Wallets & security
Multisig modules: the threshold is only part of the story
Enabled modules can add execution paths beyond the familiar owner flow.
Research articles and reference entries are published in English. Navigation is available in seven languages.
People & projects
In this article
- Inspect what is enabled Record owners, threshold, modules and other relevant configuration. Identify each module's code and the conditions it uses to authorise actions. If an extension depends on another contract or upgrade authority, continue tracing that dependency instead of stopping at the first address.
- Ask a concrete control question Could one compromised key or service use an enabled path to move funds without collecting the owner signatures normally expected? The answer depends on the implementation. It cannot be derived from the word multisig alone.
- Describe the complete boundary A useful report states which paths were examined and which remain unresolved. Separate an intentionally installed automation module from an unexpected module added during compromise. Record configuration changes with transaction references so a reader can reconstruct when the account's security model changed. A threshold screenshot without the surrounding configuration is an incomplete audit trail.
Safe modules extend an account's behaviour and can enable transaction execution through module-specific logic. A dashboard showing multiple owners and a signing threshold does not, by itself, describe every enabled execution path.
Inspect what is enabled Record owners, threshold, modules and other relevant configuration. Identify each module's code and the conditions it uses to authorise actions. If an extension depends on another contract or upgrade authority, continue tracing that dependency instead of stopping at the first address.
Ask a concrete control question Could one compromised key or service use an enabled path to move funds without collecting the owner signatures normally expected? The answer depends on the implementation. It cannot be derived from the word multisig alone.
Describe the complete boundary A useful report states which paths were examined and which remain unresolved. Separate an intentionally installed automation module from an unexpected module added during compromise. Record configuration changes with transaction references so a reader can reconstruct when the account's security model changed. A threshold screenshot without the surrounding configuration is an incomplete audit trail.
Sources
Safe documentation · smart-account-modulesTechnical reference checked 9 September 2026. The review questions are editorial analysis, not findings about a named project.