Token Program Multisig Guidelines (May 2025)

[theshelb]

Hey @SEEDGov! Apologies for the slow reply - thanks for sharing your feedback!

I would like to start by saying that the guidelines shared above are not enforceable. The purpose of the guidelines is to provide a starting point for Token Program leads/proposal authors to reference when designing a program that may require a multisig. Program leads and proposal authors can choose to add additional layers of security depending on the amount that the multisig controls or the importance of the contract they are the admin of.

@SEEDGov

Have an exhaustive list of approved hardware wallets for this task;

Good observation. We will reach out to our security advisors and ask for a list of hardware wallets.

@SEEDGov

For Medium and High signers, require two hardware wallets for each key/multisig with the same PIN, one as the primary device and the other one as backup. After confirming that both devices can create valid signatures, the seed phrase should be destroyed;

@SEEDGov

Keys should be rotated every certain period, let’s say two years;

We can add these two suggestions to the “For high-risk multisig, here are additional measure to consider:” list under the Signer Guidelines Checklist.

@SEEDGov

For all signers, hardware wallets must not be reused on different multisigs simultaneously;
For all signers, hardware wallets must not be used for any activities other than signing multisig transactions;

Agree. This is included under the Signer Guidelines Checklist.

@SEEDGov

Multisigs should avoid changing the number of signers without approval from the Token Assembly; and

Multisigs may have to change the number of signers for a variety of reasons throughout a program. We’ve added in the guidelines that any changes of multisig signers should be communicated publicly on the governance forum.

In addition, all multisig signers in relation to a Token Program will be contractually bound to deliver the scope of each Token Program through ZKGPS. The Token Assembly is allowed to “pull the plug” on a Token Program at any time by passing a TPP to remove the minter role from all relevant capped minters if they do not agree with the changes to a multisig.

@SEEDGov

A good practice is to use the ‘approve’ function, if available, when transferring tokens.

In most cases, multisig signers for Token Programs will never have custody of minted tokens. Rather, they will be managing capped minter contracts / minting rights to capped minter contracts.