# Your Assets and Custody

> Assets in your wallet are controlled only by you. Lending deposits sit in accounts controlled by the Spout program.

Canonical: https://spout.finance/docs/custody/

---

Assets in your wallet are controlled only by you. Lending deposits sit in accounts controlled by the Spout program. Collateral sits in the program's pool escrow; once it has joined the pool, the real shares behind it are held in Spout's brokerage account and a matching receipt token sits in the escrow in its place. Some steps, such as redeeming and reissuing collateral tokens with the issuer, moving idle lending cash to and from the Treasury fund, and settling trades in the brokerage account, are carried out by Spout's operational key.

| Asset | Where it sits | Who controls it |
| --- | --- | --- |
| Tokens and USDC in your wallet | Your wallet | You |
| Collateral you deposit | The asset's pool escrow, an account controlled by the Spout program. Once it has joined the pool, the real shares sit in Spout's brokerage account and a matching receipt token sits in the escrow. | The program's rules onchain; Spout's operational key at the broker and the issuer |
| Your share of a collateral pool | Recorded in your position onchain | The program's rules |
| USDC you lend | The lending pool, an account controlled by the program; idle cash in a tokenized Treasury fund | The program's rules; idle cash moved to and from the Treasury fund by Spout's operational key |
| Your lending shares | Your wallet, as share tokens | You |

## When collateral can leave a pool

Collateral leaves a pool only under the program's rules:

- **You withdraw it,** between cycles once its tokens are back in the pool, and within 50% LTV.
- **Calls on it are assigned,** and the called shares are delivered at the strike from the brokerage account. The pool is restored with shares bought back.

- **A position is liquidated,** and the collateral sold repays the loan.
- **It is redeemed with the issuer,** and the underlying shares go to Spout's brokerage account. A matching receipt token takes its place in the pool until the tokens are reissued.

Spout's operational key starts assignments and liquidations and reports their results, such as sale proceeds, so you rely on Spout to run them correctly. Every step is reconciled against the broker, and anything that does not match halts for review.

## Upgrades

Spout's programs can be upgraded by governance, which is held in a multisig. See Governance and Roles.