How Does WAAS Work?
How does WAAS work? A business’s systems send instructions to the WaaS provider through an API, such as creating an address or initiating a transfer. WaaS first checks the operation against risk rules, then the key management layer signs it, and finally the transaction is broadcast to the blockchain through nodes, with the result sent back to the business. For the business, the whole process is just a few API calls; the complex cryptography and on-chain interactions all happen behind the scenes.
What Layers Make Up a WaaS System?
At the top is the interface layer: the APIs, SDKs, and admin console that the business calls directly. It receives instructions, authenticates the caller, and pushes transaction status updates through webhooks.
In the middle is the risk control layer. Here, a transaction policy engine checks each transaction against whitelists, amount limits, and approval rules, and runs anti-money laundering screening. Below that is the key management layer. With MPC, private key shards are distributed across different parties, and signing can be performed inside a Trusted Execution Environment (TEE). At the bottom is the blockchain access layer, which connects to nodes on each chain to broadcast transactions and detect incoming deposits.
How Does WaaS Process a Deposit and a Withdrawal?
Deposit Flow
The business calls the API to generate a dedicated deposit address for a user. When the user sends assets to that address, the blockchain access layer detects the transaction and, once it reaches the required number of confirmations, notifies the business through a webhook so it can credit the user. If the risk control layer finds the funds came from a high-risk address, they can be frozen pending review. Funds spread across deposit addresses are then swept into the main wallet automatically according to set rules.
Withdrawal Flow
The business submits a transfer request through the API, specifying the recipient address, asset, and amount. The risk control layer first checks whether the address is on the whitelist and whether the amount exceeds limits, and large transactions go to manual approval. Once approved, the MPC nodes in the key management layer jointly compute the signature, without ever assembling the complete private key. The signed transaction is broadcast by the blockchain access layer, and the business receives a callback once it is confirmed.
This order is critical: risk checks run before signing and independently of the system that sent the request. Even if a business’s servers or employee accounts are compromised, fraudulent withdrawals sent by attackers are stopped at this step.
How Do Key Backup and Disaster Recovery Work in WaaS?
One of the biggest concerns for businesses is what happens to their assets if the provider stops operating. WaaS built on MPC self-custody typically lets the business keep its own encrypted backup of key shards. In an extreme scenario, the business can use open-source tools to recover the private key in an offline environment and move its assets independently, without relying on the provider.
Day to day, MPC also supports periodic shard refreshes: the private key and addresses stay the same, but the shards held by each party are replaced. Even if an old shard was ever exposed, it becomes useless after the refresh. When choosing a WaaS provider, it’s worth running a backup and recovery drill to confirm you truly control your assets.
Conclusion
How does WAAS work? It consists of four layers: interface, risk control, key management, and blockchain access. The business sends an instruction, risk controls check it first, MPC completes the signature, and nodes broadcast it to the chain. Combined with key backups and shard refreshes, this lets businesses launch quickly through an API while always staying in control of their assets.
Want to see how WaaS would work in your business? Explore Safeheron WaaS, or contact the Safeheron sales team to book a one-on-one demo
