How M-of-N multisig threshold enforcement works in smart contract wallets

05 September 2026

Multisig wallets require multiple approvals before a transaction executes. The threshold is the number of required confirmations. For an M-of-N setup, any M signers out of the N total can authorize an operation, and the enforcement lives entirely on-chain inside the wallet contract.

Off-chain signature collection

Signers never submit individual transactions. They sign the same transaction data off-chain using their private keys through a secure interface - usually a browser extension or mobile app. Each signer produces an ECDSA signature over a standardized hash of the transaction payload.

The signatures remain off-chain until someone collects enough to meet the threshold. A single coordinator, often a relayer or one of the signers, gathers the M required signatures. No partial submission touches the blockchain.

The single submission transaction

Only one on-chain transaction ever occurs. The coordinator packages all M signatures together with the raw transaction data, and this bundle goes to the wallet contract in a single call.

Safe (formerly Gnosis Safe) is the most widely deployed smart contract wallet implementing this pattern. In Safe's execTransaction function, the contract receives the signatures bytes array, extracts each signature sequentially, checks the recovered signer against the stored owner set, and also confirms the signer's position has not already voted. If any signature fails, the entire transaction reverts. The threshold parameter is immutable for that specific execution; the contract stores the threshold as a uint256, and when execTransaction runs, it verifies signatures.length >= threshold. This prevents partial authorization.

Verification logic inside the wallet

Safe's verification process works as follows. The wallet holds an array of owner addresses. Each signature is parsed to recover the signer's address, and the contract checks that this address exists in the owners array. It also uses a bitmap to track which owners have already signed - this prevents one signer from filling the threshold alone.

The recovered signer must match the hash of the current transaction data. Safe uses EIP-712 typed structured data hashing, which includes the transaction's to, value, data, operation, safeTxGas, baseGas, gasPrice, gasToken, refundReceiver, and a nonce. The nonce prevents replay attacks and ensures each transaction is unique.

Threshold changes and signer rotation

The threshold is not permanent. Safe allows owners to change both the signer set and the threshold through an internal transaction, and this requires a multisig operation itself. The proposal to swap out signer A for signer B must reach the existing threshold. Once executed, the new owner set and threshold take effect for all subsequent transactions, meaning signer rotation has the same security model as any other operation. There is no backdoor or administrative override.

If the threshold is 2-of-3, removing owner C requires signatures from A and B. The same logic applies to increasing the threshold from 2 to 3: the change requires the current threshold, not the proposed one.

Gas cost implications

Each signature adds fixed gas costs. The signature bytes arrive as calldata, and the contract must do computation to recover each signer. ECDSA signature recovery is an elliptic curve operation costing roughly 3000 gas per signature on Ethereum. Adding the calldata and memory costs, a second signature adds about 5000-7000 gas total.

For a 3-of-5 Safe, the gas overhead from signatures is around 15000-21000 gas, compared to approximately 21000 base gas for any Ethereum transaction. The signature processing can double total gas for simple transactions. For complex transactions with heavy computation, the signature overhead becomes a smaller relative cost.

Contrast with single-signature smart accounts

Single-signature ERC-4337 smart accounts send one UserOperation per execution. The bundler verifies the single signature against the EntryPoint contract. Gas cost per signature is lower because the EntryPoint handles verification efficiently.

Multisig wallets cannot use ERC-4337 natively because each UserOperation requires a single signature from the account owner. A multisig strategy must move the threshold verification into the wallet contract itself, meaning the UserOperation's signature is simply a placeholder for the real multisig validation that happens during execution. The tradeoff is clear: multisig provides distributed security but adds gas overhead, while single-signature accounts optimize for speed and cost. Neither design is strictly superior - the choice depends on the asset value and risk tolerance of the wallet's users.

Back to smart wallets