Custody and settlement

Where value sits at every moment of a sale, who can move it, and what happens to it if Minthouse stops answering. The house never holds fiat money, never holds a customer's keys, and never takes custody of funds in an onramp or a cash-out.

The one-line answer#

Minthouse holds customer value in exactly one place: the bid escrow contract, and it holds it there as collateral for that customer's own bids, credited on chain to that customer's own address, withdrawable by that customer without any signature from the house. Everywhere else, value is either in the customer's own wallet or in the house's own treasury as payment for goods sold.

The object is a separate question#

This page is about value: where money sits, who can move it, and what the house can reach. The card is a different kind of custody with a different ledger behind it, and the two are deliberately not described in the same sentence. Where a physical card is, who verified that it is there, and what a collector can do with it while the house holds it, is The vault.

Two things about that arrangement belong here, because a reader on this page is likely to assume them:

• Holding the object gives the house no claim on it. A card in the vault is the owner's. Custody and ownership are separate columns, a custody transfer moves no value in either direction, and nothing in the house's own books treats a vaulted card as house property.
• The house undertakes no insurance on it, and the published agreements do not say who bears loss or damage while a card is in the vault. That gap is stated plainly on The vault rather than papered over here; the only published term that touches it is the liability cap in Terms of Service §13.

Value, by location#

No fiat, ever#

There is no Minthouse bank account holding a buyer's payment while a card ships, and no point in any flow at which the house holds dollars belonging to a customer. Invoices are denominated in dollars and settle in USDC at one to one, which means the house receives the settlement token directly and never receives, holds, or returns money in a bank.

The consequence worth stating: the traditional auction-house arrangement in which the saleroom holds the buyer's cash in a client account until the consignor is paid does not exist here. The buyer pays Minthouse for goods; Minthouse owes the consignor the proceeds; and the second obligation is discharged out of the house's own treasury after the buyer protection window. Those are two debts, not one pot being held.

No keys, ever#

Every movement of a customer's own funds is signed by the customer's own wallet:

• Depositing into the escrow is deposit or depositWithPermit, signed by the depositor. The house cannot initiate a deposit and cannot pull from a wallet.
• Withdrawing is requestWithdraw then claimWithdraw, both signed by the owner. claimWithdraw is not pausable and requires nothing from the house.
• Paying an invoice directly is an ordinary transfer the buyer signs.
• Cashing out is a deposit into a public protocol contract that the customer signs.

Where an account uses an embedded wallet created through the sign-in provider, the keys are held under that provider's own custody model, not by Minthouse. The house's own key material is a single settler key whose entire power is documented in Threat model.

The house's three verbs#

The only thing Minthouse's operational key can do to a customer's escrow balance is call three functions, and the contract limits every one of them:

There is no fourth verb. There is no administrative transfer, no sweep, no emergency withdrawal to a recovery address, and no upgrade path that could add one. See Guarantees and limits for the proof of each of those, and for the three places where the house's reach is broader than a one-line summary would suggest.

The onramp#

Converting dollars into the settlement token is provided by Peer Pay, an independent third-party service operating under its own terms. Minthouse is not a party to the customer's relationship with it.

• Minthouse does not profit from onramps and takes no fee, spread, or referral revenue on one.
• Minthouse holds no customer funds at any point in an onramp. The order is between the customer and the provider; the tokens arrive in the customer's wallet.
• Disputes about an onramp order, whether failed, delayed or cancelled, lie with the provider under the provider's terms. Minthouse cannot reverse, refund or adjudicate one.
• Orders run $100 – $10,000. Above the cap the desk can discuss OTC options; Minthouse never takes custody of or converts a customer's funds and is not a party to any conversion.
• Using an onramp changes nothing about the invoice. It remains due within 10 days regardless of the status of any order.

The cash-out#

On deployments running on Base mainnet, a cash-out converts USDC in the customer's own wallet into a fiat payout in a payment app they name. It runs on the open ZKP2P protocol: the customer's wallet signs a deposit into a public cash-out escrow contract, and an independent buyer fills the order by paying the customer's payment-app handle.

• Minthouse never holds, routes, or converts funds in a cash-out, and earns nothing from one.
• Payout details are supplied by the customer and used by the protocol. A payment sent to a wrong handle cannot be reversed by Minthouse.
• USDC is denominated in dollars, so a cash-out is not a currency conversion. The amount received can fall slightly below the amount deposited through slippage on the fill.
• Disputes about a fill lie within the protocol's own on-chain rules. Minthouse is not a party to a cash-out and cannot adjudicate one.

If Minthouse stops answering#

This is the question that decides whether a custody claim is real, so it gets a direct answer rather than a reassurance.

A bidder with a locked balance waits for the lock's own clock. expireLock is callable by anyone, is not pausable, and releases a lock that has stood past MAX_LOCK_AGE, which is 30 days on this deployment. That is the ceiling on how long a lock can survive a house that has stopped operating, and it is why the constant exists at all. If the guardian is still reachable, revokeSettler makes every lock immediately expirable and shortens that wait to zero.

What no reader should take from this is that the wait is nothing. Thirty days is thirty days, and a bidder whose collateral is locked against a lot when the house disappears has it locked for that period. The honest framing is that the exit is unconditional and does not require Minthouse, not that it is instant.

What the house cannot recover for you#

• A transfer to the wrong address. On-chain transfers are final. A payment sent to a wrong address, on the wrong network, or in the wrong asset cannot be recalled by Minthouse or by anyone.
• Lost keys. If a customer loses control of the wallet holding their escrow balance, that balance is unreachable. The contract keys everything to the depositing address, and there is no function that reassigns a balance to a different address, which is the same property that stops the house doing it to a customer.
• Network fees. Blockchain fees are the customer's and are not refunded, including on overpayments returned in kind and on reissued invoices.
• A third-party rail. Onramp and cash-out orders are governed by the provider's or the protocol's own rules.

These are set out again, with the rest of the risk surface, in Risk disclosures.