Skip to main content

Non-Custodial Wallets

Understanding how LazaiTrader keeps you in control of your funds at all times.

What Does "Non-Custodial" Mean?​

In the crypto world, custodial vs non-custodial determines who controls your funds:

TypeWho Holds KeysWho Can Move FundsExample
CustodialThe platformThe platformCentralized exchanges
Non-CustodialYouOnly youPersonal wallets
LazaiTraderSmart contractYou + authorized botBest of both

LazaiTrader is non-custodial - you always maintain ultimate control over your funds.

How LazaiTrader Works​

Your Smart Contract Wallet (SCW)​

When you register, we deploy a personal smart contract wallet for you. This wallet:

┌─────────────────────────────────────────────────────────┐
│              Your Smart Contract Wallet                  │
├─────────────────────────────────────────────────────────┤
│                                                         │
│  Owner: Your EOA (0x742d35...)                         │
│  ├── Can withdraw ALL funds anytime                    │
│  └── Receives ALL withdrawals                          │
│                                                         │
│  Bot Operator: LazaiTrader (0x50dBE4...)               │
│  ├── Can execute trades on whitelisted DEXs            │
│  └── CANNOT withdraw to any address                    │
│                                                         │
│  Whitelisted DEXs: Only approved exchanges             │
│  └── All other contracts blocked                       │
│                                                         │
└─────────────────────────────────────────────────────────┘

Key Security Properties​

  1. Withdrawals go to you - No matter who initiates, funds go to your registered wallet
  2. Limited bot permissions - Bot can only trade, not withdraw to other addresses
  3. Whitelisted DEXs only - Prevents interaction with malicious contracts
  4. On-chain code - Rules enforced by blockchain, not our servers

What LazaiTrader CAN Do​

ActionAllowedReason
Execute trades✅ YesCore functionality
Approve tokens for DEX✅ YesRequired for swaps
Read your balance✅ YesFor trade calculations
Send notifications✅ YesKeep you informed

What LazaiTrader CANNOT Do​

ActionBlockedWhy
Withdraw to other addresses❌ NoSmart contract enforces your EOA only
Trade on non-whitelisted DEXs❌ NoWhitelist is hardcoded
Change your registered wallet❌ NoImmutable after deployment
Access your private keys❌ NoWe never have them
Move funds without trading❌ NoOnly trade functions available

The Security Model​

Layer 1: Smart Contract Rules​

The SCW smart contract enforces:

// Withdrawals ONLY go to owner (your EOA)
function withdrawAllTokens(address _token) external {
    IERC20(_token).safeTransfer(owner, balance);  // owner = your wallet
}

// Only whitelisted DEXs can be called
modifier onlyWhitelistedDEX(address dex) {
    require(factory.isDEXWhitelisted(dex), "DEX not whitelisted");
    _;
}

Layer 2: Permission Model​

Your EOA (Owner)
├── Full withdrawal rights
├── Can call withdraw functions directly
└── Receives all withdrawn funds

Bot Operator
├── Can execute trades
├── Can approve tokens for whitelisted DEXs
├── Can initiate withdrawals (but funds go to owner)
└── Cannot redirect funds anywhere else

Layer 3: Factory Whitelist​

DEXs must be pre-approved at the factory level:

  • Factory owner controls whitelist
  • Individual SCWs inherit the whitelist
  • No user or bot can override

Comparing to Alternatives​

vs Centralized Exchanges​

AspectCEXLazaiTrader
Holds your fundsExchangeYour SCW
Can freeze fundsYesNo
Can get hackedYes (hot wallets)Only your SCW affected
Requires KYCUsuallyNo
Your keysDon't haveYou control

vs Trading Bots with API Keys​

AspectAPI Key BotsLazaiTrader
Permission scopeFull account accessTrade only
Withdrawal riskCan withdraw anywhereOnly to your wallet
Key compromiseTotal loss possibleLimited to SCW
RevocationMust revoke on exchangeOn-chain controls

What If LazaiTrader Disappears?​

Even if LazaiTrader stops operating:

  1. Your funds are safe - They're in your SCW on the blockchain
  2. You can withdraw directly - Call the contract's withdraw function
  3. No dependency on us - Smart contract continues to work

Emergency Recovery​

If the bot is unavailable, you can withdraw using any Ethereum wallet that supports contract interactions:

  1. Go to block explorer (e.g., Metis Explorer)
  2. Find your SCW address
  3. Connect your registered wallet
  4. Call withdrawAllTokens(tokenAddress) or withdrawAllNative()
  5. Funds sent to your connected wallet

Trust Assumptions​

What you're trusting when using LazaiTrader:

ComponentTrust LevelMitigation
Smart contract codeHighOpen source, auditable
Bot doesn't go rogueMediumContract limits actions
DEX whitelist is safeMediumOnly established DEXs
Telegram account securityMediumCan't change withdraw address
Our infrastructureLowCan recover without us
tip

Key Point: Even with full access to our systems, an attacker cannot steal your funds - only the smart contract can move them, and it enforces your EOA as the only withdrawal destination.

Best Practices​

Secure Your Registered Wallet​

Your EOA is the key to your funds. Protect it:

  • Back up seed phrase offline
  • Use hardware wallet if possible
  • Never share private keys

Monitor Your SCW​

Periodically check:

  • Balance matches expectations
  • No unexpected transactions
  • Trading activity is as configured

Understand the Limits​

Know that:

  • Bot CAN execute trades on your behalf
  • Bot CANNOT send funds elsewhere
  • You CAN always withdraw directly

Further Reading​