trust-machines / multisafe

MultiSafe is a shared crypto wallet for managing Stacks (STX) and Bitcoin (BTC).

MultiSafe

MultiSafe is a shared crypto wallet for managing Stacks (STX) and Bitcoin (BTC).

Deploy a MultiSafe

https://app.multisafe.xyz/

Features

Current supported features:

• Send, transfer and hold STX
• SIP-009 Non-fungible token and SIP-010 Fungible token support
• Supports up to 20 owners

Future updates (coming soon):

• User-friendly app
• Native Bitcoin (BTC) support

Security

CoinFabrik audit report

Least Authority audit report

Please report any security issues you find via our bug bounty program on Immunefi.

Clarity Usage

Requires Clarinet

Install Clarinet: https://github.com/hirosystems/clarinet

MultiSafe is written in Clarity and therefore requires you to install Clarinet locally on the command line. Type the following command to check that you have Clarinet installed:

$ clarinet --version

Please make sure you have Clarinet version 0.31.1 or higher installed.

Download MultiSafe

1. Clone the repo:

$ git clone https://github.com/Trust-Machines/multisafe.git && cd multisafe

2. Run the unit test to confirm all the tests passed and everything is working:

$ clarinet test

3. Open the Clarinet console in order to interact with the contract

$ clarinet console

Setup the first MultiSafe owners

Go to /contracts/safe.clar. At the bottom of that contract you'll see a list with three sample owners. These are the default Clarinet wallets that you can use for testing locally in Clarinet.

(init (list 
    'ST1SJ3DTE5DN7X54YDH5D64R3BCB6A2AG2ZQ8YPD5 
    'ST2CY5V39NHDPWSXMW9QDT3HC3GD6Q6XX4CFRK9AG 
    'ST2JHG361ZXG51QTKY2NQCVBPPRRE2KZB1HR05NNC
) u2)

If you'd like to deploy to mainnet/testnet update those wallet addresses with your own wallet addresses.

Get Safe Owners

(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe get-owners)

In the example above ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe is your safe's contract name.

get-owners will return [ST1SJ3DTE5DN7X54YDH5D64R3BCB6A2AG2ZQ8YPD5, ST2CY5V39NHDPWSXMW9QDT3HC3GD6Q6XX4CFRK9AG, ST2JHG361ZXG51QTKY2NQCVBPPRRE2KZB1HR05NNC]

Get confirmation threshold

(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe get-threshold)

The Clarinet console demo will return u2

In this example “u2” tells us that we need a minimum of 2 confirmations in order to approve a transaction

Add new owners

1. Change the transaction sender to “wallet_1”

::set_tx_sender ST1SJ3DTE5DN7X54YDH5D64R3BCB6A2AG2ZQ8YPD5

2. Add a new user to the wallet. In this example, we add “wallet_9” to MultiSafe.

(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe submit 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.add-owner 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.ft-none 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.nft-none (some 'STNHKEPYEPJ8ET55ZZ0M5A34J0R3N5FM2CMMMAZ6) none none)

ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM = deployer 'STNHKEPYEPJ8ET55ZZ0M5A34J0R3N5FM2CMMMAZ6 = wallet_9

3. If you “get-owners” you’ll see that there are still only 3 owners. In order to confirm the 4th owner you will need to switch to “wallet_2” or “wallet_3” (the other owner”) and approve the transaction.

(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe get-owners)

Returns: [ST1SJ3DTE5DN7X54YDH5D64R3BCB6A2AG2ZQ8YPD5, ST2CY5V39NHDPWSXMW9QDT3HC3GD6Q6XX4CFRK9AG, ST2JHG361ZXG51QTKY2NQCVBPPRRE2KZB1HR05NNC]

4. Change owner to wallet_2

::set_tx_sender ST2CY5V39NHDPWSXMW9QDT3HC3GD6Q6XX4CFRK9AG

5. As wallet_2 owner, now you can approve the 4th new owner

(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe confirm u0 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.add-owner 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.ft-none 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.nft-none)

6. Call “get-owners” again and you will see the 4th owner has been added

(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe get-owners)

Returns: [ST1SJ3DTE5DN7X54YDH5D64R3BCB6A2AG2ZQ8YPD5, ST2CY5V39NHDPWSXMW9QDT3HC3GD6Q6XX4CFRK9AG, ST2JHG361ZXG51QTKY2NQCVBPPRRE2KZB1HR05NNC, STNHKEPYEPJ8ET55ZZ0M5A34J0R3N5FM2CMMMAZ6]

Send STX to the MultiSafe

If you are the wallet_3 owner (ST2JHG361ZXG51QTKY2NQCVBPPRRE2KZB1HR05NNC) then the following command will allow you to send STX from your wallet to the MultiSafe

(stx-transfer? u5000 'ST2JHG361ZXG51QTKY2NQCVBPPRRE2KZB1HR05NNC 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe)

::get_assets_maps will show you that the STX has been transfered into the .safe contract

Send STX from MultiSafe to a new wallet

In this example, using Clarinet console, we will send STX from MultiSafe to "wallet_7"

1. Send STX to wallet_7

Assuming you are an owner — in this example, you will send 1000 uSTX from the MultisSafe to wallet_7 (ST3PF13W7Z0RRM42A8VZRVFQ75SV1K26RXEP8YGKJ).

(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe submit 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.transfer-stx 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe 
'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.ft-none 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.nft-none (some 'ST3PF13W7Z0RRM42A8VZRVFQ75SV1K26RXEP8YGKJ) (some u1000) none)

2. Change owner to wallet_2

::set_tx_sender ST2CY5V39NHDPWSXMW9QDT3HC3GD6Q6XX4CFRK9AG

3. Wallet_2 can now confirm the transaction

(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe confirm u1 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.transfer-stx 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.ft-none 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.nft-none)

MultiSafe now has -1000 uSTX, and wallet_7 +1000 uSTX

API Reference

Owner only functions

The following function can be run by only safe owners:

submit (executor <executor-trait>, safe <safe-trait>, param-ft <ft-trait>, param-nft <nft-trait>, param-p (optional principal), param-u (optional uint), param-b (optional (buff 20))) => (response uint)

confirm (tx-id uint, executor <executor-trait>, safe <safe-trait>, param-ft <ft-trait>, param-nft <nft-trait>) => (response bool)

revoke (tx-id uint) => (response bool)

Safe only functions

The following functions can be run by only safe contract itself and requires the minimum number of confirmations:

add-owner (owner principal) => (response bool)

remove-owner (owner principal) => (response bool)

set-threshold (value uint) => (response bool)

Views (Read only functions)

get-version() => string-ascii

get-owners() => list

get-threshold() => uint

get-nonce() => uint

get-info() => tuple

get-transaction (tx-id uint) => tuple

get-transactions (tx-ids (list 20 uint)) => list

multisafe's Issues

Deposit not showing in safe

I deployed my first safe to mainnet and deposited 5 STX but it doesn't appear in the UI:

• Safe deployment: https://explorer.stacks.co/txid/0x1bd774bf557059fef27b76e6f52fd9dfbc9967533a6951657b23dcc7289d670d?chain=mainnet
• Deposit: https://explorer.stacks.co/txid/0xc86b7ed4b01afc54edfb6b76f393147e650a357ad016ab005975ae0b1575ff6f?chain=mainnet

Changing `min-confirmations` affects all transactions

When we change min-confirmations from X to Y it affects both on going and future transactions.
I think that each transaction should have its own fixed min-confirmation threshold that is set up when transaction is created.

app.multisafe.xyz should have a link back to docs or this repo

A user landing straight on https://app.multisafe.xyz/ without knowing about https://linktr.ee/multisafe or this repo should be helped to reach them.
Perhaps add a link to one or both of those pages on the app page too. In the navbar or footer perhaps? Something like: "Docs - Github"

Crucial functions are secured with `tx-sender`

It is not a bug per-se, but securing crucial functions with just tx-sender can be considered as security flaw.

Depending on your security strategy and approach I would suggest securing those functions with contract-caller or add 1uSTX transfer to crucial functions in order to enforce the need to construct TX with post-conditions.

Reference: https://github.com/LNow/clarity-notes/blob/main/security/function-calls.md

FT and NFTs do not display correctly on testnet MultiSafes because metadata is disabled

Thinking this is more of an issue with Stacks API issue for testnet and that metadata is disabled on it, but logging here anyway as well since the presence of it makes it significantly more difficult to test the MultiSafe with various assets (since you can't differentiate them in the UI).

In UI there it is not possible to revoke a pending, unauthorized transaction

On the Transactions page, when loaded by for review an owner that was not the transaction originator, there is no REVOKE button. So hypothetically speaking, let's say one of the owner accounts was compromised and an unauthorized transaction was made by it. There is no revoke button for the other owners.

Add 'get-owners' or 'get-info' function to safe-trait

Adding 'get-owners' or 'get-info' function to safe-trait would allow on-chain verification of safe owner from other clarity contracts.

e.g.
In LEOS project, this will help verify if a user have created multi-safe contract, is in the list of owners of that contract or not.

License is missing from this repository and needs to be added

@talhasch

Hello, we just observed there is no License file in this repository -- we're interested in developing on top of MultiSafe and extending it via code contributions here but can't do so if there is no license defined since the opaqueness of not having one creates an undefined state of what is permissible use of this code.

Cc: @muneeb-ali

A list of improvements

• Optional transaction parameters
  param-p and param-u are not necessary for every transaction. It's better to have them as optional to keep state data smaller.

• A new buffer parameter
  An optional buffer parameter param-b to use for transfer memo.

• sip-009 and sip-010 support:
  This is something we must have for built-in ft and nft transfers. We need two more executors and transaction parameters as param-ft (sip-009-trait) and param-nft (sip-010-trait). They won't be optional since trait references cannot be stored on smart contracts and they have to be validated in confirm function by taking principal. values with contract-of function. Therefore we'll need to use some default/none/null values for transactions other than token/nft transfers. I believe that is a reasonable trade-off to provide support for all tokens/nfts.

• Include transaction id in get-transaction(s) function response to provide better ux.

• Rename min-confirmation (and all related variables and constants) to threshold to avoid confusion.

• Info function:
  A new function to allow read all basic safe information (version, owners, threshold, nonce) at once.

• Test improvements:
  Our tests getting bigger and they should be improved to provide a cleaner code. Some re-uses can be optimized.

[BUG] Owners can set min-confirmation > 20 and by doing so they can lock safe permanently.

multisafe/contracts/safe.clar

Lines 124 to 130 in e5a3768

	(define-public (set-min-confirmation (value uint))
	(begin
	(asserts! (is-eq tx-sender SELF) ERR-CALLER-MUST-BE-SELF)
	(asserts! (> value u0) ERR-MIN-CONFIRMATION-CANT-BE-ZERO)
	(ok (set-min-confirmation-internal value))
	)
	)

There should be one more asserts! that ensures value is less than or equal 20.

Open sourcing frontend code for app.multisafe.xyz

Does this initiative exist? Might be worth considering adding to this repo (or its own separate repo if that is preferred).

This will enable people to contribute to improving the UI, UX, etc. Speaking for myself, I noted some issues + opportunities and would be interested.

Example issue:

On the Transactions page, when loaded by for review an owner that was not the transaction originator, there is no REVOKE button. So hypothetically speaking, let's say one of the owner accounts was compromised and an unauthorized transaction was made by it. There is no revoke button for the other owners.

Use send-many-memo for STX transfers

It's better to use SP3FBR2AGK5H9QBDH3EEN6DF8EK8JY7RX8QJ5SVTE.send-many-memo contract to make STX transfers instead of using stx-transfer function since using memo with transfers something mandatory while transferring money to centralized exchanges.

[BUG] One "transaction" can be executed multiple times.

If safe have multiple owners, then one transaction can be executed more than once.

# switch to one of the owners
::set_tx_sender ST1SJ3DTE5DN7X54YDH5D64R3BCB6A2AG2ZQ8YPD5
# create new "transaction"
(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe submit 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.set-min-confirmation 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe .tx-sender u3)

# change to 2nd owner
::set_tx_sender ST2CY5V39NHDPWSXMW9QDT3HC3GD6Q6XX4CFRK9AG
# confirm transaction => 1st execution
(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe confirm u0 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.set-min-confirmation 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe)

# change to 3rd owner
::set_tx_sender ST2JHG361ZXG51QTKY2NQCVBPPRRE2KZB1HR05NNC
# confirm transaction => 2nd execution
(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe confirm u0 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.set-min-confirmation 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe)

Add here:

multisafe/contracts/safe.clar

Lines 237 to 244 in e5a3768

	(let
	(
	(tx (unwrap! (map-get? transactions tx-id) ERR-TX-NOT-FOUND))
	(confirmations (get confirmations tx))
	)
	(asserts! (is-none (index-of confirmations tx-sender)) ERR-TX-ALREADY-CONFIRMED-BY-OWNER)
	(asserts! (is-eq (get executor tx) (contract-of executor)) ERR-TX-INVALID-EXECUTOR)

one extra assert:

(asserts! (not (get confirmed tx)) ERR-TX-CONFIRMED)

Buffer size use is limited

With only 20 bytes for FT/NFT param-b, there is limited information that can be kept
Addresses (at least) 40 characters
Transactions 66 characters
uuid 36 characters

saving it as binary, compressed or both may save a few bytes but doesn't change the fact, that to keep any meaningful information an external storage is required, What where the design goals for the size?

A public function to get transaction count

We need a variable + getter function to read total transaction count on the safe.