Loading today’s stories
Build1 distinct publisher2 min readUpdated
The multisig number in your review is not a limit if a Safe module is enabled
A reviewer who checked dozens of mainnet Safes says the threshold is rarely the weak point. Two commands would show whether it binds anything at all.
The Engineer · Build desk
What happened
- A security reviewer publishing as 0xrivet on dev.to writes that after checking a few dozen Safes on mainnet for bridge and protocol security reviews, the threshold is rarely the weakest link, and lists five other things that determine whether a Gnosis Safe actually protects funds.
- Safe modules are contracts authorised to execute transactions from the Safe; a module can execute any transaction from the Safe without a single owner signature, because the module has its own authority, and the threshold is irrelevant to it.
- Modules are enumerated with a call to getModulesPaginated(address,uint256) returning (address[],address), using the sentinel address 0x0000000000000000000000000000000000000001 and a page size of 10.
- The post says modules are legitimate uses such as timelocks, but a malicious or compromised module is a full bypass of every threshold: "Your 7-of-10 means nothing if a module can move funds independently."
- A guard contract adds validation on top of the threshold, such as restricting destinations, limiting values or blocking certain operations; the guard address lives at storage slot 0x4a204f620c8c5ccdca3fd54d003badd85ba500436a431f0cbda4f558c93c34c8, and if it reads 0x00 there is no guard.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
The module list goes unread because it does not fit the shape of a review. A threshold is one integer and it drops into a table cell. The module list is a variable-length array behind a paginated getter [3], and reporting it honestly means writing a sentence about which contracts hold unilateral spend authority over the treasury [2]. Table cells get filled in. Sentences get deferred to the next engagement.
The fix is priced in single commands. One `cast call` returns the enabled modules [3]. One storage read at a fixed slot returns the guard address, or `0x00` when there is no guard at all [5]. Two commands [14]. The author, publishing as 0xrivet, puts the stake plainly: a 7-of-10 means nothing if a module can move funds independently [4].
The guard read matters for a second reason, which is where delegatecall lands. `execTransaction` carries an operation flag, and when it is set to 1 the target contract's code executes in the Safe's own storage context, free to rewrite ownership or change the threshold [7]. The post reads Bybit's loss that way: the payload contained `operation: 1`, the target replaced the implementation, and the signatures were all valid [8]. Nothing in that sequence is a signature failure. Without a guard that explicitly blocks the delegatecall path, a quorum in good standing can hand over the contract [9].
Then there is the item no command answers. Whether nine owners are nine organisations or one operator holding nine addresses is off-chain work: trace each owner's first inbound transfer and look for a shared origin [12]. Ronin's 5-of-9 [10] is the worked example of why that check exists. The fifth signature sat behind an allowlisted key granted under a gas-free RPC arrangement in November 2021 and never revoked, so a single compromised developer machine produced five of the nine [11].
Even the on-chain reads have an edge to them. The sample module enumeration asks for ten entries and returns a next pointer alongside the array [3], so a reviewer who reads the first page and stops has established the first ten modules and nothing about the eleventh [15]. That is the same failure as quoting the threshold, one layer down: a number retrieved correctly and then treated as the whole answer.
Loading topic controls
Loading related stories