A wallet with no owner. Every member keeps their own key on their own device, and the money moves when enough of them have signed — any two of three, any five of nine, whatever the group set when it made the wallet.
Nothing below is a construct of ours. Each chain already has a way for several people
to hold one address, and this uses that way: P2WSH on Bitcoin, Safe on the EVM chains,
the account’s own permission system on Tron, Squads V4 on Solana. The addresses
on the pages that follow are the deployments this application talks to.
HOW IT WORKS
Four steps, and only the last one is on a chain
A payment is a conversation before it is a transaction. That is not a metaphor here — it happens in the thread, as messages, and the chain sees it only once the group has agreed.
1
The group fixes the rule
Who signs, and how many of them it takes. It is written into the wallet at the moment it is made, and it is on the chain rather than in this application.
The rule is not edited afterwards here: a different rule is a different wallet, with its own address to fund and move to. Some chains would allow the change and this application does not make it, so the screen says so before it asks for the second tap.
2
Somebody proposes a payment
It arrives in the conversation as a message, from the person who made it, saying what it pays and to whom. Until it is signed it is a request and nothing else.
The proposal is carried by the same encrypted group the chat uses, so the server carries it without reading it.
3
Each signer signs on their own device
Read it, tap once, and it is signed with a key that has never left the phone it was made on. Everybody sees the count move.
No device ever holds a second person’s key, so there is no device whose loss hands anybody the wallet.
4
At the threshold it goes to the chain
The signatures are assembled and broadcast. What enforces the rule from there is the chain, not this application — which is the point of putting the rule there.
If this application disappeared tomorrow, the wallet would still be a wallet and the rule would still hold.
FIVE CHAINS
What each chain calls “several people, one address”
Five chains and four pieces of machinery — Ethereum and BNB Smart Chain are the same one. Bitcoin builds and finalises a transaction that carries every signature; the EVM chains keep a contract that counts them; Solana keeps the proposal on chain and approves against it; Tron writes the rule into the account itself. The group does the same thing on all of them, and underneath it is four different pieces of machinery.
Bitcoin
P2WSH multisig · BIP 67 · PSBT
A witness script that reads m of these n keys, and an address that is the hash of it. The keys are sorted lexicographically, so everybody who builds the script from the same set of keys arrives at the same address rather than at n! different ones.
The payment travels as a PSBT: one file that goes round the signers picking up signatures, and is finalised when it has enough.
Script
OP_m <key>… OP_n OP_CHECKMULTISIG
Signers
up to 15, threshold anywhere in between
Chain data
an Electrum server
Ethereum
Safe · canonical deployment
The contract most of the money held by groups on Ethereum already sits in. A proxy is made by the canonical factory and points at the canonical singleton; the owners and the threshold are set in the same call that makes it.
Nothing is forked and nothing is redeployed. The version is read off the contract rather than assumed, because a Safe made by somebody else is a Safe this can open.
Singleton
0x41675C099F32341bf84BFc5382aF534df5C7461a
Factory
0x4e1DCf7AD4e460CfD30791CCC4F9c8a4f820ec67
Batching
MultiSend — several moves, one approval
BNB Smart Chain
Safe · the same addresses
The same contracts at the same addresses. Safe’s deployments are deterministic across EVM chains, so there is nothing chain-specific to learn here and nothing chain-specific in the code either.
It is also why an account on Ethereum is the same account on BNB Smart Chain: one coin type, one key, two chains.
Contracts
identical to Ethereum’s, above
Coin type
60 — shared with Ethereum
Tron
Account permissions · no contract
Tron has the rule built into accounts. A permission carries a list of keys, a weight for each and a threshold, and it is written to the account itself — there is no contract to deploy and no contract to trust.
Weights mean the rule can be something other than counting heads: one key worth two votes, three keys worth one each.
Written by
AccountPermissionUpdate
Rule
weighted keys, one threshold
Note
the update replaces the list rather than amending it
Solana
Squads Protocol V4
The multisig program most of Solana’s treasuries use. The proposal is an account on chain: members approve against it, and it executes when the approvals reach the threshold.
The program id decides where every account of the wallet is derived, so it is pinned to the published deployment and a different one is refused rather than trusted.
Program
SQDS4ep65T869zMMBKyuUq6aD6EgTu8psMjkvj52pCf
Proposal
on chain, approved against
WHY STANDARD ONES
A wallet you can only open here is a wallet somebody else owns
There is an easier way to build this: one contract of our own on every chain, one format of our own, one application that understands it. It would be less code and it would be worse, because the group’s money would then depend on this application continuing to exist.
What using the standard ones buys
Each of these is a consequence of the choice, not a feature that was added.
Audited by more people than us. Safe and Squads hold billions between them and have been
looked at accordingly. P2WSH and Tron’s permissions are consensus rules.
Readable by other tools. The address is an ordinary Safe, an ordinary Squads multisig, an
ordinary P2WSH address, an ordinary Tron permission — block explorers and the protocols’
own interfaces read them without knowing this application exists.
Nothing to migrate from. There is no proprietary format to be stuck in, so there is no
moment later where leaving costs something.
The rule outlives us. The threshold is enforced by the chain. This application is where
the group talks about the payment, not what permits it.
AUDITS
Read by people who are not us
This is the argument for using each chain’s own multisig rather than writing
one: the reports below exist, they were paid for by somebody else, and they are about exactly the
contracts a wallet made here is made of. Every address and every program id on this page was checked
against the projects’ own published deployment records while this section was written.
Safe
Ethereum · BNB Smart Chain
2 reports
The four contracts this application talks to are the canonical
v1.4.1 deployments — singleton, proxy factory, fallback handler and MultiSend —
each one matching the address in Safe’s own deployment registry.
Four reports, three firms and a formal verification. The program id this
application pins is the one the program declares for itself in its own source.
There is nothing here for an auditor to be hired for, and that is the point:
a multisig on Bitcoin is not a deployed program but a script the network’s own rules
evaluate. What is worth reading instead is the specification.
The same again: the rule is a property of the account, enforced by the
nodes rather than by code somebody deployed. There is no contract to audit because there is no
contract.
Nothing to link, and that is the honest answer
An audit is a reading of a codebase at a commit, not a guarantee about the money in
it — and none of these reports is about this application. They are about the contracts underneath
it, which is exactly why they are worth more than a report we commissioned about ourselves would be.
BRINGING A PHRASE
Twenty-four words you have used somewhere else
A recovery phrase is not one convention, it is several, and they disagree about the same thing: which element of the path moves when you ask for “account 2”. Every one of them is correct, and a phrase read under the wrong one shows a zero balance for money that is exactly one line of arithmetic away. So the convention is not guessed at — it is a setting, one per chain, and it offers a list of applications rather than a list of specifications. Money that looks missing is money at a path this app was not looking at.
Bitcoin
Native SegWitdefault
m/84'/0'/{account}'/0/0
Electrum
BlueWallet
Sparrow
Exodus
Address index
m/84'/0'/0'/0/{account}
Trust Wallet
Muun
Phoenix
Ethereum & BNB Smart Chain
Address indexdefault
m/44'/60'/0'/0/{account}
MetaMask
Rabby
Trust Wallet
Rainbow
Phantom
Hardened account
m/44'/60'/{account}'/0/0
Ledger Live
Trezor Suite
Exodus
Four elements
m/44'/60'/0'/{account}
MyEtherWallet (legacy)
Ledger (legacy)
Tron
Address indexdefault
m/44'/195'/0'/0/{account}
TronLink
Trust Wallet
Hardened account
m/44'/195'/{account}'/0/0
Ledger Live
Trezor Suite
Solana
Four elementsdefault
m/44'/501'/{account}'/0'
Phantom
Solflare
Backpack
Account only
m/44'/501'/{account}'
Ledger Live
Solflare (hardware)
Legacy
m/501'/{account}'/0/0
Sollet (legacy)
Bitcoin’s legacy and nested layouts are deliberately absent. The address
builder derives native SegWit and nothing else, so a m/44'/0'/… here would produce a
bc1… where every other wallet shows a 1… or a 3…
— a string that looks right, belongs to your phrase, and is not the address anybody else reads off
that path. A choice that quietly means something other than what it says is worse than no choice.
BRINGING A WALLET
Coming from somewhere else
Two ways in, and they are at different stages
Said plainly, because a page that describes what is planned in the same voice as what is built is a page you cannot use to decide anything.
Your recovery phrase — here now. Twenty-four words, and the question about which
wallet you used them in. Every address the table above describes is derived on your device from the
phrase and stored nowhere; an EVM account, a Tron account and a Solana account are the same address
on every network of that chain.
A multisig that already exists — not yet. Reading one is done: the library behind
this opens a Safe by address and reports its owners, threshold and version; it reads a Squads
multisig’s members and threshold, a Tron permission’s signers and weights, and decodes a
Bitcoin witness script back to its address, threshold and keys. What is not built is the screen that
walks you through it and attaches it to a conversation. Until it is, this page will not pretend
otherwise.
Nothing stops you in the meantime: a Safe or a Squads multisig you already have keeps working in the interface you made it in, because it was never anything other than a Safe or a Squads multisig.
COMPAX