BC10: Capstone: a shared fund the group can trust
Project 2: a multi-signature vault
🎯You'll be able to
Complete Project 2: a SakhiVault where three of five members must approve, on-chain or with signed approvals, with no way for one key to act alone.
🏠The everyday picture
The group's bank account needs three of five office holders' signatures on every cheque, and changing the signatories needs the same three signatures on a letter to the bank.
📘What it really is
- Set-up checks: no duplicate or zero owners, and a threshold between 1 and the number of owners.
-
The flow:
submit,confirmonce per owner,revoke, andexecuteonce, marked done before the call and reverted if the call fails. -
Owner changes:
addOwner,removeOwnerandchangeThresholdonly through the vault's own approved transactions. - Signed approvals: EIP-712 with the vault's name, version, chain ID and address, and its nonce; signatures sorted by signer.
- The design (
docs/multisig-design.md): owners and threshold ("3 of 5"), approving, lost or stolen keys, and not verified.
📝A worked example
Input: test 04 failing on the starter: one owner's second confirm doesn't revert.
Steps:
- Read the test: M01 confirms twice and expects
AlreadyConfirmed, then checks the count is 1. - Read the starter:
confirmsetsconfirmedByand adds one to a counter, without checking whether it was already set. - Refuse a second confirm from the same owner, count only current owners' confirmations, and run
npm run test:multisig.
Expected output: test 04 passes, and one owner can't reach the threshold alone.
🌍Where it's used
- Treasuries of organisations and projects.
- Admin roles for contracts and upgrades.
- Custody of shared funds.
📝Case scenario
A learner's vault passed tests 1 to 7 and 8, but failed test 9: a signature made for a second vault worked on the first. Their
domain left out the vault's address. Adding verifyingContract to the domain, as docs/FORMATS.md says, made each vault's
signatures its own.
🖱️Try it
Run npm run test:multisig on the starter and read test 07's failure. Success: you can say which single owner action the starter
allows that it shouldn't.
⚠️Common mistakes
- Marking executed after the call. Sign: test 06 fails. Fix: mark first, revert on failure.
- Owner changes by any owner. Sign: test 07 fails. Fix: only through the vault.
- Signatures without nonce or domain. Sign: tests 8 and 9 fail. Fix: EIP-712 with the vault's nonce.
🛠️For your project
Project 2's evidence: the output of npm run test:multisig with 10 passing, docs/multisig-design.md, and a note that real wallets and
key ceremonies were not verified.
✅Quick check
What stops signed approvals being used on another vault?
Show the answer
The vault's own address in the signed domain.
Who can remove an owner from SakhiVault?
Show the answer
Only the vault itself, through a transaction approved by 3 of 5 owners.