How Client-Funded Paymasters Work: Funding, Withdrawals, and Policy Control
Every paymaster needs a balance behind it. Someone has to fund the contract that's going to cover gas on behalf of users, and someone has to decide how that balance gets spent. In a client-funded model, that someone is the application, not the infrastructure provider.
What client-funded actually means
In Trustware's paymaster system, sponsorship funds live in the paymaster's own EntryPoint deposit, a balance the client funds directly and can withdraw from at any time. This deposit is distinct from the anti-DoS stake required by the ERC-4337 standard, which carries an unstake delay; the gas-paying deposit itself has no such lock. The deploying wallet is the sole owner of the contract, and funding, top-ups, and withdrawals all run through that owner.
This is a structural difference from provider-managed paymasters, where the application typically funds a shared balance or gets billed against usage, without direct control over the actual onchain deposit backing their sponsorship.
Managing a client-funded paymaster day to day
Being client-funded doesn't mean being unmanaged. Trustware's dashboard gives clients direct control over:
Paymaster deployment
Top-ups and withdrawals
Contract upgrades
Monthly budgets
API-key scope rules
Maximum uses per sender
Maximum cost per transaction
Rules priority
Paymaster activity and usage tracking
The client decides how much to fund, when to top up, and when to pull unused funds back out. Trustware's role is to authorize which sponsored UserOperations are eligible under the client's own rules, not to hold or allocate the money itself.
Why funding control matters more as usage scales
A shared, provider-managed balance makes it hard to answer basic questions once sponsorship becomes material to your business: How much is being spent, on what, and by whom? Can unused funds be recovered without a support ticket? Is the balance verifiable onchain in real time?
A client-funded paymaster answers all of this by default, because the funds never leave the client's own contract. The application funds it, tracks it, and withdraws from it on its own terms. Trustware supplies the deployment flow, the dashboard, and the policy layer around that balance, but the balance itself, and every dollar in it, belongs to the client.