Safe key management and day-to-day DeFi operations, across every protocol you touch.
Where it comes from
Built from the same muscle memory as public-goods and protocol work at high decentralisation stages, including DeFi Collective-style treasury reality: distributed signers, deliberate friction on capital and operational discipline on every DeFi interaction. Machine payments and agent float are one optional module of the stack.
Reference architecture
Identity, endpoint, treasury multisig, DeFi operations and optional automation.
People and access
- YubiKey / FIDO2Human MFA, SSH, IAM, deploy
- Named signersNo shared seeds, clear roles
Endpoint
- Hardened OSDisk encryption, updates, isolation
- Signing workstationClean browser, known RPCs
Treasury plane
- Safe multisigm-of-n, policies, modules
- Hardware walletsOne per signer, offline ceremony
- Timelocks and limitsFriction matched to stage
DeFi operations
- Approvals and permitsScoped and revocable
- Simulate, then signTrust the calldata over the UI
- Governance, bridges, LPA runbook per action class
Optional automation
- Ops and grant floatCapped and allowlisted
- Agents and x402A separate module, kept away from treasury keys
- Top-tier pathTaurus custody, Opsek HNW security
What you actually run
Human identity
- YubiKey (FIDO2) on OS login, SSH, cloud IAM, GitHub and any admin surface
- Named people, with no shared root and no seed phrases shared between signers
- Session hygiene: short-lived tokens and phishing-resistant MFA everywhere capital decisions happen
Hardened endpoint
- Clean OS and full-disk encryption (Linux, macOS and Windows baselines)
- Browser isolation for the Safe UI, dApps and governance portals
- No random wallet extensions, and known-good RPC and bookmark discipline
Treasury key management
- Safe (or equivalent) multisig as the default capital container
- Hardware wallets per signer, an offline seed ceremony and dual-control backups
- Role design: proposers, signers and ops, with geographic and organisational diversity of keys
- Thresholds, spending limits and timelocks matched to decentralisation stage
DeFi operations blend
- Allowance hygiene: no infinite approvals by default, and a revoke and rotate cadence
- Simulate before you sign (Tenderly-class or equivalent) and verify the calldata as well as the UI labels
- Protocol interaction runbooks: LP, gauges, grants, bridges and governance votes
- Frontend trust model: official domains and dual-channel verification for large moves
Hot ops and automation (optional)
- A dedicated ops, grant or agent float, kept off the treasury Safe seed path
- Hard spend caps and allowlists when bots or x402-style machine payments appear
- A clear promotion path: the ops wallet reaches treasury only through a deliberate multisig
Observability and recovery
- Signer availability SLAs, and an emergency rotation if a key or person is compromised
- On-chain monitoring of the Safe, large approvals and anomalous outflows
- Tabletop drills: lost signer, malicious proposal, UI phishing, bridge incident
Key management training and setup
The product covers the tools and also how a treasury team generates keys, stores them, proposes, reviews and signs under a high-decentralisation threat model.
Ceremony design
How seeds are generated, written, stored and dual-controlled. Who is allowed in the room. What never goes on a phone photo or cloud note.Signer operating system
Hardware wallet model, firmware cadence, a YubiKey for the human, and a personal checklist before every signature session.Proposal hygiene
Who can propose, who must review calldata, which dollar threshold needs an extra pair of eyes, and when a timelock is mandatory.Decentralisation stage fit
An early team runs a tight m-of-n. At high decentralisation you widen the signer set, slow the path to funds and publish runbooks. Raise friction as value and trust assumptions grow.
Day-to-day protocol work
Custody without a DeFi operating procedure is incomplete. Every recurring action class gets a short runbook so signers are not improvising under time pressure.
Approvals
Scoped allowances, regular revokes, no silent Permit traps.Simulation
Pre-sign state diffs. Refuse if the UI and the calldata disagree.Governance
Vote and execute paths kept separate from day-to-day spend.Bridges and L2
Canonical routes only, staged sizes, dual verification.Public goods and grants
An ops Safe or a module with a policy, kept off the main treasury hot path.Incident
Pause modules if available, rotate signers, and keep a public postmortem culture.
Adoption order
1
People and OS
YubiKey and a hardened host.2
Treasury Safe
Key ceremony and m-of-n.3
DeFi runbooks
Approvals and simulation.4
Ops float
Only if you need it.
Separation rule
Keep three planes distinct: personal identity (YubiKey), treasury capital (Safe and hardware signers) and hot ops float (grants, bots, optional agent or x402 spend). A compromise of ops must never become a compromise of treasury. This rule is non-negotiable.High decentralisation stage
As the organisation matures, widen signer diversity, slow the path to large moves, publish procedures and prefer on-chain policy over informal trust. Speed stops being the thing you optimise for.
When you need institutional grade or HNW security
Our SOTA Operator Stack is for sovereign and decentralised treasury teams. For banking-grade custody or high-net-worth personal security, these are the references we point people to, because they are the right tool for that mandate.
Taurus (opens in a new tab)
Institutional custody
Digital-asset infrastructure for institutions: custody, policy engines, HSM and MPC, and operational controls built for regulated environments and serious AUM.
- Banking-grade key protection and governance
- Multi-party approval and policy-driven workflows
- The right fit when DIY Safe and hardware wallet operations are not enough
Opsek (opens in a new tab)
HNW security
Operational and endpoint security for high-net-worth and high-risk operators: OS hardening, threat-modelled setups and security depth beyond generic consumer advice.
- Linux, macOS and Windows hardening at a professional bar
- Threat models for high-net-worth and high-risk people and teams
- A complementary path when you need specialist HNW security
opsek.ioOS security baselines we align with on the sovereign track.
Run a key-management session.
Run a treasury key-management session against this stack, or harden signer endpoints first if you are early.