Cold Storage Architecture and Refill Logic

The core defense layer uses P2WSH and P2TR script-path outputs to enforce organizational policy on-chain. A robust implementation separates the policy creation (defining quorum keys and relative timelocks like OP_CSV) from the spending authorization. For cold storage refills, the hot wallet's spend path should be gated by a timelock that exceeds the monitoring and intervention window. Teams must review how key material is distributed across HSMs and geographic locations to prevent a single physical breach from compromising the quorum. Chainscore can review your script composition and key ceremony design to ensure the on-chain policy matches your organizational security model.

Partially Signed Bitcoin Transactions (BIP174) are the standard for moving unsigned transactions between a watching-only hot wallet coordinator and air-gapped cold signers. A production-grade implementation must manage complex PSBT state machines, handling the iterative addition of signatures, finalization, and extraction of the fully signed transaction. The critical risk is a malformed PSBT that causes a signer to commit to an unintended output or fee. Implement strict input and output validation on the air-gapped side before signing. Chainscore provides integration reviews for PSBT workflows to eliminate state confusion and ensure compatibility with your specific HSM firmware.

Standard deterministic nonce generation (RFC6979) protects against weak randomness but not against a compromised signing device that covertly leaks the private key via a biased nonce. For cold storage refills, integrate an anti-exfiltration protocol like Anti-Klepto, which commits the signer to a nonce before receiving the message to sign. This prevents a corrupted device from grinding nonces to embed key material into the signature. This is a non-negotiable control when the signing device is a general-purpose HSM that cannot be fully trusted. Chainscore can audit your signing pipeline to verify that nonce commitments are correctly implemented and enforced.

The refill logic must autonomously select UTXOs from the cold wallet to top up the hot wallet's balance. This requires a custom coin selection algorithm that prioritizes minimizing the creation of a large, privacy-damaging consolidation event while ensuring the resulting transaction is economical. The system must dynamically calculate fees using a mempool-aware estimator, constructing the transaction with a Replace-By-Fee (BIP125) flag to allow acceleration if the refill is time-sensitive. A failure in fee estimation can lead to a stuck refill and a drained hot wallet, halting customer withdrawals. Chainscore can review your coin selection and fee bumping logic for operational resilience.

The automated system that triggers a refill must operate on a reorg-safe view of the hot wallet's balance. Relying on unconfirmed deposits or a naive block count can lead to a double-spend scenario where a refill is triggered based on a deposit that is later reorged out. The refill trigger must use a conservative confirmation depth and a ledgering system that correctly rolls back state. The monitoring service must detect a chain reorganization and immediately re-evaluate the hot wallet's available balance to prevent an unnecessary or dangerous refill. Chainscore provides architecture reviews for reorg-aware balance tracking to prevent this class of race condition.

Integrating HSMs for Bitcoin signing is non-trivial because many HSMs do not natively support Bitcoin's flexible sighash flags or the complex digest algorithms required for SegWit and Taproot. The integration layer must correctly construct the sighash preimage and present it to the HSM in a raw format it can sign, effectively bypassing the HSM's transaction parsing. This creates a risk of signing a manipulated preimage. The implementation must rigorously validate that the HSM's signature covers the exact transaction data intended. Chainscore can review your HSM integration layer to ensure it correctly handles Bitcoin's unique signing model without introducing a blind-signing vulnerability.

Chainscore Labs can review cold storage architecture at the boundary where Bitcoin transaction mechanics meet operational controls: PSBT construction, signer authorization, UTXO inventory policy, refill thresholds, fee-bump logic, monitoring, and incident runbooks. The practical review output should identify whether a compromised hot wallet can request unsafe refills, whether change outputs and derivation paths are independently verified, whether emergency signing paths are too broad, and whether stuck-refill remediation is realistic during fee spikes.