-
Use m-of-n multi-sig wallet
- Gnosis Safe https://safe.global/
- At least 2 of 3, but can balance between security and convenience
-
Back signers with hardware keys
- https://www.ledger.com/
- Make sure you have inventory control of keys
- Have some blank backup keys
- Make sure you use a long PIN
-
Seeds should be physically secured
- Never have a digital copy of the seed
- Make sure to test seed recovery to make sure it’s written down properly
- Store securely (but balance with accessibility)
- You can use something like Shamir’s Secret Sharing or a simple parity scheme (2/3) if you want to make it harder to physical theft
- You can have tamper-evident/security tape for seeds on envelopes to also have better control (combine with logs and regular audits)
- See also:
Policy:
- Create a treasury management policy
- Separate cold or hot wallets or by role as necessary
- Make sure that a cold/treasury wallet does is used only for transfers, no contract approvals
- Make sure you are doing accounting
- Set alerts for transactions on watch addresses
- DR Planning (lost keys and other scenarios)
- Regular auditing
Services to look into
- https://multis.com/
- https://coinshift.xyz/
- https://www.remox.io/
- https://www.mesha.club/dao-treasury-management/
- https://blog.tenderly.co/how-to-secure-multisigs-with-transaction-simulations/
- https://www.fireblocks.com/
- https://sablier.finance/
- https://www.superfluid.finance/
Guides
- https://multis.com/post/nail-your-dao-leverage-treasury-management-for-a-scalable-dao
- https://polygon.technology/blog/multisig-best-practices-to-maximize-transaction-security
- Trail of Bits Minimum Viable Plans for Security
- https://0xrusowsky.substack.com/p/on-operational-security
- https://cryptosecurity.hashnode.dev/crypto-security-best-practices-checklist
- https://www.digitalguardian.com/blog/what-operational-security-five-step-process-best-practices-and-more
- https://joelgsamuel.medium.com/how-to-keep-your-smartphone-safe-from-spying-d7d50fbed817