Gnosis Safe
Decentralized Self Custody for Digital Assets
full disclosure: I work at an mpc based wallet provider
Gnosis provides the “Safe” product which is a multiple signature wallet used by groups in the web3 space primarily to secure shared assets in a decentralized manner. The ability to custody and utilize assets is a foundational requirement for any organization in this space. The default solution is a multisig wallet since they’re cheap and easy to spin up while adhering to the broader tenets of crypto. I’ve specifically chosen to look at Gnosis’ Safe solution because it is overwhelmingly the most used multisig on Ethereum due to its track record of security, ability to self custody, decentralized nature, and fully on chain approach. Safe’s first mover advantage has been effectively captured by the Gnosis team and continues to attract users and organizations on its branding strength. Developers are empowered to build out additional functionality that can be integrated through SafeApps or modules. There are even full on entrepreneurs that want to build products using Safe as a platform. Multisig wallets are critical infrastructure for up and coming projects as well as some of those that are already behemoths in the space. I’ll try to provide a fundamental understanding of their capabilities as another piece in the puzzle for a greater perspective on the current and future state of the crypto ecosystem.
Multisig:
Multisig wallets have a couple properties that are pretty straight forward. Safe uses a smart contract implementation though it is worth noting that Bitcoin has a native protocol for their multisig implementation if you want to dig further into that. In a typical transaction you’ve got stuff like destination, gas costs, data payload, and that’s all ultimately signed by an individual’s private key. When a multisig wallet smart contract is setup there is an additional layer of process that’s created within a contract. There is a list of all the signers who can sign off on a transaction as well as what the quorum requirement is for how many of those signers are required to execute a transaction. That’s pretty much all it takes to get started, plus a bit of gas to pay the initial setup costs.
Interface:
Once you’ve got a new multisig wallet it’ll have its own address that you’re able to custody any tokens or NFTs in with the rest of your fellow signers. There’s a basic web UI that allows you to view your assets and initiate new transactions, which is the floor of capabilities you would expect. There’s a Transactions log containing all transactions with creators and signers to provide some accountability as well as an “address book” so you can save commonly used addresses and minimize the chances of an accidental copy paste or fat fingers.
Moving into the more interesting capabilities there’s an “Apps” section which allows you to open a version of each app within the browser interface and supports the multisig transactions with that protocol. An easy example is something like Aave which works just the way you expect with the only difference being the multiple signatures. There are however some unique apps that pair especially well with a multisig implementation. If there’s a Dapp that is not currently integrated via its own SafeApp the WalletConnect app provides a QR code to allow a multisig to interact with any Dapp that’s supported. This serves as a catch all to interact with most of web3 even if there’s not an officially supported SafeApp. If an organization is going way off road the ability to add fully custom apps is also supported. Another notable SafeApp is the TransactionBuilder. This one is pretty cool in that it allows you to build a bunch of smaller transactions into a single batched transaction which optimizes for gas costs and signature overhead. It’s super technical in that the creation of raw messages is required, but depending on what needs to be taken care of, this sort of flexibility can be very valuable. To wrap this up, here’s the disclaimer that goes with SafeApps “It is at the sole discretion of Gnosis to list or delist apps from the Safe. Safe Apps are not owned, controlled, maintained, or audited by Gnosis.”
Get Prezzel’s stories in your inbox
Join Medium for free to get updates from this writer.
Down in the “Settings” portion of the interface there’s a couple classics like “what should the safe be called” and everyone's first move which is to flip on dark mode. Then there’s Owners and Policies sections which I dug into a bit because I wanted to determine how the owners could be updated and the quorum requirements changed when Eth smart contract were supposed to be immutable. The way this works is that there are a couple different smart contracts that handle the different functionality. One that controlled the actual safe and then another that manages the owners and quorum variables. Updating those values is done via a function in the existing smart contract so you have to successfully execute a transaction with the existing multisig parameters. If that’s possible then the existing signers are able to update the owners and quorum variables stored in the smart contract as the needs of the organization change.
The “Spending Limit” portion allows the signers to configure beneficiaries which are able to access funds within the Safe without needing to collect all the signatures which includes an allowance limit. Specific spending limits can also be placed on any assets in the safe with a configurable reset time of a day, week, or a month. I suppose this protects from a nefarious contract draining all of an asset, but if the multisig itself is compromised this would be little more than a speed bump to draining all the assets. Overall this provides some amount of flexibility and accident protection but lacks the robustness of access control I would expect in something that’s so widely adopted for organizations.
Extensibility:
One of the most powerful characteristics of the Safe is that it’s open source and provides industrious users with the ability to use pre-made modules or write and integrate their own. Modules operate below the quorum requirement. This provides the opportunity to build an entirely separate access control logic which can be tailored to an organization and provide much greater security provided the smart contract is rock solid. Some of the existing modules include some of the basics like providing allowances or setting up recurring transfers. The really interesting ones though are more advanced for specific use cases. The “Optimistic Governor” for example allows on-chain executions based off of Snapshot proposal results using an oracle. Snapshot is an off-chain way to do DAO governance. That’s the sort of flexibility this approach affords the broader ecosystem. The ability of a third party to provide a module that marries off-chain governance with on-chain action serves to improve participation in DAO votes by sidestepping gas costs by the majority of members while still providing on-chain impact. This module approach allows anyone utilizing a Safe multisig to plug in their own smart contracts to get the exact experience they need and then offer that to the broader community.
A recently added feature that provides some operational security is the ability to implement Transaction Guards. Transaction Guards operate above the quorum requirement. Once everyone has signed off and the transaction is being sent to the execution step the transaction guard is an opportunity to check all the parameters that are being passed to the execution step and revert the transaction if they don't pass the check. The docs leave a lot to be desired for such a widely adopted solution and I’m not sure why you would use a guard instead of a module. Also their discord was not particularly helpful compared to other projects I’ve evaluated.
There are multiple products that are using Safe as the underlying platform to provide their own enhanced custody services with things such as more robust access controls, fine tuned governance, or more enterprise friendly interfaces for the more common use cases. One of the really powerful integrations is Metamask Institutional which provides enterprise features such as compliance reporting and know your transaction capabilities which are critical for enterprise customers. Beyond the feature additions though is the ability to tap into the ConsenSys professional services arm to outsource any custom smart contract work that needs to be done to further tailor the experience.
Summary:
There’s definitely some weakness in multisigs as they exist today in how they align to the practical needs and overall goals of a web3 future. I think over time a lot of those gaps will be filled by modules or premium offerings built on top of Safe. The one exception would be a chain agnostic Safe solution. I saw a “bridge” module that looked interesting, but I believe a Gnosis chain coupled with some interoperability protocol and an MPC implementation across the validators may turn out to be the solution. A lot of the documentation touts “security” which may be technically true, but the numerous compromises of multisig wallets may indicate a fundamental flaw in the approach. I also don’t believe I saw any mention of multi-party computation in their docs anywhere, which I think when implemented correctly provides better security.
A multisig takes a couple dollars in a gas and less than a minute to stand up. It’s no wonder why it’s the default wallet infrastructure for web3 organizations. The fully on chain approach provides visibility and by using a smart contract it can be plugged in before or after any other smart contract to put a decentralized approval choke point on anything that’s happening. The open source approach means the community will build and solve most of the problems for free and share them with other users which I would expect to further solidify the monopoly that Safe has on the custody of digital assets on Ethereum for web3 native organizations.
