Wallet infrastructure
Lit Protocol vs Fireblocks
Make the decision to sign part of your application.
Compare distributed signing and transaction policies with wallet-bound code that reads data, evaluates rules, and signs.
Scope: Fireblocks Vault/direct-custody infrastructure and Lit in ChainSecured mode. Embedded-wallet variants may use different thresholds.
Lit assessment
Why choose Lit
With Lit, a signing rule can be a program: fetch a price, read a vault ratio, and authorize a transaction only when your conditions hold. Bind that program to a wallet through on-chain permissions. Choose Lit when custom pre-signing logic is central to the application. Where needed, Lit Actions can also participate in an MPC protocol.[1][2][3]
Tradeoffs to weigh
Fireblocks signing depends on the configured share participation, with documented recovery paths for device loss and service suspension. Lit depends on its runtime and supporting infrastructure. For either model, evaluate the recovery arrangement your application would actually use during an outage.
Architecture, side by side
| Dimension | Fireblocks | Lit (ChainSecured mode) |
|---|---|---|
| Signing method | MPC-CMP produces signatures from distributed shares without assembling the complete private key during ordinary signing.[4] | The TEE derives keys and executes permitted Lit Actions. On-chain permissions determine the allowed wallet/action combinations.[5][2] |
| Policy authority | An enclave-protected policy engine applies transaction rules and administrative approval quorums. MPC and enclave controls work together.[4] | The account owner governs policy on Base. The runtime reads that public state when authorizing a request.[6] |
| Continuity | Normal signing requires the configured share participation. Fireblocks documents recovery tools for loss of signing devices or suspension of its operations.[7] | Contract authority does not guarantee service availability. Execution still needs the runtime, chain reads, and supporting infrastructure.[5][6] |
Signing method
Policy authority
Continuity
- Fireblocks
- Normal signing requires the configured share participation. Fireblocks documents recovery tools for loss of signing devices or suspension of its operations.[7]
- Lit (ChainSecured mode)
- Contract authority does not guarantee service availability. Execution still needs the runtime, chain reads, and supporting infrastructure.[5][6]
MPC and confidential execution can be combined
Lit Actions can run WebAssembly, including documented threshold ECDSA and FROST signing examples. This allows a Lit workload to participate in an MPC protocol while enforcing its own signing logic. Using an existing co-signer requires compatible code and an integration assessment.[3]