Why Withdrawal Systems Should Use a State Machine Instead of a Single Function

A common flaw in custodial withdrawal systems is collapsing two distinct events — a user's request and the actual fund transfer — into a single function call, leaving no room for intermediate actions. This design eliminates the ability to cancel a request, batch transactions, control fee pricing, or recover cleanly when a node call times out. The proposed fix treats a withdrawal as an immutable record with an explicit state machine, moving through stages such as requested, approved, sending, sent, and confirmed. Each state transition returns a new record rather than mutating an existing one, creating an append-only history that makes auditing and incident response straightforward. The key insight is that a withdrawal should exist as a piece of data the system fully controls before it becomes an irreversible event on the network.