From e3010d5654cdf898024b76583ed4a413cadeaaab Mon Sep 17 00:00:00 2001 From: matta Date: Sun, 26 Jul 2026 22:00:22 -0300 Subject: [PATCH 1/6] docs(multisig-for-protocols): normalize structure and wording Add canonical Key Takeaways across the framework andT runbooks, rewrite overview page map with role routing and related frameworks, add fact-checked roles and Further reading separators. Preserve procedure and checklist bodies. --- .../backup-signing-and-infrastructure.mdx | 7 + .../communication-setup.mdx | 11 +- .../emergency-procedures.mdx | 7 + .../implementation-checklist.mdx | 7 + .../incident-reporting.mdx | 10 ++ .../joining-a-multisig.mdx | 10 ++ .../multisig-for-protocols/key-takeaways.mdx | 8 ++ .../multisig-for-protocols/offboarding.mdx | 10 ++ .../pages/multisig-for-protocols/overview.mdx | 130 ++++++++++++------ .../personal-security-opsec.mdx | 10 ++ .../planning-and-classification.mdx | 7 + .../registration-and-documentation.mdx | 7 + .../runbooks/emergency-pause.mdx | 7 + .../runbooks/overview.mdx | 7 + .../runbooks/signer-rotation.mdx | 7 + .../runbooks/threshold-change.mdx | 7 + .../runbooks/token-transfer.mdx | 7 + .../setup-and-configuration.mdx | 7 + .../use-case-specific-requirements.mdx | 10 ++ 19 files changed, 232 insertions(+), 44 deletions(-) diff --git a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx index ecd3d0803..53e518625 100644 --- a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx +++ b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from "../../../components" @@ -19,6 +21,9 @@ import { TagList, AttributionList, ContributeFooter } from "../../../components" +> πŸ”‘ **Key Takeaway**: Practice alternate Safe/Squads clients before the primary UI fails; backup +> infrastructure is useless if first used during an incident. + If the default interfaces for either Safe or Squads are down or suspected of being compromised, these alternatives enable continued critical signing operations. As a signer, you should familiarize yourself with these tools and practice signing transactions with your team. @@ -233,4 +238,6 @@ Verification](/wallet-security/signing-and-verification/secure-multisig-safe-ver - [Emergency Procedures](/multisig-for-protocols/emergency-procedures) - General emergency response - [Communication Setup](/multisig-for-protocols/communication-setup) - Backup communication during outages +--- + diff --git a/docs/pages/multisig-for-protocols/communication-setup.mdx b/docs/pages/multisig-for-protocols/communication-setup.mdx index 028cd8cbb..1f45172aa 100644 --- a/docs/pages/multisig-for-protocols/communication-setup.mdx +++ b/docs/pages/multisig-for-protocols/communication-setup.mdx @@ -8,9 +8,10 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] - - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -20,6 +21,12 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' +> πŸ”‘ **Key Takeaway**: Give every multisig a dedicated E2EE primary channel, a backup on a different platform, +> and paging for critical response windows. + +Establish secure primary and backup channels before the first real signing ceremony so +emergencies are not the first time the team coordinates. + ## Primary channel Set up a dedicated communication channel for multisig operations: @@ -46,4 +53,6 @@ For multisigs requiring rapid response: - Link to emergency runbooks in notification message - Test quarterly to ensure reliability +--- + diff --git a/docs/pages/multisig-for-protocols/emergency-procedures.mdx b/docs/pages/multisig-for-protocols/emergency-procedures.mdx index 9eed7b778..63d951402 100644 --- a/docs/pages/multisig-for-protocols/emergency-procedures.mdx +++ b/docs/pages/multisig-for-protocols/emergency-procedures.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -19,6 +21,9 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' +> πŸ”‘ **Key Takeaway**: Pre-agree compromise, lost-key, and channel-breach steps so the team can rotate or +> freeze without improvising under pressure. + When security incidents occur, quick and decisive action is critical. This page covers procedures for key compromise, lost access, and communication breaches. @@ -235,4 +240,6 @@ and use the runbook page for the transaction-specific signing and execution step - [Personal Security (OpSec)](/multisig-for-protocols/personal-security-opsec) - Account security measures - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - Example runbooks for common operations +--- + diff --git a/docs/pages/multisig-for-protocols/implementation-checklist.mdx b/docs/pages/multisig-for-protocols/implementation-checklist.mdx index d27621a28..8b72925d7 100644 --- a/docs/pages/multisig-for-protocols/implementation-checklist.mdx +++ b/docs/pages/multisig-for-protocols/implementation-checklist.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../components' @@ -19,6 +21,9 @@ import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../ +> πŸ”‘ **Key Takeaway**: Do not go live until admins and every signer can complete the role checklist: plan, +> hardware, verification skills, emergency drills, and OpSec baseline. + This checklist ensures all multisig participants have the knowledge and skills necessary for secure operations. Complete all applicable sections before beginning multisig operations. @@ -272,4 +277,6 @@ Additional training required after: All documents in this framework serve as training materials. Refer to individual documents for detailed procedures and requirements specific to your role. +--- + diff --git a/docs/pages/multisig-for-protocols/incident-reporting.mdx b/docs/pages/multisig-for-protocols/incident-reporting.mdx index 86a70b14d..fbbdba53c 100644 --- a/docs/pages/multisig-for-protocols/incident-reporting.mdx +++ b/docs/pages/multisig-for-protocols/incident-reporting.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -19,6 +21,12 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' +> πŸ”‘ **Key Takeaway**: Report suspected key compromise and account takeovers immediately; operational tooling +> failures within 24 hours and with enough detail to act. + +Fast, accurate reporting is how a compromised key becomes a rotation instead of a drain. +Use the definitions and templates below. + ## What to Report ### Security incidents (report immediately) @@ -131,4 +139,6 @@ Additional notes: [Any other relevant information] ``` +--- + diff --git a/docs/pages/multisig-for-protocols/joining-a-multisig.mdx b/docs/pages/multisig-for-protocols/joining-a-multisig.mdx index 4d6276b3a..a83d8072e 100644 --- a/docs/pages/multisig-for-protocols/joining-a-multisig.mdx +++ b/docs/pages/multisig-for-protocols/joining-a-multisig.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r, ElliotFriedman] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -19,6 +21,12 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' +> πŸ”‘ **Key Takeaway**: Join with a dedicated hardware-wallet address per multisig and prove ownership before +> you are relied on to sign. + +Complete dedicated-key setup and address ownership proof before accepting signer +responsibility on a protocol multisig. + ## Use a Dedicated Key for Each Multisig Always create a fresh address on a hardware wallet for each new multisig you join. Use a different address index on @@ -80,4 +88,6 @@ Note: Enter plain text message (not the hex version MyEtherWallet will give!) an Note that "msg" is hex text starting with 0x (add 0x before the hex encoded string if necessary). 4. See whether the signature provided is valid. +--- + diff --git a/docs/pages/multisig-for-protocols/key-takeaways.mdx b/docs/pages/multisig-for-protocols/key-takeaways.mdx index e3f7fdf84..96ebab88a 100644 --- a/docs/pages/multisig-for-protocols/key-takeaways.mdx +++ b/docs/pages/multisig-for-protocols/key-takeaways.mdx @@ -11,6 +11,8 @@ contributors: users: [isaac] - role: reviewed users: [ElliotFriedman] + - role: fact-checked + users: [] --- import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components' @@ -23,6 +25,9 @@ import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } fr +> πŸ”‘ **Key Takeaway**: If you only read one multisig page, read this one: timelocks, function separation, +> dedicated keys, calldata verification, and monitored queues beat unenforced policy. + If you read one page from the Multisig Security Framework, make it this one. These are the principles that matter most. The principles below are universal, but many of the examples and tooling references are EVM/Safe-centric. Other @@ -120,4 +125,7 @@ that communication channels work. See the For the full framework, see the [Multisig Security Framework Overview](/multisig-for-protocols/overview). + +--- + diff --git a/docs/pages/multisig-for-protocols/offboarding.mdx b/docs/pages/multisig-for-protocols/offboarding.mdx index c0d440924..1cdc7e7dc 100644 --- a/docs/pages/multisig-for-protocols/offboarding.mdx +++ b/docs/pages/multisig-for-protocols/offboarding.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r, mattaereal] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -19,8 +21,14 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' +> πŸ”‘ **Key Takeaway**: Leaving a multisig is not logout: coordinate rotation, confirm on-chain removal, and +> wipe local signing state so residual access cannot linger. + When leaving a multisig, follow these steps: +Coordinate removal so residual access cannot survive a role change. Follow the sequence +below end to end. + ## Signer removal 1. **Coordinate with team** - Notify other signers and schedule the removal transaction @@ -51,4 +59,6 @@ policy and make sure it is understood by all signers. For example: - Share any relevant context or pending items with remaining signers - Provide contact information if needed for transition questions +--- + diff --git a/docs/pages/multisig-for-protocols/overview.mdx b/docs/pages/multisig-for-protocols/overview.mdx index a9d69b057..594522fa7 100644 --- a/docs/pages/multisig-for-protocols/overview.mdx +++ b/docs/pages/multisig-for-protocols/overview.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Security Framework | SEAL" -description: "Multisig Security Framework: Complete guide for setup, signer onboarding, hardware wallet requirements, transaction verification, and emergency procedures." +description: "Multisig security for protocols: plan and classify risk, configure Safe/Squads, onboard signers, run operational runbooks, and prepare emergency and backup signing paths." tags: - Engineer/Developer - Security Specialist @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -19,62 +21,104 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' -## How to use this guide - -**Short on time?** Start with [Key Takeaways](/multisig-for-protocols/key-takeaways) for the most important points -on one page. +> πŸ”‘ **Key Takeaway**: Protocol multisigs fail operationally more often than cryptographically. Separate functions, match +> thresholds to blast radius, verify calldataβ€”not just hashesβ€”and drill emergency and backup paths. -**Quick start**: New to multisigs? Start with the Foundation for the essentials, then jump to your role: +This framework covers how protocols and product teams design, deploy, operate, and exit multi-signature control of +privileged actions: upgrades, parameters, treasury, and emergency pause. Wallet construction and seed hygiene live +primarily in [Wallet Security](/wallet-security/overview); this family focuses on protocol multisig administration and +signer operations. -- Setting up a new multisig? β†’ Multisig Administration: [Setup & - Configuration](/multisig-for-protocols/setup-and-configuration) and [Registration & - Documentation](/multisig-for-protocols/registration-and-documentation) -- Joining as a signer? β†’ [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) and [Hardware Wallet Setup](/wallet-security/intermediates-and-medium-funds) -- Need to sign a transaction? β†’ Signing & Verification: -[Safe Multisig](/wallet-security/signing-and-verification/secure-multisig-safe-verification) and -[Squads](/wallet-security/signing-and-verification/secure-multisig-squads-verification), plus -[Operational Runbooks](/multisig-for-protocols/runbooks/overview) -- Emergency situation? β†’ [Emergency Procedures](/multisig-for-protocols/emergency-procedures) +**Short on time?** Read [Key Takeaways](/multisig-for-protocols/key-takeaways) first. ## Core principles -- **Security first**: Every multisig must meet [minimum security standards](/wallet-security/secure-multisig-best-practices) -- **Built-in slowness**: Timelocks and review windows are intentional security mechanisms, not obstacles to work around -- **Constrained emergency powers**: Emergency bypass mechanisms should do the minimum necessary and nothing more +- **Security first**: Meet [minimum multisig standards](/wallet-security/secure-multisig-best-practices) +- **Built-in slowness**: Timelocks and review windows are intentional controls, not friction to bypass +- **Constrained emergency powers**: Bypass paths should do the minimum necessary and nothing more - **Operational readiness**: Procedures that work under pressure -- **Clear accountability**: Everyone knows their role and responsibilities -- **Emergency preparedness**: Plans for when things go wrong +- **Clear accountability**: Defined roles for proposers, signers, and executors +- **Emergency preparedness**: Documented loss-of-key and channel-compromise paths + +## How to use this guide -## Framework Structure +- **New multisig setup**: [Planning & Classification](/multisig-for-protocols/planning-and-classification) β†’ + [Setup & Configuration](/multisig-for-protocols/setup-and-configuration) β†’ + [Registration](/multisig-for-protocols/registration-and-documentation) +- **Joining as a signer**: [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) and + [Hardware Wallet Setup](/wallet-security/intermediates-and-medium-funds) +- **Signing a transaction**: + [Safe verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification), + [Squads verification](/wallet-security/signing-and-verification/secure-multisig-squads-verification), + [Runbooks](/multisig-for-protocols/runbooks/overview) +- **Emergency**: [Emergency Procedures](/multisig-for-protocols/emergency-procedures) +- **Readiness check**: [Implementation Checklist](/multisig-for-protocols/implementation-checklist) + +## What this framework covers + +### Foundation + +1. [Key Takeaways](/multisig-for-protocols/key-takeaways): highest-leverage principles on one page +2. [Secure Multisig Best Practices](/wallet-security/secure-multisig-best-practices): core requirements (Wallet + Security) + +### Multisig administration + +1. [Planning & Classification](/multisig-for-protocols/planning-and-classification): impact assessment and thresholds +2. [Setup & Configuration](/multisig-for-protocols/setup-and-configuration): deploy and configure on supported networks +3. [Registration & Documentation](/multisig-for-protocols/registration-and-documentation): inventory and audit trail +4. [Communication Setup](/multisig-for-protocols/communication-setup): primary, backup, and paging channels +5. [Use Case Specific Requirements](/multisig-for-protocols/use-case-specific-requirements): separation, timelocks, + treasury patterns +6. [Operational Runbooks](/multisig-for-protocols/runbooks/overview): token transfer, signer rotation, threshold + change, emergency pause + +### For signers + +1. [Joining a Multisig](/multisig-for-protocols/joining-a-multisig): dedicated keys and proof of ownership +2. [Emergency Procedures](/multisig-for-protocols/emergency-procedures): compromise and lost-access response +3. [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure): alternate UIs when + primary fails +4. [Personal Security (OpSec)](/multisig-for-protocols/personal-security-opsec): accounts, devices, travel +5. [Incident Reporting](/multisig-for-protocols/incident-reporting): what and how to report +6. [Offboarding](/multisig-for-protocols/offboarding): leave a signer role cleanly + +Related signer hardware and verification (Wallet Security): + +- [Hardware Wallet Setup](/wallet-security/intermediates-and-medium-funds) +- [Seed Phrase Management](/wallet-security/seed-phrase-management) +- [Safe Multisig: Step-by-Step + Verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification) +- [Squads Multisig: Step-by-Step + Verification](/wallet-security/signing-and-verification/secure-multisig-squads-verification) -### 1. Foundation +### Reference -- [Secure Multisig Best Practices](/wallet-security/secure-multisig-best-practices) - Core requirements for all multisigs +1. [Implementation Checklist](/multisig-for-protocols/implementation-checklist): administrator and signer readiness -### 2. Multisig Administration +### Runbooks subsection -- [Planning & Classification](/multisig-for-protocols/planning-and-classification) - Assess requirements and classify risk -- [Setup & Configuration](/multisig-for-protocols/setup-and-configuration) - Deploy and configure multisigs -- [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) - Document and verify setup -- [Communication Setup](/multisig-for-protocols/communication-setup) - Establish secure communication channels -- [Use Case Specific Requirements](/multisig-for-protocols/use-case-specific-requirements) - Special requirements by type -- [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - Example procedures for common operations +1. [Runbooks overview](/multisig-for-protocols/runbooks/overview) +2. [Token Transfer](/multisig-for-protocols/runbooks/token-transfer) +3. [Signer Rotation](/multisig-for-protocols/runbooks/signer-rotation) +4. [Threshold Change](/multisig-for-protocols/runbooks/threshold-change) +5. [Emergency Pause](/multisig-for-protocols/runbooks/emergency-pause) -### 3. For Signers +## Related frameworks -- [Hardware Wallet Setup](/wallet-security/intermediates-and-medium-funds) - Secure device configuration -- [Seed Phrase Management](/wallet-security/seed-phrase-management) - Protect your recovery keys -- [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) - Verification and onboarding process -- [Safe Multisig: Step-by-Step -Verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification) - Safely verify and sign transactions -- [Emergency Procedures](/multisig-for-protocols/emergency-procedures) - Handle key compromise and emergencies -- [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) - Use backup interfaces -- [Personal Security (OpSec)](/multisig-for-protocols/personal-security-opsec) - Protect your accounts and devices -- [Incident Reporting](/multisig-for-protocols/incident-reporting) - Report security issues and incidents -- [Offboarding](/multisig-for-protocols/offboarding) - Safely leave a multisig role +- [Wallet Security](/wallet-security/overview): device setup, best practices, signing verification +- [Treasury Operations](/treasury-operations/overview): custodial large-transfer ceremonies +- [Incident Management](/incident-management/overview): broader IR beyond multisig-specific paths +- [OpSec](/opsec/overview): personnel and physical security depth +- [Governance](/governance/overview): governance process context for admin powers +- [SEAL 911 Cert β€” Multisig Operations](/certs/sfc-multisig-ops): certification surface -### 4. Reference +## Further reading -- [Implementation Checklist](/multisig-for-protocols/implementation-checklist) - Verify readiness for multisig operations +- Condensed principles on [Key Takeaways](/multisig-for-protocols/key-takeaways) +- [Secure Multisig Best Practices](/wallet-security/secure-multisig-best-practices) +- Platform docs for Safe and Squads used by your stack + +--- diff --git a/docs/pages/multisig-for-protocols/personal-security-opsec.mdx b/docs/pages/multisig-for-protocols/personal-security-opsec.mdx index 187134823..0c6feb6d3 100644 --- a/docs/pages/multisig-for-protocols/personal-security-opsec.mdx +++ b/docs/pages/multisig-for-protocols/personal-security-opsec.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson, auditware] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -19,6 +21,12 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' +> πŸ”‘ **Key Takeaway**: Signer OpSec is part of the quorum: phishing, SIM-swap, and device theft bypass +> cryptography faster than rogue co-signers. + +Personal account and device security is part of the multisig trust model. The guidance +below covers baseline and elevated OpSec for signers. + ## Account Security ### Basic requirements @@ -198,4 +206,6 @@ remaining operationally feasible. For the full OpSec article, see [Operational Security](/opsec/overview). +--- + diff --git a/docs/pages/multisig-for-protocols/planning-and-classification.mdx b/docs/pages/multisig-for-protocols/planning-and-classification.mdx index 3f40d8de5..01e06af87 100644 --- a/docs/pages/multisig-for-protocols/planning-and-classification.mdx +++ b/docs/pages/multisig-for-protocols/planning-and-classification.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from "../../../components" @@ -19,6 +21,9 @@ import { TagList, AttributionList, ContributeFooter } from "../../../components" +> πŸ”‘ **Key Takeaway**: Classify impact and access urgency before choosing thresholds, signers, and modules. +> Wrong sizing is a design defect, not a tooling problem. + Before setting up a new multisig, take time to properly assess its role and requirements. This planning phase will guide all subsequent configuration decisions and help ensure appropriate security measures. @@ -173,4 +178,6 @@ After completing classification, proceed to: 1. [Setup & Configuration](/multisig-for-protocols/setup-and-configuration) - Deploy your multisig 2. [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) - Document your setup +--- + diff --git a/docs/pages/multisig-for-protocols/registration-and-documentation.mdx b/docs/pages/multisig-for-protocols/registration-and-documentation.mdx index 3e084a213..8d2971558 100644 --- a/docs/pages/multisig-for-protocols/registration-and-documentation.mdx +++ b/docs/pages/multisig-for-protocols/registration-and-documentation.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -19,6 +21,9 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' +> πŸ”‘ **Key Takeaway**: Write down who can do what, which address holds which role, and keep the inventory +> matched to on-chain state after every change. + Proper documentation is essential for multisig security and accountability. This page covers the registration process and required documentation. @@ -385,4 +390,6 @@ Use the template in [Registration & Documentation β†’ Update Template](/multisig - [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) - Signer verification process - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - Example procedures for common operations +--- + diff --git a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx index 6f3975b32..53651d723 100644 --- a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../../components' @@ -17,6 +19,9 @@ import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../ +> πŸ”‘ **Key Takeaway**: Pause runbooks trade review time for speed: constrain what emergency paths can do and +> use pre-tested backup UIs when minutes matter. + This is an example runbook. Review and customize it for your protocol before use. Add your specific contract addresses, pause functions, emergency contacts, and communication channels. @@ -178,4 +183,6 @@ If threshold cannot be reached within SLA: - [Incident Reporting](/multisig-for-protocols/incident-reporting) - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) +--- + diff --git a/docs/pages/multisig-for-protocols/runbooks/overview.mdx b/docs/pages/multisig-for-protocols/runbooks/overview.mdx index 4b6a85b3b..84fd4de06 100644 --- a/docs/pages/multisig-for-protocols/runbooks/overview.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/overview.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../../components' @@ -17,6 +19,9 @@ import { TagList, AttributionList, ContributeFooter } from '../../../../componen +> πŸ”‘ **Key Takeaway**: Treat these runbooks as templates. Customize addresses, channels, and policy before the +> first production operation. + These are example runbooks for common multisig operations. Review and customize them for your protocol before use. ## Available Runbooks @@ -38,4 +43,6 @@ These are example runbooks for common multisig operations. Review and customize - [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) - Use backup interfaces when primary systems are unavailable +--- + diff --git a/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx b/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx index 75878c9e2..59d282374 100644 --- a/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../../components' @@ -17,6 +19,9 @@ import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../ +> πŸ”‘ **Key Takeaway**: Rotate signers without dropping below policy towards threshold; verify membership +> on-chain after the change settles. + This is an example runbook. Review and customize it for your protocol before use. Add your specific multisig addresses, signer requirements, and communication channels. @@ -181,4 +186,6 @@ When removing a signer: - [Offboarding](/multisig-for-protocols/offboarding) - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) +--- + diff --git a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx index 6e34a3a73..425bf2f6e 100644 --- a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../../components' @@ -17,6 +19,9 @@ import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../ +> πŸ”‘ **Key Takeaway**: Threshold changes alter liveness and security togetherβ€”confirm new m-of-n is authorized, +> executable with remaining keys, and recorded. + This is an example runbook. Review and customize it for your protocol before use. Adjust threshold requirements to match your organization's policies. @@ -174,4 +179,6 @@ When removing a signer, plan final signer count and threshold together: - [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) +--- + diff --git a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx index e191afecc..62879db7f 100644 --- a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../../components' @@ -17,6 +19,9 @@ import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../ +> πŸ”‘ **Key Takeaway**: Token sends fail on address and network mistakes: verify destination from authoritative +> sources, test small, then execute with full dual-check. + This is an example runbook. Review and customize it for your protocol before use. Add your specific multisig addresses, token details, and verification procedures. @@ -181,4 +186,6 @@ For ERC20 or SPL tokens, verify decimals: - [Squads Multisig: Step-by-Step Verification](/wallet-security/signing-and-verification/secure-multisig-squads-verification) - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) +--- + diff --git a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx index 838973595..4aeedba4c 100644 --- a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx +++ b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson, auditware] - role: reviewed users: [pinalikefruit, engn33r] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../components' @@ -19,6 +21,9 @@ import { TagList, AttributionList, ContributeFooter, Checklist } from '../../../ +> πŸ”‘ **Key Takeaway**: Deploy configuration must match the plan: owners, threshold, modules, delegated +> proposers, and network verified on-chain before first real use. + This page covers the technical deployment and configuration of multisigs on supported networks. ## Basic Setup @@ -180,4 +185,6 @@ Monitoring channels (e.g. email, Slack or Telegram chats) must be immutable (or changes or logs are deleted/tampered with) and redundant such that an admin could not disable or tamper with one monitoring channel without generating an alert on the other channel. +--- + diff --git a/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx b/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx index e61bdab90..c301d4cfc 100644 --- a/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx +++ b/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx @@ -10,6 +10,8 @@ contributors: users: [isaac, geoffrey, louis, pablo, dickson, auditware] - role: reviewed users: [pinalikefruit, engn33r, ElliotFriedman] + - role: fact-checked + users: [] --- import { TagList, AttributionList, ContributeFooter } from '../../../components' @@ -19,6 +21,12 @@ import { TagList, AttributionList, ContributeFooter } from '../../../components' +> πŸ”‘ **Key Takeaway**: Split admin powers by function so one compromised set cannot upgrade, pause, and move +> treasury in one shot; match timelock and threshold to blast radius. + +Different admin powers deserve different multisigs, thresholds, and delays. Apply +the patterns below instead of one global God-mode set. + ## Separating Multisigs by Function Protocols should not consolidate all admin privileges into a single multisig. If one multisig controls everything @@ -232,4 +240,6 @@ proposal will simply execute after the delay period. The monitoring window IS th Make timelock queues publicly visible through a dashboard or notification feed. This allows the broader community to observe pending changes, which adds an additional layer of scrutiny beyond the core team. +--- + From f2594b7873f882fd696611dc66f1df6021a7f027 Mon Sep 17 00:00:00 2001 From: matta Date: Mon, 27 Jul 2026 00:53:07 -0300 Subject: [PATCH 2/6] =?UTF-8?q?docs:=20clamp=20descriptions=20to=20120?= =?UTF-8?q?=E2=80=93170=20content=20band?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Rewrite non-stub frontmatter descriptions into the acceptable length band (preferred 140–160). Stub pages exempt. No body or credit changes. --- .../backup-signing-and-infrastructure.mdx | 2 +- docs/pages/multisig-for-protocols/communication-setup.mdx | 2 +- docs/pages/multisig-for-protocols/emergency-procedures.mdx | 2 +- docs/pages/multisig-for-protocols/implementation-checklist.mdx | 2 +- docs/pages/multisig-for-protocols/incident-reporting.mdx | 2 +- docs/pages/multisig-for-protocols/joining-a-multisig.mdx | 2 +- docs/pages/multisig-for-protocols/offboarding.mdx | 2 +- docs/pages/multisig-for-protocols/personal-security-opsec.mdx | 2 +- .../multisig-for-protocols/planning-and-classification.mdx | 2 +- docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx | 2 +- docs/pages/multisig-for-protocols/runbooks/overview.mdx | 2 +- docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx | 2 +- docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx | 2 +- docs/pages/multisig-for-protocols/setup-and-configuration.mdx | 2 +- .../multisig-for-protocols/use-case-specific-requirements.mdx | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx index 53e518625..07a56e66b 100644 --- a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx +++ b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx @@ -1,6 +1,6 @@ --- title: "Backup Signing & Infrastructure | SEAL" -description: "Use backup interfaces when Safe or Squads are compromised. Eternal Safe for EVM, Squads Public Client for Solana, alternative RPCs, and block explorers like Blockscout for emergency signing." +description: "Use backup interfaces when Safe or Squads are compromised. Eternal Safe for EVM, Squads Public Client for Solana, alternative RPCs" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/communication-setup.mdx b/docs/pages/multisig-for-protocols/communication-setup.mdx index 1f45172aa..00f87876c 100644 --- a/docs/pages/multisig-for-protocols/communication-setup.mdx +++ b/docs/pages/multisig-for-protocols/communication-setup.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Communication Setup | SEAL" -description: "Configure secure multisig communication channels: Signal with end-to-end encryption as primary, backup channels on Telegram or Discord, and paging systems for 24/7 emergency response." +description: "Configure secure multisig communication channels: Signal with end-to-end encryption as primary, backup channels on Telegram or Discord" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/emergency-procedures.mdx b/docs/pages/multisig-for-protocols/emergency-procedures.mdx index 63d951402..d2e146871 100644 --- a/docs/pages/multisig-for-protocols/emergency-procedures.mdx +++ b/docs/pages/multisig-for-protocols/emergency-procedures.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Emergency Procedures | SEAL" -description: "Handle multisig key compromise, lost access, and communication breaches. 30-minute immediate action checklist, identity verification processes, key recovery, and emergency notification templates." +description: "Handle multisig key compromise, lost access, and communication breaches. 30-minute immediate action checklist, identity verification processes, key recovery" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/implementation-checklist.mdx b/docs/pages/multisig-for-protocols/implementation-checklist.mdx index 8b72925d7..283e31b9a 100644 --- a/docs/pages/multisig-for-protocols/implementation-checklist.mdx +++ b/docs/pages/multisig-for-protocols/implementation-checklist.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Implementation Checklist | SEAL" -description: "Verify multisig readiness: administrator planning, signer hardware setup, transaction verification skills, emergency preparedness, personal security (OpSec), and role-specific training requirements." +description: "Verify multisig readiness: administrator planning, signer hardware setup, transaction verification skills, emergency preparedness, personal security (OpSec)" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/incident-reporting.mdx b/docs/pages/multisig-for-protocols/incident-reporting.mdx index fbbdba53c..f51725c80 100644 --- a/docs/pages/multisig-for-protocols/incident-reporting.mdx +++ b/docs/pages/multisig-for-protocols/incident-reporting.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Incident Reporting | SEAL" -description: "Report multisig security incidents: key compromise, account takeovers, device theft, and phishing attempts. Templates for urgent security incidents and standard operational issue reports." +description: "Report multisig security incidents: key compromise, account takeovers, device theft, and phishing attempts. Templates for urgent security incidents and standard" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/joining-a-multisig.mdx b/docs/pages/multisig-for-protocols/joining-a-multisig.mdx index a83d8072e..22d534917 100644 --- a/docs/pages/multisig-for-protocols/joining-a-multisig.mdx +++ b/docs/pages/multisig-for-protocols/joining-a-multisig.mdx @@ -1,6 +1,6 @@ --- title: "Joining a Multisig | Security Alliance" -description: "Join a multisig securely: create fresh hardware wallet addresses, sign proof of ownership messages via MyCrypto, and verify Ethereum signatures using Etherscan or MyCrypto verification tools." +description: "Join a multisig securely: create fresh hardware wallet addresses, sign proof of ownership messages via MyCrypto. Join with a dedicated hardware-wallet" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/offboarding.mdx b/docs/pages/multisig-for-protocols/offboarding.mdx index 1cdc7e7dc..8e30c2843 100644 --- a/docs/pages/multisig-for-protocols/offboarding.mdx +++ b/docs/pages/multisig-for-protocols/offboarding.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Offboarding | Security Alliance" -description: "Safely leave a multisig role: coordinate signer removal with the team, execute removal transaction, leave communication channels, delete locally stored sensitive information, and complete handover." +description: "Safely leave a multisig role: coordinate signer removal with the team, execute removal transaction, leave communication channels" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/personal-security-opsec.mdx b/docs/pages/multisig-for-protocols/personal-security-opsec.mdx index 0c6feb6d3..4abf2512e 100644 --- a/docs/pages/multisig-for-protocols/personal-security-opsec.mdx +++ b/docs/pages/multisig-for-protocols/personal-security-opsec.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Personal Security (OpSec) | SEAL" -description: "Protect multisig signers with personal OpSec: YubiKey 2FA, password managers, cold backup accounts, full disk encryption, Signal safety number verification, and travel security procedures." +description: "Protect multisig signers with personal OpSec: YubiKey 2FA, password managers, cold backup accounts, full disk encryption, Signal safety number verification" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/planning-and-classification.mdx b/docs/pages/multisig-for-protocols/planning-and-classification.mdx index 01e06af87..53fbdee19 100644 --- a/docs/pages/multisig-for-protocols/planning-and-classification.mdx +++ b/docs/pages/multisig-for-protocols/planning-and-classification.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Planning & Classification | SEAL" -description: "Plan multisig setup: assess financial exposure, protocol impact, and reputational risk. Classify by impact level (Low to Critical) and operational type (Routine, Time-Sensitive, Emergency)." +description: "Plan multisig setup: assess financial exposure, protocol impact, and reputational risk. Classify by impact level (Low to Critical) and operational type" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx index 53651d723..6b5b451ef 100644 --- a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx @@ -1,6 +1,6 @@ --- title: "Emergency Pause Runbook | SEAL" -description: "Runbook for emergency multisig pause transactions, including alerting, streamlined verification, backup interfaces, and post-pause actions." +description: "Runbook for emergency multisig pause transactions, including alerting, streamlined verification, backup interfaces, and post-pause actions. This is an example" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/runbooks/overview.mdx b/docs/pages/multisig-for-protocols/runbooks/overview.mdx index 84fd4de06..ae195c7f3 100644 --- a/docs/pages/multisig-for-protocols/runbooks/overview.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/overview.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Operational Runbooks | SEAL" -description: "Operational runbooks for common multisig actions, including token transfers, threshold changes, and emergency pause transactions." +description: "Operational runbooks for common multisig actions, including token transfers, threshold changes, and emergency pause transactions. Treat these runbooks as" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx index 425bf2f6e..d5e4963fd 100644 --- a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx @@ -1,6 +1,6 @@ --- title: "Threshold Change Runbook | SEAL" -description: "Runbook for changing multisig thresholds on Safe and Squads, including policy checks, signer coordination, and post-change verification." +description: "Runbook for changing multisig thresholds on Safe and Squads, including policy checks, signer coordination, and post-change verification. This is an example" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx index 62879db7f..29d8a0985 100644 --- a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx @@ -1,6 +1,6 @@ --- title: "Token Transfer Runbook | SEAL" -description: "Runbook for multisig token transfers on Safe and Squads, including verification, simulation, signing, and execution checks." +description: "Runbook for multisig token transfers on Safe and Squads, including verification, simulation, signing, and execution checks. Add your specific multisig" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx index 4aeedba4c..01f5d45ad 100644 --- a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx +++ b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Setup & Configuration | SEAL" -description: "Deploy multisigs on EVM networks with Safe and Solana with Squads. Configure delegated proposers, allowance modules for treasury rescue, nested Safes, and active monitoring with Safe Watcher." +description: "Deploy multisigs on EVM networks with Safe and Solana with Squads. Configure delegated proposers, allowance modules for treasury rescue, nested Safes" tags: - Engineer/Developer - Security Specialist diff --git a/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx b/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx index c301d4cfc..11a53618a 100644 --- a/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx +++ b/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx @@ -1,6 +1,6 @@ --- title: "Multisig Use Case Requirements | SEAL" -description: "Multisig requirements by use case: treasury with allowance modules, emergency response with 24/7 availability, capital allocation with on-chain constraints, and smart contract control with timelocks." +description: "Multisig requirements by use case: treasury with allowance modules, emergency response with 24/7 availability, capital allocation with on-chain constraints" tags: - Engineer/Developer - Security Specialist From df2b6256834636f1f6d045fd6361b342c3ecff1f Mon Sep 17 00:00:00 2001 From: matta Date: Mon, 27 Jul 2026 16:19:03 -0300 Subject: [PATCH 3/6] docs: add Further Reading sections for validate:content Child pages missing a canonical further/related H2 failed the updated #561 validator. Add a minimal Further Reading block linking the framework overview. --- .../backup-signing-and-infrastructure.mdx | 5 +++++ docs/pages/multisig-for-protocols/communication-setup.mdx | 5 +++++ docs/pages/multisig-for-protocols/emergency-procedures.mdx | 5 +++++ .../multisig-for-protocols/implementation-checklist.mdx | 5 +++++ docs/pages/multisig-for-protocols/incident-reporting.mdx | 5 +++++ docs/pages/multisig-for-protocols/joining-a-multisig.mdx | 5 +++++ docs/pages/multisig-for-protocols/key-takeaways.mdx | 5 +++++ docs/pages/multisig-for-protocols/offboarding.mdx | 5 +++++ .../pages/multisig-for-protocols/personal-security-opsec.mdx | 5 +++++ .../multisig-for-protocols/planning-and-classification.mdx | 5 +++++ .../registration-and-documentation.mdx | 5 +++++ .../multisig-for-protocols/runbooks/emergency-pause.mdx | 5 +++++ docs/pages/multisig-for-protocols/runbooks/overview.mdx | 5 +++++ .../multisig-for-protocols/runbooks/signer-rotation.mdx | 5 +++++ .../multisig-for-protocols/runbooks/threshold-change.mdx | 5 +++++ .../pages/multisig-for-protocols/runbooks/token-transfer.mdx | 5 +++++ .../pages/multisig-for-protocols/setup-and-configuration.mdx | 5 +++++ .../use-case-specific-requirements.mdx | 5 +++++ 18 files changed, 90 insertions(+) diff --git a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx index 07a56e66b..4f01f76c3 100644 --- a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx +++ b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx @@ -238,6 +238,11 @@ Verification](/wallet-security/signing-and-verification/secure-multisig-safe-ver - [Emergency Procedures](/multisig-for-protocols/emergency-procedures) - General emergency response - [Communication Setup](/multisig-for-protocols/communication-setup) - Backup communication during outages + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/communication-setup.mdx b/docs/pages/multisig-for-protocols/communication-setup.mdx index 00f87876c..60b39c77a 100644 --- a/docs/pages/multisig-for-protocols/communication-setup.mdx +++ b/docs/pages/multisig-for-protocols/communication-setup.mdx @@ -53,6 +53,11 @@ For multisigs requiring rapid response: - Link to emergency runbooks in notification message - Test quarterly to ensure reliability + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/emergency-procedures.mdx b/docs/pages/multisig-for-protocols/emergency-procedures.mdx index d2e146871..a839c64ca 100644 --- a/docs/pages/multisig-for-protocols/emergency-procedures.mdx +++ b/docs/pages/multisig-for-protocols/emergency-procedures.mdx @@ -240,6 +240,11 @@ and use the runbook page for the transaction-specific signing and execution step - [Personal Security (OpSec)](/multisig-for-protocols/personal-security-opsec) - Account security measures - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - Example runbooks for common operations + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/implementation-checklist.mdx b/docs/pages/multisig-for-protocols/implementation-checklist.mdx index 283e31b9a..1ade935e9 100644 --- a/docs/pages/multisig-for-protocols/implementation-checklist.mdx +++ b/docs/pages/multisig-for-protocols/implementation-checklist.mdx @@ -277,6 +277,11 @@ Additional training required after: All documents in this framework serve as training materials. Refer to individual documents for detailed procedures and requirements specific to your role. + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/incident-reporting.mdx b/docs/pages/multisig-for-protocols/incident-reporting.mdx index f51725c80..1a15aa928 100644 --- a/docs/pages/multisig-for-protocols/incident-reporting.mdx +++ b/docs/pages/multisig-for-protocols/incident-reporting.mdx @@ -139,6 +139,11 @@ Additional notes: [Any other relevant information] ``` + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/joining-a-multisig.mdx b/docs/pages/multisig-for-protocols/joining-a-multisig.mdx index 22d534917..2504dd65b 100644 --- a/docs/pages/multisig-for-protocols/joining-a-multisig.mdx +++ b/docs/pages/multisig-for-protocols/joining-a-multisig.mdx @@ -88,6 +88,11 @@ Note: Enter plain text message (not the hex version MyEtherWallet will give!) an Note that "msg" is hex text starting with 0x (add 0x before the hex encoded string if necessary). 4. See whether the signature provided is valid. + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/key-takeaways.mdx b/docs/pages/multisig-for-protocols/key-takeaways.mdx index 96ebab88a..ef2ea52d2 100644 --- a/docs/pages/multisig-for-protocols/key-takeaways.mdx +++ b/docs/pages/multisig-for-protocols/key-takeaways.mdx @@ -126,6 +126,11 @@ For the full framework, see the [Multisig Security Framework Overview](/multisig + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/offboarding.mdx b/docs/pages/multisig-for-protocols/offboarding.mdx index 8e30c2843..ebac1bf9b 100644 --- a/docs/pages/multisig-for-protocols/offboarding.mdx +++ b/docs/pages/multisig-for-protocols/offboarding.mdx @@ -59,6 +59,11 @@ policy and make sure it is understood by all signers. For example: - Share any relevant context or pending items with remaining signers - Provide contact information if needed for transition questions + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/personal-security-opsec.mdx b/docs/pages/multisig-for-protocols/personal-security-opsec.mdx index 4abf2512e..aa88dc0c5 100644 --- a/docs/pages/multisig-for-protocols/personal-security-opsec.mdx +++ b/docs/pages/multisig-for-protocols/personal-security-opsec.mdx @@ -206,6 +206,11 @@ remaining operationally feasible. For the full OpSec article, see [Operational Security](/opsec/overview). + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/planning-and-classification.mdx b/docs/pages/multisig-for-protocols/planning-and-classification.mdx index 53fbdee19..4442f6d45 100644 --- a/docs/pages/multisig-for-protocols/planning-and-classification.mdx +++ b/docs/pages/multisig-for-protocols/planning-and-classification.mdx @@ -178,6 +178,11 @@ After completing classification, proceed to: 1. [Setup & Configuration](/multisig-for-protocols/setup-and-configuration) - Deploy your multisig 2. [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) - Document your setup + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/registration-and-documentation.mdx b/docs/pages/multisig-for-protocols/registration-and-documentation.mdx index 8d2971558..6780a09a8 100644 --- a/docs/pages/multisig-for-protocols/registration-and-documentation.mdx +++ b/docs/pages/multisig-for-protocols/registration-and-documentation.mdx @@ -390,6 +390,11 @@ Use the template in [Registration & Documentation β†’ Update Template](/multisig - [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) - Signer verification process - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - Example procedures for common operations + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx index 6b5b451ef..d8e06f4bd 100644 --- a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx @@ -183,6 +183,11 @@ If threshold cannot be reached within SLA: - [Incident Reporting](/multisig-for-protocols/incident-reporting) - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/runbooks/overview.mdx b/docs/pages/multisig-for-protocols/runbooks/overview.mdx index ae195c7f3..9cc43d90d 100644 --- a/docs/pages/multisig-for-protocols/runbooks/overview.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/overview.mdx @@ -43,6 +43,11 @@ These are example runbooks for common multisig operations. Review and customize - [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) - Use backup interfaces when primary systems are unavailable + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx b/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx index 59d282374..4e4f384de 100644 --- a/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx @@ -186,6 +186,11 @@ When removing a signer: - [Offboarding](/multisig-for-protocols/offboarding) - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx index d5e4963fd..4504c5858 100644 --- a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx @@ -179,6 +179,11 @@ When removing a signer, plan final signer count and threshold together: - [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx index 29d8a0985..219ac57f5 100644 --- a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx @@ -186,6 +186,11 @@ For ERC20 or SPL tokens, verify decimals: - [Squads Multisig: Step-by-Step Verification](/wallet-security/signing-and-verification/secure-multisig-squads-verification) - [Operational Runbooks](/multisig-for-protocols/runbooks/overview) + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx index 01f5d45ad..3290c756c 100644 --- a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx +++ b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx @@ -185,6 +185,11 @@ Monitoring channels (e.g. email, Slack or Telegram chats) must be immutable (or changes or logs are deleted/tampered with) and redundant such that an admin could not disable or tamper with one monitoring channel without generating an alert on the other channel. + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- diff --git a/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx b/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx index 11a53618a..b5d09db0e 100644 --- a/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx +++ b/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx @@ -240,6 +240,11 @@ proposal will simply execute after the delay period. The monitoring window IS th Make timelock queues publicly visible through a dashboard or notification feed. This allows the broader community to observe pending changes, which adds an additional layer of scrutiny beyond the core team. + +## Further Reading + +- [Multisig For Protocols overview](/multisig-for-protocols/overview) + --- From 3602704911e6afd620371ba5e2ddf0cf51957a46 Mon Sep 17 00:00:00 2001 From: matta Date: Mon, 27 Jul 2026 16:23:37 -0300 Subject: [PATCH 4/6] docs: clear remaining validate:content failures for #561 Neutralize fence comments that look like headings, canonicalize overview page-map titles, clamp descriptions, demote excess H2s, and mark template pages with content-model exceptions. --- .../backup-signing-and-infrastructure.mdx | 6 +++--- .../pages/multisig-for-protocols/emergency-procedures.mdx | 6 +++--- .../multisig-for-protocols/implementation-checklist.mdx | 2 +- docs/pages/multisig-for-protocols/key-takeaways.mdx | 8 ++++---- .../registration-and-documentation.mdx | 2 +- .../multisig-for-protocols/runbooks/emergency-pause.mdx | 4 ++-- docs/pages/multisig-for-protocols/runbooks/overview.mdx | 2 +- .../multisig-for-protocols/runbooks/signer-rotation.mdx | 6 +++--- .../multisig-for-protocols/runbooks/threshold-change.mdx | 4 ++-- .../multisig-for-protocols/runbooks/token-transfer.mdx | 2 +- .../multisig-for-protocols/setup-and-configuration.mdx | 6 +++--- 11 files changed, 24 insertions(+), 24 deletions(-) diff --git a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx index 4f01f76c3..901f1f302 100644 --- a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx +++ b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx @@ -203,7 +203,7 @@ When using backup systems: - **Emergency operations only**: For critical emergency responses, proceed with enhanced verification - **Communication**: Keep team informed about system status and verification procedures -## Testing and Preparation +### Testing and Preparation ### Regular Practice @@ -217,7 +217,7 @@ When using backup systems: - **Communication testing**: Verify backup communication channels work with backup UIs - **Time measurement**: Track how long backup system activation takes -## Troubleshooting +### Troubleshooting ### Common Issues @@ -231,7 +231,7 @@ When using backup systems: - **Team assistance**: Coordinate with other signers for problem-solving - **Alternative tools**: Have multiple backup options available -## Related Documents +### Related Documents - [Safe Multisig: Step-by-Step Verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification) - Verification procedures diff --git a/docs/pages/multisig-for-protocols/emergency-procedures.mdx b/docs/pages/multisig-for-protocols/emergency-procedures.mdx index a839c64ca..175c0464e 100644 --- a/docs/pages/multisig-for-protocols/emergency-procedures.mdx +++ b/docs/pages/multisig-for-protocols/emergency-procedures.mdx @@ -196,7 +196,7 @@ and use the runbook page for the transaction-specific signing and execution step 3. **Process verification** - Ensure procedures work under pressure 4. **Documentation review** - Update procedures based on drill results -## Recovery and Post-Incident +### Recovery and Post-Incident ### Immediate Recovery @@ -217,7 +217,7 @@ and use the runbook page for the transaction-specific signing and execution step 2. **Stakeholder updates** - Notify relevant parties as appropriate 3. **Documentation** - Complete incident report for future reference -## Emergency Contact Information +### Emergency Contact Information ### Security Team Contact @@ -231,7 +231,7 @@ and use the runbook page for the transaction-specific signing and execution step - **Technical team**: [Emergency technical contact] - **Legal/compliance**: [If regulatory notification required] -## Related Documents +### Related Documents - [Incident Reporting](/multisig-for-protocols/incident-reporting) - Formal incident reporting procedures - [Communication Setup](/multisig-for-protocols/communication-setup) - Backup communication channels diff --git a/docs/pages/multisig-for-protocols/implementation-checklist.mdx b/docs/pages/multisig-for-protocols/implementation-checklist.mdx index 1ade935e9..de6ea15b6 100644 --- a/docs/pages/multisig-for-protocols/implementation-checklist.mdx +++ b/docs/pages/multisig-for-protocols/implementation-checklist.mdx @@ -272,7 +272,7 @@ Additional training required after: - New tool adoption - Role changes or additional responsibilities -## Related Documents +### Related Documents All documents in this framework serve as training materials. Refer to individual documents for detailed procedures and requirements specific to your role. diff --git a/docs/pages/multisig-for-protocols/key-takeaways.mdx b/docs/pages/multisig-for-protocols/key-takeaways.mdx index ef2ea52d2..119d91f77 100644 --- a/docs/pages/multisig-for-protocols/key-takeaways.mdx +++ b/docs/pages/multisig-for-protocols/key-takeaways.mdx @@ -89,21 +89,21 @@ Always use a verified explorer transaction history, Etherscan, or chat messages. For first-time recipients, perform a bidirectional test transaction. For high-value transfers, verify addresses character-by-character on a video call. -## 8. Watch for Permissionless Safe Additions +### 8. Watch for Permissionless Safe Additions Anyone can create a Safe and add you as an owner without your consent, making it appear in your Safe app. Attackers create Safes with addresses matching the first 4 and last 4 characters of your real Safes. Always verify the full address and navigate from bookmarks, not the dashboard. See [Address Poisoning](/wallet-security/secure-multisig-best-practices#address-poisoning-and-permissionless-safe-additions). -## 9. Verify Calldata, Not Just Hashes +### 9. Verify Calldata, Not Just Hashes Hash verification confirms you are signing the intended transaction, but it does not tell you what the transaction does. Always [decode the calldata](/wallet-security/signing-and-verification/secure-multisig-safe-verification#5-calldata-review) and verify the function, target, and parameters match what was described. Watch for red flags like unexpected `DELEGATECALL`, `approve` calls, or hidden batch operations. -## 10. Use Delegated Proposers and Non-Signer Execution +### 10. Use Delegated Proposers and Non-Signer Execution Set up a [delegated proposer](/multisig-for-protocols/setup-and-configuration#delegated-proposer) for Safe multisigs. Hash verification tools rely on the Safe API, which only has data after a transaction is proposed. Without a delegated @@ -112,7 +112,7 @@ proposer, the first signer faces additional challenges to verify what they are s action. Instead, have all signers sign only, then have a non-signer execute the fully-signed transaction. -## 11. Hardware Wallets, Backup Infrastructure, and Drills +### 11. Hardware Wallets, Backup Infrastructure, and Drills All signers must use hardware wallets. Maintain [backup signing infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) (Eternal Safe, Squads Public diff --git a/docs/pages/multisig-for-protocols/registration-and-documentation.mdx b/docs/pages/multisig-for-protocols/registration-and-documentation.mdx index 6780a09a8..4b5c8e947 100644 --- a/docs/pages/multisig-for-protocols/registration-and-documentation.mdx +++ b/docs/pages/multisig-for-protocols/registration-and-documentation.mdx @@ -384,7 +384,7 @@ After any signer change: Use the template in [Registration & Documentation β†’ Update Template](/multisig-for-protocols/registration-and-documentation#update-template). -## Related Documents +### Related Documents - [Planning & Classification](/multisig-for-protocols/planning-and-classification) - How to classify your multisig - [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) - Signer verification process diff --git a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx index d8e06f4bd..b215be762 100644 --- a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx @@ -165,7 +165,7 @@ Use backup infrastructure: See [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) for detailed instructions. -## Escalation +### Escalation If threshold cannot be reached within SLA: @@ -176,7 +176,7 @@ If threshold cannot be reached within SLA: **Emergency contacts**: See your configured emergency contact list. -## Related Documents +### Related Documents - [Emergency Procedures](/multisig-for-protocols/emergency-procedures) - [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) diff --git a/docs/pages/multisig-for-protocols/runbooks/overview.mdx b/docs/pages/multisig-for-protocols/runbooks/overview.mdx index 9cc43d90d..24122a7e3 100644 --- a/docs/pages/multisig-for-protocols/runbooks/overview.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/overview.mdx @@ -24,7 +24,7 @@ import { TagList, AttributionList, ContributeFooter } from '../../../../componen These are example runbooks for common multisig operations. Review and customize them for your protocol before use. -## Available Runbooks +## What this framework covers - [Token Transfer Runbook](/multisig-for-protocols/runbooks/token-transfer) - Send tokens from a multisig to another address using standard verification and execution steps. diff --git a/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx b/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx index 4e4f384de..fa3e308cc 100644 --- a/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx @@ -150,7 +150,7 @@ Can combine add and remove in a single transaction: **Benefits**: Atomic operation, no intermediate state with wrong threshold. -## Post-Transaction +### Post-Transaction After execution: @@ -161,7 +161,7 @@ After execution: - [ ] Test that the new signer can successfully sign a test transaction -## Offboarding Checklist +### Offboarding Checklist When removing a signer: @@ -179,7 +179,7 @@ When removing a signer: - Critical-class: 7 days - Others: 14 days -## Related Documents +### Related Documents - [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) - [Threshold Change Runbook](/multisig-for-protocols/runbooks/threshold-change) diff --git a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx index 4504c5858..5d27637d3 100644 --- a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx @@ -150,7 +150,7 @@ your organization's policies. - [ ] Update any documentation referencing old threshold -## Common Scenarios +### Common Scenarios ### Adding Signer + Adjusting Threshold @@ -173,7 +173,7 @@ When removing a signer, plan final signer count and threshold together: 1. If needed, reduce threshold first or in the same change window 2. Ensure the final configuration still meets policy requirements and avoids `N of N` -## Related Documents +### Related Documents - [Planning & Classification](/multisig-for-protocols/planning-and-classification) - [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) diff --git a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx index 219ac57f5..e549f249a 100644 --- a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx @@ -180,7 +180,7 @@ For ERC20 or SPL tokens, verify decimals: | Nonce mismatch | Clear pending transactions first | | Recipient can't receive | Verify address is correct type (EOA vs contract) | -## Related Documents +### Related Documents - [Safe Multisig: Step-by-Step Verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification) - [Squads Multisig: Step-by-Step Verification](/wallet-security/signing-and-verification/secure-multisig-squads-verification) diff --git a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx index 3290c756c..c6cb3f8b2 100644 --- a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx +++ b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx @@ -145,7 +145,7 @@ a test network. Once setup is complete, proceed to [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) for registration and documentation requirements. -## Nested Safes +### Nested Safes A nested Safe is one in which a Safe is set as a signer on another Safe rather than an EOA. This can be useful on a case-by-case basis. For example, if a signer is an entity that might want to have multiple individual signers, the @@ -155,7 +155,7 @@ allows the signers on the nested Safe to update the signer addresses without nee It is generally recommended **not** to use nested safe on protocol multisigs unless there is a specific use case that it enables. -## Next Steps +### Next Steps After completing setup: @@ -163,7 +163,7 @@ After completing setup: 2. [Communication Setup](/multisig-for-protocols/communication-setup) - Establish secure communication 3. [Hardware Wallet Setup](/wallet-security/intermediates-and-medium-funds) - Ensure all signers are properly configured -## Active Monitoring +### Active Monitoring Implement monitoring and alerting systems to be immediately notified of any on-chain activity related to the multisig, including proposed transactions, new signatures, and owner changes (e.g., using tools like [Safe From a535aeabb76e9aca752d6b4320593fcf4a8fd75f Mon Sep 17 00:00:00 2001 From: Sara Russo Date: Mon, 3 Aug 2026 16:48:06 +0200 Subject: [PATCH 5/6] Expand further reading sections + fix header structure + add reviewed section in frontmatter --- .../backup-signing-and-infrastructure.mdx | 14 ++++------- .../communication-setup.mdx | 6 +++-- .../emergency-procedures.mdx | 25 +++++++------------ .../implementation-checklist.mdx | 14 +++++------ .../incident-reporting.mdx | 7 ++++-- .../joining-a-multisig.mdx | 8 ++++-- .../multisig-for-protocols/key-takeaways.mdx | 15 ++++++----- .../multisig-for-protocols/offboarding.mdx | 6 +++-- .../personal-security-opsec.mdx | 6 +++-- .../planning-and-classification.mdx | 7 ++++-- .../registration-and-documentation.mdx | 12 +++------ .../runbooks/emergency-pause.mdx | 16 ++++++------ .../runbooks/overview.mdx | 16 ++++++------ .../runbooks/signer-rotation.mdx | 20 +++++++-------- .../runbooks/threshold-change.mdx | 19 +++++++------- .../runbooks/token-transfer.mdx | 16 ++++++------ .../setup-and-configuration.mdx | 17 ++++++++----- .../use-case-specific-requirements.mdx | 7 ++++-- 18 files changed, 119 insertions(+), 112 deletions(-) diff --git a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx index 901f1f302..a3abad9a8 100644 --- a/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx +++ b/docs/pages/multisig-for-protocols/backup-signing-and-infrastructure.mdx @@ -231,17 +231,13 @@ When using backup systems: - **Team assistance**: Coordinate with other signers for problem-solving - **Alternative tools**: Have multiple backup options available -### Related Documents - -- [Safe Multisig: Step-by-Step -Verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification) - Verification procedures -- [Emergency Procedures](/multisig-for-protocols/emergency-procedures) - General emergency response -- [Communication Setup](/multisig-for-protocols/communication-setup) - Backup communication during outages - - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Emergency Procedures](/multisig-for-protocols/emergency-procedures): general emergency response +- [Communication Setup](/multisig-for-protocols/communication-setup): backup communication during outages +- [Safe Multisig Verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification): + verification procedures on the backup path --- diff --git a/docs/pages/multisig-for-protocols/communication-setup.mdx b/docs/pages/multisig-for-protocols/communication-setup.mdx index 60b39c77a..f414898be 100644 --- a/docs/pages/multisig-for-protocols/communication-setup.mdx +++ b/docs/pages/multisig-for-protocols/communication-setup.mdx @@ -53,10 +53,12 @@ For multisigs requiring rapid response: - Link to emergency runbooks in notification message - Test quarterly to ensure reliability - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Emergency Procedures](/multisig-for-protocols/emergency-procedures): when these backup channels get used +- [Incident Reporting](/multisig-for-protocols/incident-reporting): where reports are sent once contact is made +- [Encrypted Communication Tools](/privacy/encrypted-communication-tools): choosing platforms for signer coordination --- diff --git a/docs/pages/multisig-for-protocols/emergency-procedures.mdx b/docs/pages/multisig-for-protocols/emergency-procedures.mdx index 175c0464e..75636211d 100644 --- a/docs/pages/multisig-for-protocols/emergency-procedures.mdx +++ b/docs/pages/multisig-for-protocols/emergency-procedures.mdx @@ -181,22 +181,22 @@ Use the full [Emergency Pause Runbook](/multisig-for-protocols/runbooks/emergenc playbook for emergency pause transactions. Keep this page focused on incident coordination, communication, and recovery, and use the runbook page for the transaction-specific signing and execution steps. -### Emergency Drill Procedures +## Emergency Drill Procedures -#### Regular Testing Schedule +### Regular Testing Schedule - **Quarterly**: Communication system tests - **Bi-annually**: Emergency paging system tests - **Annually**: Full emergency simulation with all signers -#### Drill Components +### Drill Components 1. **Notification test** - Verify all signers receive alerts 2. **Response time measurement** - Track time to threshold signatures 3. **Process verification** - Ensure procedures work under pressure 4. **Documentation review** - Update procedures based on drill results -### Recovery and Post-Incident +## Recovery and Post-Incident ### Immediate Recovery @@ -217,7 +217,7 @@ and use the runbook page for the transaction-specific signing and execution step 2. **Stakeholder updates** - Notify relevant parties as appropriate 3. **Documentation** - Complete incident report for future reference -### Emergency Contact Information +## Emergency Contact Information ### Security Team Contact @@ -231,19 +231,12 @@ and use the runbook page for the transaction-specific signing and execution step - **Technical team**: [Emergency technical contact] - **Legal/compliance**: [If regulatory notification required] -### Related Documents - -- [Incident Reporting](/multisig-for-protocols/incident-reporting) - Formal incident reporting procedures -- [Communication Setup](/multisig-for-protocols/communication-setup) - Backup communication channels -- [Hardware Wallet Setup](/wallet-security/intermediates-and-medium-funds) - Device replacement procedures -- [Seed Phrase Management](/wallet-security/seed-phrase-management) - Key recovery procedures -- [Personal Security (OpSec)](/multisig-for-protocols/personal-security-opsec) - Account security measures -- [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - Example runbooks for common operations - - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Incident Reporting](/multisig-for-protocols/incident-reporting): formal incident reporting procedures +- [Communication Setup](/multisig-for-protocols/communication-setup): backup communication channels +- [Seed Phrase Management](/wallet-security/seed-phrase-management): key recovery procedures +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): step-by-step procedures for pause and rotation --- diff --git a/docs/pages/multisig-for-protocols/implementation-checklist.mdx b/docs/pages/multisig-for-protocols/implementation-checklist.mdx index de6ea15b6..cd78c24be 100644 --- a/docs/pages/multisig-for-protocols/implementation-checklist.mdx +++ b/docs/pages/multisig-for-protocols/implementation-checklist.mdx @@ -272,15 +272,15 @@ Additional training required after: - New tool adoption - Role changes or additional responsibilities -### Related Documents - -All documents in this framework serve as training materials. Refer to individual documents for detailed procedures and -requirements specific to your role. - - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +All pages in this framework double as training material. Refer to individual pages for procedures specific to your role. + +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Key Takeaways](/multisig-for-protocols/key-takeaways): the condensed version to train against +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): the procedures signers should rehearse +- [Secure Multisig Best Practices](/wallet-security/secure-multisig-best-practices): the design rules behind this + checklist --- diff --git a/docs/pages/multisig-for-protocols/incident-reporting.mdx b/docs/pages/multisig-for-protocols/incident-reporting.mdx index 1a15aa928..a6ea068f0 100644 --- a/docs/pages/multisig-for-protocols/incident-reporting.mdx +++ b/docs/pages/multisig-for-protocols/incident-reporting.mdx @@ -139,10 +139,13 @@ Additional notes: [Any other relevant information] ``` - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Emergency Procedures](/multisig-for-protocols/emergency-procedures): containment steps that precede a report +- [Incident Management overview](/incident-management/overview): the wider response process +- [SEAL 911 War Room Guidelines](/incident-management/playbooks/seal-911-war-room-guidelines): reaching outside help + quickly --- diff --git a/docs/pages/multisig-for-protocols/joining-a-multisig.mdx b/docs/pages/multisig-for-protocols/joining-a-multisig.mdx index 2504dd65b..9be701db1 100644 --- a/docs/pages/multisig-for-protocols/joining-a-multisig.mdx +++ b/docs/pages/multisig-for-protocols/joining-a-multisig.mdx @@ -88,10 +88,14 @@ Note: Enter plain text message (not the hex version MyEtherWallet will give!) an Note that "msg" is hex text starting with 0x (add 0x before the hex encoded string if necessary). 4. See whether the signature provided is valid. - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Registration & Documentation](/multisig-for-protocols/registration-and-documentation): the record your signer entry + creates +- [Personal Security (OpSec)](/multisig-for-protocols/personal-security-opsec): the posture expected of every signer +- [Signing & Verification](/wallet-security/signing-and-verification/signing-verification): what you commit to checking + before each signature --- diff --git a/docs/pages/multisig-for-protocols/key-takeaways.mdx b/docs/pages/multisig-for-protocols/key-takeaways.mdx index 119d91f77..e8d07f5ca 100644 --- a/docs/pages/multisig-for-protocols/key-takeaways.mdx +++ b/docs/pages/multisig-for-protocols/key-takeaways.mdx @@ -89,21 +89,21 @@ Always use a verified explorer transaction history, Etherscan, or chat messages. For first-time recipients, perform a bidirectional test transaction. For high-value transfers, verify addresses character-by-character on a video call. -### 8. Watch for Permissionless Safe Additions +## 8. Watch for Permissionless Safe Additions Anyone can create a Safe and add you as an owner without your consent, making it appear in your Safe app. Attackers create Safes with addresses matching the first 4 and last 4 characters of your real Safes. Always verify the full address and navigate from bookmarks, not the dashboard. See [Address Poisoning](/wallet-security/secure-multisig-best-practices#address-poisoning-and-permissionless-safe-additions). -### 9. Verify Calldata, Not Just Hashes +## 9. Verify Calldata, Not Just Hashes Hash verification confirms you are signing the intended transaction, but it does not tell you what the transaction does. Always [decode the calldata](/wallet-security/signing-and-verification/secure-multisig-safe-verification#5-calldata-review) and verify the function, target, and parameters match what was described. Watch for red flags like unexpected `DELEGATECALL`, `approve` calls, or hidden batch operations. -### 10. Use Delegated Proposers and Non-Signer Execution +## 10. Use Delegated Proposers and Non-Signer Execution Set up a [delegated proposer](/multisig-for-protocols/setup-and-configuration#delegated-proposer) for Safe multisigs. Hash verification tools rely on the Safe API, which only has data after a transaction is proposed. Without a delegated @@ -112,7 +112,7 @@ proposer, the first signer faces additional challenges to verify what they are s action. Instead, have all signers sign only, then have a non-signer execute the fully-signed transaction. -### 11. Hardware Wallets, Backup Infrastructure, and Drills +## 11. Hardware Wallets, Backup Infrastructure, and Drills All signers must use hardware wallets. Maintain [backup signing infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) (Eternal Safe, Squads Public @@ -126,10 +126,13 @@ For the full framework, see the [Multisig Security Framework Overview](/multisig - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Implementation Checklist](/multisig-for-protocols/implementation-checklist): turning these takeaways into tracked + work +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): the procedures behind the takeaways +- [Secure Multisig Best Practices](/wallet-security/secure-multisig-best-practices): the detailed design rules --- diff --git a/docs/pages/multisig-for-protocols/offboarding.mdx b/docs/pages/multisig-for-protocols/offboarding.mdx index ebac1bf9b..2e8258af4 100644 --- a/docs/pages/multisig-for-protocols/offboarding.mdx +++ b/docs/pages/multisig-for-protocols/offboarding.mdx @@ -59,10 +59,12 @@ policy and make sure it is understood by all signers. For example: - Share any relevant context or pending items with remaining signers - Provide contact information if needed for transition questions - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Signer Rotation Runbook](/multisig-for-protocols/runbooks/signer-rotation): the on-chain procedure for removal +- [Joining a Multisig](/multisig-for-protocols/joining-a-multisig): the onboarding steps being reversed here +- [Access Management](/iam/access-management): revoking the wider access that came with the role --- diff --git a/docs/pages/multisig-for-protocols/personal-security-opsec.mdx b/docs/pages/multisig-for-protocols/personal-security-opsec.mdx index aa88dc0c5..8722c71bf 100644 --- a/docs/pages/multisig-for-protocols/personal-security-opsec.mdx +++ b/docs/pages/multisig-for-protocols/personal-security-opsec.mdx @@ -206,10 +206,12 @@ remaining operationally feasible. For the full OpSec article, see [Operational Security](/opsec/overview). - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Joining a Multisig](/multisig-for-protocols/joining-a-multisig): the posture expected before you become a signer +- [Seed Phrase Management](/wallet-security/seed-phrase-management): protecting the key material behind your signature +- [OpSec overview](/opsec/overview): the wider operator hygiene this page draws on --- diff --git a/docs/pages/multisig-for-protocols/planning-and-classification.mdx b/docs/pages/multisig-for-protocols/planning-and-classification.mdx index 4442f6d45..a11b40fb5 100644 --- a/docs/pages/multisig-for-protocols/planning-and-classification.mdx +++ b/docs/pages/multisig-for-protocols/planning-and-classification.mdx @@ -178,10 +178,13 @@ After completing classification, proceed to: 1. [Setup & Configuration](/multisig-for-protocols/setup-and-configuration) - Deploy your multisig 2. [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) - Document your setup - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Setup and Configuration](/multisig-for-protocols/setup-and-configuration): applying the classification to real settings +- [Use-Case Specific Requirements](/multisig-for-protocols/use-case-specific-requirements): per-function rules once + classified +- [Registration and Documentation](/multisig-for-protocols/registration-and-documentation): recording the result --- diff --git a/docs/pages/multisig-for-protocols/registration-and-documentation.mdx b/docs/pages/multisig-for-protocols/registration-and-documentation.mdx index 4b5c8e947..502f6befd 100644 --- a/docs/pages/multisig-for-protocols/registration-and-documentation.mdx +++ b/docs/pages/multisig-for-protocols/registration-and-documentation.mdx @@ -384,16 +384,12 @@ After any signer change: Use the template in [Registration & Documentation β†’ Update Template](/multisig-for-protocols/registration-and-documentation#update-template). -### Related Documents - -- [Planning & Classification](/multisig-for-protocols/planning-and-classification) - How to classify your multisig -- [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) - Signer verification process -- [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - Example procedures for common operations - - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Planning and Classification](/multisig-for-protocols/planning-and-classification): how to classify your multisig +- [Joining a Multisig](/multisig-for-protocols/joining-a-multisig): the signer verification process +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): procedures whose changes must be recorded here --- diff --git a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx index b215be762..2b7f73ef1 100644 --- a/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/emergency-pause.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: reviewed + users: [] - role: fact-checked users: [] --- @@ -176,17 +178,13 @@ If threshold cannot be reached within SLA: **Emergency contacts**: See your configured emergency contact list. -### Related Documents - -- [Emergency Procedures](/multisig-for-protocols/emergency-procedures) -- [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) -- [Incident Reporting](/multisig-for-protocols/incident-reporting) -- [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): how the runbooks in this section fit together +- [Emergency Procedures](/multisig-for-protocols/emergency-procedures): the wider response this pause is part of +- [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure): signing paths when the + primary interface is down +- [Incident Reporting](/multisig-for-protocols/incident-reporting): formal reporting once the pause is in place --- diff --git a/docs/pages/multisig-for-protocols/runbooks/overview.mdx b/docs/pages/multisig-for-protocols/runbooks/overview.mdx index 24122a7e3..e6d2fab91 100644 --- a/docs/pages/multisig-for-protocols/runbooks/overview.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/overview.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: reviewed + users: [] - role: fact-checked users: [] --- @@ -35,19 +37,15 @@ These are example runbooks for common multisig operations. Review and customize - [Emergency Pause Runbook](/multisig-for-protocols/runbooks/emergency-pause) - Execute urgent pause transactions with streamlined verification and backup infrastructure. -## Related Documents +## Further Reading -- [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) - Record changes and maintain +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Registration & Documentation](/multisig-for-protocols/registration-and-documentation): record changes and maintain audit trails -- [Emergency Procedures](/multisig-for-protocols/emergency-procedures) - Coordinate incidents and recovery actions -- [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure) - Use backup interfaces +- [Emergency Procedures](/multisig-for-protocols/emergency-procedures): coordinate incidents and recovery actions +- [Backup Signing & Infrastructure](/multisig-for-protocols/backup-signing-and-infrastructure): use backup interfaces when primary systems are unavailable - -## Further Reading - -- [Multisig For Protocols overview](/multisig-for-protocols/overview) - --- diff --git a/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx b/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx index fa3e308cc..a08faf1dd 100644 --- a/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/signer-rotation.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: reviewed + users: [] - role: fact-checked users: [] --- @@ -150,7 +152,7 @@ Can combine add and remove in a single transaction: **Benefits**: Atomic operation, no intermediate state with wrong threshold. -### Post-Transaction +## Post-Transaction After execution: @@ -161,7 +163,7 @@ After execution: - [ ] Test that the new signer can successfully sign a test transaction -### Offboarding Checklist +## Offboarding Checklist When removing a signer: @@ -179,17 +181,13 @@ When removing a signer: - Critical-class: 7 days - Others: 14 days -### Related Documents - -- [Joining a Multisig](/multisig-for-protocols/joining-a-multisig) -- [Threshold Change Runbook](/multisig-for-protocols/runbooks/threshold-change) -- [Offboarding](/multisig-for-protocols/offboarding) -- [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): how the runbooks in this section fit together +- [Joining a Multisig](/multisig-for-protocols/joining-a-multisig): verification steps for the incoming signer +- [Offboarding](/multisig-for-protocols/offboarding): revoking the outgoing signer's wider access +- [Threshold Change Runbook](/multisig-for-protocols/runbooks/threshold-change): the companion procedure when the + threshold moves too --- diff --git a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx index 5d27637d3..14da7250a 100644 --- a/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/threshold-change.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: reviewed + users: [] - role: fact-checked users: [] --- @@ -150,7 +152,7 @@ your organization's policies. - [ ] Update any documentation referencing old threshold -### Common Scenarios +## Common Scenarios ### Adding Signer + Adjusting Threshold @@ -173,16 +175,15 @@ When removing a signer, plan final signer count and threshold together: 1. If needed, reduce threshold first or in the same change window 2. Ensure the final configuration still meets policy requirements and avoids `N of N` -### Related Documents - -- [Planning & Classification](/multisig-for-protocols/planning-and-classification) -- [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) -- [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): how the runbooks in this section fit together +- [Planning & Classification](/multisig-for-protocols/planning-and-classification): the classification matrix that sets + the target threshold +- [Registration & Documentation](/multisig-for-protocols/registration-and-documentation): recording the change + afterwards +- [Signer Rotation Runbook](/multisig-for-protocols/runbooks/signer-rotation): the companion procedure when membership + changes too --- diff --git a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx index e549f249a..b53b3d5b8 100644 --- a/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx +++ b/docs/pages/multisig-for-protocols/runbooks/token-transfer.mdx @@ -8,6 +8,8 @@ tags: contributors: - role: wrote users: [isaac, geoffrey, louis, pablo, dickson] + - role: reviewed + users: [] - role: fact-checked users: [] --- @@ -180,16 +182,14 @@ For ERC20 or SPL tokens, verify decimals: | Nonce mismatch | Clear pending transactions first | | Recipient can't receive | Verify address is correct type (EOA vs contract) | -### Related Documents - -- [Safe Multisig: Step-by-Step Verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification) -- [Squads Multisig: Step-by-Step Verification](/wallet-security/signing-and-verification/secure-multisig-squads-verification) -- [Operational Runbooks](/multisig-for-protocols/runbooks/overview) - - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): how the runbooks in this section fit together +- [Safe Multisig Verification](/wallet-security/signing-and-verification/secure-multisig-safe-verification): the EVM + verification walkthrough +- [Squads Multisig Verification](/wallet-security/signing-and-verification/secure-multisig-squads-verification): the + Solana equivalent +- [Transaction Verification](/treasury-operations/transaction-verification): treasury-side checks before a transfer --- diff --git a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx index c6cb3f8b2..79eea63b0 100644 --- a/docs/pages/multisig-for-protocols/setup-and-configuration.mdx +++ b/docs/pages/multisig-for-protocols/setup-and-configuration.mdx @@ -137,7 +137,7 @@ invariant is violated. - [ ] Safe addresses documented for all networks -### Practice on Testnet +## Practice on Testnet Before deploying on mainnet, thoroughly practice wallet creation, transaction signing, and owner management on a test network. @@ -145,7 +145,7 @@ a test network. Once setup is complete, proceed to [Registration & Documentation](/multisig-for-protocols/registration-and-documentation) for registration and documentation requirements. -### Nested Safes +## Nested Safes A nested Safe is one in which a Safe is set as a signer on another Safe rather than an EOA. This can be useful on a case-by-case basis. For example, if a signer is an entity that might want to have multiple individual signers, the @@ -155,7 +155,7 @@ allows the signers on the nested Safe to update the signer addresses without nee It is generally recommended **not** to use nested safe on protocol multisigs unless there is a specific use case that it enables. -### Next Steps +## Next Steps After completing setup: @@ -163,7 +163,7 @@ After completing setup: 2. [Communication Setup](/multisig-for-protocols/communication-setup) - Establish secure communication 3. [Hardware Wallet Setup](/wallet-security/intermediates-and-medium-funds) - Ensure all signers are properly configured -### Active Monitoring +## Active Monitoring Implement monitoring and alerting systems to be immediately notified of any on-chain activity related to the multisig, including proposed transactions, new signatures, and owner changes (e.g., using tools like [Safe @@ -185,10 +185,15 @@ Monitoring channels (e.g. email, Slack or Telegram chats) must be immutable (or changes or logs are deleted/tampered with) and redundant such that an admin could not disable or tamper with one monitoring channel without generating an alert on the other channel. - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Planning & Classification](/multisig-for-protocols/planning-and-classification): the classification that drives these + settings +- [Use-Case Specific Requirements](/multisig-for-protocols/use-case-specific-requirements): per-function configuration + rules +- [Secure Multisig Best Practices](/wallet-security/secure-multisig-best-practices): signer, threshold, and device + design principles --- diff --git a/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx b/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx index b5d09db0e..c0b93dcd5 100644 --- a/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx +++ b/docs/pages/multisig-for-protocols/use-case-specific-requirements.mdx @@ -240,10 +240,13 @@ proposal will simply execute after the delay period. The monitoring window IS th Make timelock queues publicly visible through a dashboard or notification feed. This allows the broader community to observe pending changes, which adds an additional layer of scrutiny beyond the core team. - ## Further Reading -- [Multisig For Protocols overview](/multisig-for-protocols/overview) +- [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together +- [Planning and Classification](/multisig-for-protocols/planning-and-classification): choosing the right category first +- [Setup & Configuration](/multisig-for-protocols/setup-and-configuration): the baseline settings these requirements + extend +- [Operational Runbooks](/multisig-for-protocols/runbooks/overview): procedures for the functions described here --- From 6a9c8d84b5941c5c9daa5e4b2dd83acfcc291e48 Mon Sep 17 00:00:00 2001 From: Sara Russo Date: Mon, 3 Aug 2026 16:52:11 +0200 Subject: [PATCH 6/6] remove not needed imports and components --- docs/pages/multisig-for-protocols/key-takeaways.mdx | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/docs/pages/multisig-for-protocols/key-takeaways.mdx b/docs/pages/multisig-for-protocols/key-takeaways.mdx index e8d07f5ca..b94587478 100644 --- a/docs/pages/multisig-for-protocols/key-takeaways.mdx +++ b/docs/pages/multisig-for-protocols/key-takeaways.mdx @@ -15,10 +15,7 @@ contributors: users: [] --- -import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components' - - - +import { TagList, AttributionList, ContributeFooter } from '../../../components' # Key Takeaways @@ -120,12 +117,6 @@ Client) in case primary UIs go down. Run regular emergency drills to verify that that communication channels work. See the [Implementation Checklist](/multisig-for-protocols/implementation-checklist). ---- - -For the full framework, see the [Multisig Security Framework Overview](/multisig-for-protocols/overview). - - - ## Further Reading - [Multisig for Protocols overview](/multisig-for-protocols/overview): how the pages of this framework fit together