LibraryData and agents2023Design paperCorpus record
Safe: owner sets, thresholds, and modules
Safe Smart Account. Safe.
A Safe account stores owners and a threshold. Execution is valid when enough owners sign, or when a module the owners enabled is allowed to call.
A reading of the project's public design document. Not a copy, not a benchmark, and not an offer.
A Safe account stores owners and a threshold. Execution is valid when enough owners sign, or when a module the owners enabled is allowed to call.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 3
- Records linked
- 2
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
The defect
A multisig that can add a module has moved authority. The module can act without a fresh owner signature if the docs say it can.
Claim 02 · Paper model
The proposal
A Safe account stores owners and a threshold. Execution is valid when enough owners sign, or when a module the owners enabled is allowed to call.
Claim 03 · Paper model
The mechanism
Owners and the threshold live in account storage. Changing them is itself a Safe transaction, not an off-hand admin call, in the documented design.
Claim 04 · Paper model
The bound
This note does not say a Safe is quantum-safe, and it does not say that rotating a signer changes the signature scheme.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 The defect
Observation
What the study says
A multisig that can add a module has moved authority. The module can act without a fresh owner signature if the docs say it can.
Model
What has to hold
You are reading Safe's public docs. A wallet interface is not the account contract.
Falsifier
What would retire it
Can a module execute without a fresh owner signature?
02 The proposal
Observation
What the study says
A Safe account stores owners and a threshold. Execution is valid when enough owners sign, or when a module the owners enabled is allowed to call.
Model
What has to hold
You are reading Safe's public docs. A wallet interface is not the account contract.
Falsifier
What would retire it
Where are owners and the threshold stored?
03 The mechanism
Observation
What the study says
Owners and the threshold live in account storage. Changing them is itself a Safe transaction, not an off-hand admin call, in the documented design.
Model
What has to hold
You are reading Safe's public docs. A wallet interface is not the account contract.
Falsifier
What would retire it
Where are owners and the threshold stored?
04 The bound
Observation
What the study says
This note does not say a Safe is quantum-safe, and it does not say that rotating a signer changes the signature scheme.
Model
What has to hold
You are reading Safe's public docs. A wallet interface is not the account contract.
Falsifier
What would retire it
Can a module execute without a fresh owner signature?
03 Sequence
One action, as an operating tape
- 01Owners and the threshold live in account storage. Changing them is itself a Safe transaction, not an off-hand admin call, in the documented design.
- 02Modules execute through a separate entry point. That entry point is the part of the design people skip when they say the threshold is the whole policy.
- 03Signatures are an ordered set of owner approvals. The order and the encoding are part of validity.
04 Load-bearing
The argument, and where a pitch drops it
What the name has to mean
The cut
A Safe account stores owners and a threshold. Execution is valid when enough owners sign, or when a module the owners enabled is allowed to call.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A module's bug is an authority bug. The threshold does not contain it.
What actually moves
The cut
Modules execute through a separate entry point. That entry point is the part of the design people skip when they say the threshold is the whole policy.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A module's bug is an authority bug. The threshold does not contain it.
What a later deployment may change
The cut
Signatures are an ordered set of owner approvals. The order and the encoding are part of validity.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A later client, parameter or reward formula is a different object from this paragraph.
05 Register
What has to be true
Model · Not re-measured
You are reading Safe's public docs. A wallet interface is not the account contract.
Model · Not re-measured
The document is the one at the source URL. A marketing page with the same brand is not this text.
Model · Not re-measured
No price, supply, yield, or adoption figure is added by this desk.
06 Divergence
What happened after the paper
A module's bug is an authority bug. The threshold does not contain it.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 3 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
A multisig that can add a module has moved authority. The module can act without a fresh owner signature if the docs say it can.
What the design proposes
- Owners and the threshold live in account storage. Changing them is itself a Safe transaction, not an off-hand admin call, in the documented design.
- Modules execute through a separate entry point. That entry point is the part of the design people skip when they say the threshold is the whole policy.
- Signatures are an ordered set of owner approvals. The order and the encoding are part of validity.
How the mechanism is specified
- Owners and the threshold live in account storage. Changing them is itself a Safe transaction, not an off-hand admin call, in the documented design.
- Modules execute through a separate entry point. That entry point is the part of the design people skip when they say the threshold is the whole policy.
- Signatures are an ordered set of owner approvals. The order and the encoding are part of validity.
What this page does not treat as proven
- This note does not say a Safe is quantum-safe, and it does not say that rotating a signer changes the signature scheme.
- It states no asset total held in Safes.
- A module's bug is an authority bug. The threshold does not contain it.
Why the desk still reads it
A Safe account stores owners and a threshold. Execution is valid when enough owners sign, or when a module the owners enabled is allowed to call.
09 Lexicon
Terms, opened into the record
- Threshold
- The number of owner signatures required for an ordinary execution.
- Module
- Code the account enabled to act under its own rules. It is a second authority.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
Concepts
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.