A lot of people are now looking to multisig as “the” solution for the recent data leak incidents with trezor, ledger, coldcard etc. Even though I could be biased building
@safe I can tell you that there is no silver bullet. However the fundamental choices Safe made in its design are to help people be more in control of their custody, security and sovereignty. A more secure setup than a standard EOA.
Crypto industry has a tendency to use these incidents as trigger points in order to influence buyer choices with a cheeky marketing tactic like “How our solution X could have prevented the hack Y” — it’s FUD.
The real hard work is in addressing these security goals proactively and bake them into your design choices. And yes, it makes your build more complicated and complex — I think many people in crypto will tell you that it’s not easy to build in web3. We don’t do it because it’s easy and helps people get rich, we do it because it’s a better way to build finance and helps people be more free.
When you’re using self custody, a simple question to ask yourself is how to avoid “single point of failure” — be it a hardware wallet or a software wallet. A single private key loss should not result in a full compromise of your account. You shouldn’t be forced to share your personal details to having basic self custody over your owned assets.
If you’re looking into Multisig, a simple and strong setup for a cold wallet could look like
- a 2-or-3 setup with a self-custody recovery
- Use hardware + dedicated mobile devices for signers. Leverage Safe Mobile
- Make these signers dedicated to the multisig account
- A clean and curated address book
This would already go a long way and be far superior to a single wallet setup. My personally preferred use case for hardware devices are for signing only and not for storage.
A more advanced setup would involve
- Onchain policy like an allowlist of addresses you interact with (ex: hot wallets)
- Another onchain policy like a time delay on your transactions
- A solution over your account setup to monitor any drift in risk and be notified (ex: address poisoning, private key compromise, etc)
- A solution over your assets and defi positions and be notified so you can act quickly (ex: protocol compromise, stablecoin depeg, etc)
- An even more advanced setup would be to have means to auto unwind your positions
An important note: a cold wallet setup is intentionally meant to be designed with friction to move assets. These are your long term holdings, your life savings etc — it should not be overly convenient to operate these. Having a separate hot wallet is always the best practice.
All of these are possible with
@safe multisig products today and we’re increasingly productizing these without compromising user sovereignty. Safe allows you to be intentional with your setup, your security and your convenience configuration. There is no silver bullet for the ultimate secure setup in anything. But that doesn’t mean that you can’t harden your setup. You should.