Wallet infrastructure
Lit Protocol vs Turnkey
Your wallet rules, secured on-chain.
A wallet’s security depends on who can change its rules, approve its software, and keep it available. Lit enforces permissions and runtime approval through public contracts.
Scope: Lit Chipotle in ChainSecured mode and Turnkey’s hosted wallet infrastructure on AWS Nitro.
Operator authority
Three questions about operator authority.
| Control | Lit · ChainSecured | Turnkey |
|---|---|---|
| Who can change the permissions? | Your account wallet approves permission changes on Base. A usage API key can run authorized Actions but cannot change those permissions.[6][7] | Customer authorization governs policy changes within Turnkey’s enclave system. Its integrity depends on the approved enclave applications and the operator quorums that authorize them.[3][8] |
| Who can approve replacement code? | The approvers authorized by the governance contracts can approve runtime releases. The key-management system checks on-chain approval and hardware attestation before releasing keys. Deploying new code is not enough.[2][9] | Turnkey’s operator quorums authorize enclave software and service-secret provisioning. AWS supplies the Nitro attestation root; the operator approval process determines which code is trusted with secrets.[8] |
| Who can stop access? | The API operator or runtime host can interrupt normal signing. On-chain permissions remain inspectable, but execution still needs the runtime and key-management system. Recovery requires a separate plan.[10][2] | Signing and normal key export require Turnkey’s service. Its disaster-recovery documentation describes provider restoration; that is distinct from a customer’s independently tested exit path.[3][11] |
Who can change the permissions?
- Lit · ChainSecured
- Your account wallet approves permission changes on Base. A usage API key can run authorized Actions but cannot change those permissions.[6][7]
- Turnkey
- Customer authorization governs policy changes within Turnkey’s enclave system. Its integrity depends on the approved enclave applications and the operator quorums that authorize them.[3][8]
Who can approve replacement code?
- Lit · ChainSecured
- The approvers authorized by the governance contracts can approve runtime releases. The key-management system checks on-chain approval and hardware attestation before releasing keys. Deploying new code is not enough.[2][9]
- Turnkey
- Turnkey’s operator quorums authorize enclave software and service-secret provisioning. AWS supplies the Nitro attestation root; the operator approval process determines which code is trusted with secrets.[8]
Who can stop access?
- Lit · ChainSecured
- The API operator or runtime host can interrupt normal signing. On-chain permissions remain inspectable, but execution still needs the runtime and key-management system. Recovery requires a separate plan.[10][2]
- Turnkey
- Signing and normal key export require Turnkey’s service. Its disaster-recovery documentation describes provider restoration; that is distinct from a customer’s independently tested exit path.[3][11]
The Lit advantage
Your on-chain rules govern signing
Your account decides which Actions can use each wallet key. Each Action is identified by its code hash, and the runtime checks your on-chain permissions. The runtime itself must have on-chain approval to receive its keys.[1][2]
How ChainSecured worksWhat custody means in practice
Custody involves more than who can read a private key. Ask who can sign, alter authorization, approve replacement software, and restore access without the provider. Lit makes account authority and runtime approvals inspectable on-chain. You still need to check who can approve upgrades and how you would regain access if service stops.[7][9][3]
Shared protections
Both use hardware isolation and software verification. Turnkey’s signed requests and authenticated policy state protect against ordinary host or database tampering. AWS account access alone is not signing authority.[3][4][5]
The operator is part of the threat model
Turnkey’s security depends on its enclave code and the operator quorums that approve it. Attestation can establish that approved code is running; it cannot establish that the people approving it made a safe choice. Lit records and enforces runtime approval through public contracts. The approval process remains part of the security model.[3][8][9]
Sources and review scope
These comparisons use published documentation and the source code linked below. We have not audited or tested the providers’ live systems. Configurations vary, and source code alone does not establish who currently owns a deployed contract or how it is configured.
- Lit: Groups and action permissions
- Lit: On-Chain KMS
- Turnkey whitepaper: authorization, state freshness, and signing
- Turnkey Verified
- Lit: What is attestation?
- Chipotle: account mutation authorization (reviewed source)
- Lit: Chain Secured
- Turnkey: Quorum deployments
- Lit: Upgrade governance
- Lit: Architecture
- Turnkey: Disaster recovery
- Chipotle: contract owner upgrade authority (reviewed source)
- Lit: verification and contract administration