  Our contributions with this paper are twofold. First, we elucidate the
methodological requirements for a risk framework of custodial operations and
argue for the value of this type of risk model as complementary with
cryptographic and blockchain security models. Second, we present a risk model
in the form of a library of attack-trees for Revault -- an open-source custody
protocol. The model can be used by organisations as a risk quantification
framework for a thorough security analysis in their specific deployment
context. Our work exemplifies an approach that can be used independent of which
custody protocol is being considered, including complex protocols with multiple
stakeholders and active defence infrastructure.
