Does protocol custody mean control?

A contract can possess a balance

On Solana, a protocol can generally control a token account through programme rules rather than a human private key. That enables escrow, vault deposits and automatic seizure after a borrower fails to repay. But Token-2022 extensions can alter the result: accounts may start frozen, transfers may require a hook, quantities may rebase, fees may be deducted and a permanent delegate may move tokens without the protocol’s signature.

Even flawless contract custody answers only the chain question. The issuer may recognize only eligible persons, registered accounts or approved intermediaries. A protocol-controlled account may therefore hold the token while lacking a direct right to redeem it.

Scenario 1: the borrower defaults

This is the morally and contractually intended loss of the token. The lender should seize collateral under the smart contract. The important question is what happens next.

1. Can the token move to the liquidator or buyer without allowlist approval?
2. Can it be sold in sufficient size without destroying the price?
3. Can the lender redeem directly, or must it find an eligible intermediary?
4. Can the issuer freeze or claw back the seized token?
5. Does the legal claim travel with possession, or remain with a registered holder?

If the lender cannot turn seizure into cash, the token may be technically valid collateral but economically poor collateral. A rational protocol responds with a low collateral factor, a tight deposit cap, permissioned liquidators—or no listing.

Scenario 2: the protocol is hacked

The attacker may acquire the same on-chain control that a legitimate liquidator would have. Whether the transfer is final depends on the token’s legal and technical design.

A bearer-like claim may follow the token, leaving the original owner with a claim against the hacked protocol rather than against the issuer. A controlled security may let the issuer freeze the attacker and reissue to the recognized owner. That recovery power protects the victim but means a lender cannot assume seizure is irrevocable. The issuer’s terms may also exclude losses caused by third-party protocols.

Scenario 3: access is lost

A bug, governance failure or lost upgrade key can strand tokens in a contract even without theft. If the issuer recognizes the contract as holder, it may say the asset remains exactly where the ledger places it. If the legal system recognizes the beneficial owner behind the contract, a recovery process might exist—but it may require evidence, discretion, a court order or a token reissue.

“The tokens still exist” is not the same as “the owner can obtain them.” Good analysis states who can initiate recovery and whether that mechanism is a right or merely issuer discretion.

A protocol listing proves only a bounded fact

An exact mint in a live reserve or collateral registry proves that the protocol configured that asset. On-chain accounts can corroborate the listing and its current parameters. It does not prove that the issuer accepts protocol custody, that liquidation size is adequate or that the legal claim survives every transfer.

Generic compatibility is weaker still. “Supports Token-2022” does not mean the protocol supports this mint’s rebase, transfer fee, freeze state, hook or eligibility rules.

Questions to ask before calling it composable

• Is this exact mint currently enabled, and for which operation?
• Can a protocol account receive, hold and transfer it without discretionary approval?
• Which oracle, LTV, liquidation threshold, cap and liquidators apply?
• Does the legal claim travel to a protocol or liquidation buyer?
• Can the issuer freeze, claw back, rebase or refuse redemption after default?
• How would legitimate default, hack theft and accidental lock-up be treated differently?
• Can seized collateral be converted to cash at meaningful size?

How RWA Sonar shows it

RWA Sonar includes only confirmed exact-mint uses, then records the permitted operation and live protocol parameters. Each technology/legal template separately answers escrow, borrower default, protocol hack and access loss. The exit-after-default verdict keeps “listed as collateral” from being mistaken for “reliably monetizable collateral.”