Safe (Gnosis Safe)

Summary

Safe (originally Gnosis Safe) is the canonical experiment in onchain shared custody: an m-of-n threshold multisig that grew into a general-purpose "smart account" platform. Its lineage starts with the Gnosis MultiSigWallet of early 2017 — which became the de-facto ICO-era treasury standard after the Parity multisig disasters — and was rebuilt in 2018 as Gnosis Safe, a gas-optimized, formally verified contract system by Richard Meissner's team at Gnosis, with the full Gnosis Safe Multisig product launching publicly in 2019. In mid-2022 the project spun out of GnosisDAO via governance proposal GIP-29, rebranded to Safe, raised $100M led by 1kx, and launched SafeDAO with a (initially non-transferable) SAFE token airdropped to early users. Safe became the default treasury infrastructure for DAOs, protocols, and institutions: by the mid-2020s it reported over $1 trillion in cumulative processed volume, tens of millions of deployed accounts, and at times roughly a third of all EVM DeFi TVL held in Safes. It is arguably the most successful piece of wallet infrastructure ever shipped on Ethereum — while the 2025 Bybit incident showed that its weakest link was never the contracts but the interfaces around them.

Design (Mechanism)

• Threshold multisig core. A Safe stores a linked list of owner addresses and a threshold k. execTransaction executes an arbitrary call (or delegatecall) only when accompanied by k valid owner signatures over an EIP-712 typed hash that includes a per-Safe nonce (replay protection). Signatures may be ECDSA, onchain pre-approved hashes, or EIP-1271 contract signatures — so Safes can own Safes, enabling nested org structures.
• Singleton + proxy. All logic lives in one audited, formally verified singleton contract per version (v1.3.0 canonical: 0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552); each user account is a ~minimal proxy that delegatecalls into it. Deployment via the ProxyFactory with CREATE2 yields deterministic addresses, letting the same Safe address be claimed across every EVM chain — cheap to deploy, and upgrades are strictly opt-in per account.
• Modules. Whitelisted external contracts may execute transactions without signatures, enabling alternative access patterns: allowance/spending-limit modules, social recovery, session keys, automation, and the ERC-4337 module that makes a Safe an account-abstraction-compatible smart account.
• Guards. An optional hook contract is consulted before and after every execTransaction and can revert — the extension point for policy: co-signing services, timelocks, whitelists, compliance checks.
• Fallback handler. Unrecognized calls delegate to a swappable handler; the default CompatibilityFallbackHandler provides EIP-1271 isValidSignature, ERC-165, and token-receiver callbacks.
• Token/governance layer (2022). GIP-29 spun SafeDAO out of GnosisDAO; 1B SAFE minted, ~5% airdropped to past users (claim window Sept–Dec 2022). SAFE launched deliberately non-transferable to force governance-first participation; transferability was only enabled in 2024 after repeated SafeDAO votes.

Outcome

Major, durable success. Gnosis-lineage multisigs secured >$1B within a few years of 2017; after the 2022 spin-off Safe became the standard back-end for DAO treasuries (Ethereum Foundation-adjacent orgs, most major protocol DAOs), institutional self-custody, and rollup bridge/upgrade councils. Reported figures across 2024–2026: ~$60–100B in assets secured at peaks, 57M+ accounts deployed rising past 61M by Q1 2026, 122.9M cumulative transactions, >$1T total value processed, and Safe accounts holding more than one-third of EVM DeFi TVL. The org restructured (Safe Ecosystem Foundation as steward, Safe Labs as wallet company from 2025), crossed $10M annualized revenue in 2025, and launched Safenet. The major blemish: on 21 Feb 2025, Lazarus Group compromised a Safe{Wallet} developer's macOS machine, injected malicious JavaScript into the interface's AWS S3 bucket targeting Bybit specifically, and blind-signed Bybit's signers into a malicious implementation upgrade — a ~$1.5B theft, the largest crypto hack in history. The Safe contracts themselves were not exploited.

Why it worked

• Minimal trusted core, maximal extensibility. The audited singleton does almost nothing beyond signature checking and execution; modules/guards/handlers push innovation to the edges without expanding the core attack surface. This let one contract serve DAOs, exchanges, retail recovery wallets, and 4337 accounts alike.
• Right product at the right moment. Parity's 2017 hack/freeze destroyed trust in the main alternative just as ICO treasuries needed custody; Gnosis's multisig inherited that demand and never lost the default position.
• Deterministic cross-chain addresses made Safe the natural identity primitive for multichain orgs.
• Credible neutrality via spin-off. Separating Safe from Gnosis (GIP-29) and giving governance to SafeDAO made competitors comfortable building on it; the non-transferable token start avoided a mercenary dump defining the community.
• Network effects of tooling. Transaction service, SDKs, {Core} protocol, and hundreds of integrated apps made switching costs enormous.

Limitations and criticisms

• Interface centralization. The Bybit hack showed that the effective security of a "trustless" multisig collapses to the security of a web frontend in an S3 bucket plus hardware wallets that can't render EIP-712 payloads humans can read. Blind signing made a 2-of-N-of-billions setup phishable even though the audited contracts themselves were never touched.
• Weak token value capture. SAFE's tokenomics lag its protocol success; usage of the free, unopinionated contracts doesn't route revenue to the DAO, and the two-year non-transferability period frustrated airdrop recipients (holders publicly asked for unlocks).
• UX drag. Multisig coordination latency and gas overhead keep Safe primarily a power-user/organization tool; retail smart-account adoption has come slower than the 4337 narrative promised.

Lessons

• The contract is rarely the weakest link. Years of formal verification were bypassed by one compromised developer laptop; end-to-end signing integrity (verifiable frontends, hardware-legible payloads, independent transaction simulation) matters as much as onchain code.
• A tiny audited core plus permissionless extension points (modules/guards) is the winning architecture for financial infrastructure — it compounds trust while still allowing innovation.
• Deterministic addresses are a mechanism, not a convenience: CREATE2 cross-chain identity is what made one wallet the coordination layer for multichain organizations.
• Spinning infrastructure out of its parent (GIP-29) buys neutrality, but launching a token without a value-capture mechanism buys governance theater; protocol success does not automatically translate to token success.
• Non-transferable token launches can filter for governance-motivated holders, but they also create pent-up sell pressure and community resentment if the lock drags on without a clear schedule.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial speculation. A redesigned Safe would treat the signing pipeline as part of the protocol: require k-of-n interface diversity (signatures only valid if produced against independently built, content-addressed frontends — e.g., IPFS-pinned UIs whose hash is committed in the signed payload) so that compromising one web distribution cannot forge what all signers see. Guards could enforce a mandatory timelock plus onchain-simulated effects digest for any implementation change or delegatecall, making a Bybit-style "masked upgrade" impossible to execute in a single sitting. On the token side, value capture could have been designed in from GIP-29 — e.g., an optional protocol fee on Safenet-style co-signing/settlement services flowing to SafeDAO — rather than launching governance rights over a free good and hoping revenue would be found later. Finally, a native "session key with spending envelope" module as a first-class default (rather than an ecosystem add-on) would likely have accelerated retail smart-account adoption ahead of the 4337 wave.