安全选择和多重签名钱包

See how LogRocket's Galileo AI surfaces the most severe issues for you No signup required

Multi-signature wallets are smart contracts that require the agreement of multiple people to perform an action. They can be useful for protecting assets (using separation of duties) or to ensure that certain actions are only taken in accordance with the wishes of the multisig’s owner or a majority of owners.

This article focuses on how to make the best design choices when setting up a multisig and how to avoid common mistakes. We’ll walk through demos of several different multisig configurations. Once you’ve set up your multi-signature wallet, you can add it to your application.

Jump ahead:

Why do we need multisigs?

There are many cases in which we want actions to be approved by multiple people. Here are a few examples:

Divided ownership

If an asset is owned by multiple people in common, especially an on-chain asset, a smart contract can verify that it is used only in accordance with the wishes of the owners. The blockchain also provides an audit trail that shows which owners approved any action, so it is impossible for owners to later pretend they did not approve.

Separation of duties

Even when an asset is owned by a single entity, multisigs can be useful for implementing separation of duties. When multiple people are required to sign off on an action both fraud and innocent mistakes are a lot less likely. In these cases, the tradeoff is between security (more signers mean you’re safer) and speed (more signers mean it takes longer to do anything).

Audit trail

There are cases where multiple people are allowed to perform an action, and we just want to know who executed the action. By using a multisig that requires only a single signature, we can cover this use case without the security risks associated with a shared account.

How does a multisig work?

Entities on the blockchain, such as a multisig contract, can only directly affect other blockchain entities. The actions that a multisig can control are therefore those that can be accomplished by calling a smart contract, such as transferring ERC-20 tokens or an NFT.

Multisigs have multiple signature addresses that are authorized to perform an action, either individually or when approved by a group of a specific size. Every signature address is a different Ethereum address, typically derived from a different recovery phrase and owned by a different person. Later in this article, we’ll discuss circumstances in which you may want to give a single person control of more than one signer address.

Types of multisigs

Most multisigs implement an M-of-N requirement. This means that there are N total signers, of which M have to approve and sign before the action occurs. This is called an M/N multisig; the ratio of M to N is called the quorum quotient. For example, a 3/5 multisig would have five signers, three of whom would need to agree to or approve an action.

The tradeoffs in setting up the parameters of a multisig come down to tradeoffs between security on one hand and ease and availability on the other.

The more signers you have (high N) and the fewer signers that are needed (low M), the easier it is to find the necessary people to perform an action

If you have fewer signers (low N), the chance of a mistake or an outright hack being approved should be reduced

Requiring more signers (high M) could translate to more oversight and improved security, but if M is too high you’ll get diffusion of responsibility; key players may assume that someone else is handling whether an approval should be made

Demo: Creating a multisig wallet

To learn more about the multisig quorum quotient and compare different cases, let’s create a wallet for a company with four managers. In our example, the multisig will need to be accessed to change a greeting. We’ll look at three configurations: no multisig, 1/3 multisig, and 2/4 multisig.

Of course, the purpose of this example is simply to demonstrate the multisig, not the contract it controls. In real-world applications, contracts generally perform more valuable functions than changing a greeting and they generally limit the number of individuals who can make a change.

No multisig

Before we actually get to the multisig we should set up our lab environment and target contract (the contract the multisig controls). The lab environment runs on top of the Goerli test network. If you need Goerli test ETH, you can get it at this faucet.

For our demo, we’ll use a simple smart contract called Greeter.sol , which I deployed with Hardhat. You can see it here.

To see the current greeting, open Contract > Read Contract and then expand greet.

To modify the current greeting, open Contract > Write Contract. Then, click Connect to Web3 to connect to the wallet. After selecting a wallet from the listed options, click setGreeting and type the new greeting. Then, click Write and approve the contract in the wallet.

Note that due to caching, after you change the greeting you may need to reload the contract a few times before you’re able to see the new greeting.

1/4 multisig (one signature required)

The demo multisig was created with Gnosis Safe, which is probably the most common multisig platform.

The addresses that are authorized to use the multisig are all derived from the passphrase: “dumb cart rally entry iron flock man demise record moon erode green”

The addresses are as follows:

0x3646468082813B33BF7aab1b8333Aa01fEe8a386

0x8c262b009B05e94D3ffF1Ce4cEa8Da0ba450c793

0x126FE1acDB5A5101B80Dc68A0b0dc882BFeEe5A6

0x0C48dfb3FAaFBCECF21f0D1F4e75E1fE6e731Ad6

0x934003bC77b9D427c4a441eBef2086AA089Ed0C5

0x9D5f666b29D0dd2397fDbc093fdaCAa0EF6e7377