Private Multisig Security Model

A Private Multisig requires multiple authorized members to approve sensitive actions according to a configured threshold.

Thresholds

The first number is the approvals required. The second is the total number of members.

2-of-3: two approvals from three members
3-of-5: three approvals from five members
5-of-7: five approvals from seven members

There is no universally correct threshold. Choose one that limits single-signer risk without making normal recovery and operations impractical.

Proposal flow

Create a proposal
  |
  v
Review the exact action
  |
  v
Approve or reject
  |
  v
Reach the required threshold
  |
  v
Verify the payload and execute

Discussion, approval, and execution are separate steps. Chat messages or labels do not count as authorization.

What the model protects against

If fewer wallets are compromised than the approval threshold, an attacker should not have enough approvals to execute a vault action.

One wallet is compromised
  |
  v
The approval threshold is not met
  |
  v
The proposed action cannot execute

This protection depends on wallet-scoped access, signer records, hidden signer authorization, payload verification, and on-chain checks working as intended.

What it does not protect against

The model cannot prevent:

• Enough authorized members approving a malicious or mistaken proposal
• Members exposing recovery phrases or signer secrets
• Users approving the wrong recipient, amount, or payload
• Risks in wallets, networks, smart contracts, or third-party infrastructure

Keep membership current, review every proposal, and use independent signing devices where practical.