"Non-custodial" gets used a lot in crypto, often as a vibe rather than a specific claim. It has a precise meaning, though, and it's worth spelling out — because it's the entire reason an escrow service can be trusted without trusting the company that built it.
Custodial escrow: the traditional model
A traditional escrow service — a real estate closing agent, Escrow.com, a freelance platform's payment holding — works by putting your money into an account the company controls. You trust that company to release it correctly. If they're honest and solvent, this works fine, and has for a long time. But it means the promise is only as good as the company: they can freeze an account, make a mistake, get hacked, go bankrupt, or get compelled by a court order to do something neither party to the deal agreed to.
Non-custodial escrow: the money never has an owner but the contract
A non-custodial escrow is a smart contract — a program deployed on a blockchain — that holds the funds instead of a company. The distinction that matters is this: once deployed, the contract's rules cannot be changed by anyone, including whoever wrote it. There's no admin key that unlocks a "just this once" override. There's no pause button. There's no upgrade path that swaps in new logic later. What the code says on deployment day is what it does forever.
Concretely, in VaultPay's contract, that means:
- No admin key. No wallet address has special privileges to move funds, cancel a deal, or override a dispute outcome.
- No pause function. The contract can't be frozen, by us or anyone else.
- No upgrade/proxy mechanism. The logic deployed on day one is the logic that runs forever — there's no swap-the-implementation trick that quietly changes behavior later.
- Source-verified. The deployed bytecode matches published source you can read yourself on Basescan, rather than asking you to take a company's word for what the contract does.
What this looks like in an actual deal
- A seller creates a deal — item, price in ETH or USDC, a delivery deadline. No account, no application, just a wallet signature.
- A buyer funds the deal. The money moves into the contract, not into a VaultPay-controlled wallet. From that moment, neither the buyer nor the seller can unilaterally move it — and neither can we, because there's no function in the contract that lets us.
- The seller delivers, the buyer confirms. The contract releases the funds to the seller, minus a 0.5% protocol fee (the only fee — nothing to open a dispute). If the buyer never confirms and the delivery deadline passes, the buyer gets an automatic full refund. Neither outcome requires anyone's permission.
- If something's actually wrong, either side can open a dispute. This is the one place a "trusted third party" enters the picture at all — but it's not VaultPay. Five reviewers are pseudo-randomly selected from a pool of people who registered ahead of time (a maximum of 10 at once), and they vote on how the funds should be split: 100% to the seller, 100% to the buyer, or a 50/50 split. The contract tallies the votes itself and pays out accordingly — nobody at VaultPay reviews, approves, or can override that outcome either.
The honest tradeoff
Non-custodial doesn't mean risk-free — it means a different, narrower set of risks. You're trusting the code (which is why it being verifiable matters), you're trusting the blockchain it runs on, and for disputes, you're trusting a small panel of reviewers rather than a company's support team. That last one is a real tradeoff worth naming: a review pool of 10 people is smaller than we'd like at scale, and it's something we're actively thinking about as usage grows. But even there, VaultPay itself has no seat at that table — it's a mechanism the contract runs, not a decision we make.
What you're not trusting is a company's solvency, a company's good intentions on any given day, or a company's willingness to freeze your funds if it decides it should. That's the whole point.
VaultPay is currently live on Base Sepolia (testnet) — test funds only, no real-money deployment yet. Read the full contract mechanics in our Terms of Service or see how VaultPay compares to Kleros' dispute model.