Non-Custodial Paymasters: Why Custody Is the Real Paymaster Problem

Gas sponsorship gets pitched as a UX upgrade: hide the gas, remove the friction, let users transact without holding a native token. That framing is accurate, but incomplete. Sponsoring gas means an application is spending real money to cover someone else's transaction, and that money has to be held, funded, and governed by someone. The question of who is rarely addressed head-on.

The default model isn't non-custodial

In effectively every productized paymaster offering today, the provider runs the contract, owns the funding or billing relationship, and hands the application a dashboard and an API layered on top of infrastructure it doesn't control. The application configures rules offchain. The provider's paymaster actually holds and spends the funds. That's a custodial arrangement, even when it doesn't get called one.

For simple use cases, this is fine. It stops being fine the moment an application or institution needs to answer basic operational questions: Where do the sponsorship funds actually sit? Who can withdraw them? Can the balance be verified onchain? Is this connected to routing and settlement, or bolted on as a separate product?

What non-custodial actually means here

A non-custodial paymaster inverts the ownership. The client deploys their own onchain paymaster contract. Sponsorship funds sit inside that contract, tied to the wallet that deployed it. The deploying address is the sole owner, controls funding and withdrawals, and can pull the balance out at any time. The provider supplies the offchain layer, the authorization logic, the dashboard, and the policy engine, but never holds custody of the funds themselves.

This is the model Trustware built for its paymaster system. Every client deploys and owns its own ERC-4337-compatible paymaster contract on EntryPoint v0.7. Trustware cannot move, withdraw, or redirect those funds under any circumstance. The offchain/onchain split is the whole point: Trustware handles policy and authorization offchain, while the client keeps full onchain control.

Why this matters more as sponsorship scales

Sponsorship gets expensive or abusable fast if it isn't scoped and owned properly. A serious system needs answers to which transactions get sponsored, which users or API keys qualify, how much can be spent, and who can pull unused funds back out. A custodial paymaster answers all of those questions on the provider's terms. A non-custodial one answers them on the application's terms, with the provider supplying the tooling rather than the ownership.

Non-custodial isn't a compliance checkbox. It's the difference between renting your gas sponsorship infrastructure and owning it outright.