Multisig Policy
Gnosis Safe configuration, threshold roadmap, signer policy, and project continuity measures.
Treasury Safe: 0x5ad6193eD6E1e31ed10977E73e3B609AcBfEcE3b — 3-of-5 active (5 signers).
LP Reserve Safe: 0x5D93E7919a71d725054e31017eCA86B026F86C04 — 3-of-5 (same 5 signers). Holds 400.6M IFR. Transferred from Deployer 18.03.2026.
Why Multisig?
A single private key controlling a protocol is a single point of failure. If that key is lost, stolen, or compromised, the entire protocol is at risk. A multisig wallet requires multiple independent signers to approve any transaction, eliminating this risk.
- No single point of failure — no one person can unilaterally change the protocol
- Key loss protection — losing one key does not lock the treasury
- Compromise resilience — an attacker needs multiple keys, not just one
- Transparent — all multisig transactions are on-chain and publicly visible
Threshold Policy
The multisig threshold increases as the protocol matures. More signers = more decentralization = more security.
Threshold Roadmap
| Phase | Threshold | Date | Status |
|---|---|---|---|
| Genesis | 1-of-2 | Feb 2026 | ✅ Completed |
| Phase 2a | 1-of-3 | Mar 2026 | ✅ Completed |
| Phase 2b | 2-of-4 | 14 Mar 2026 | ✅ Completed |
| Phase 2c | 2-of-5 | 15 Mar 2026 | ✅ Completed |
| Phase 2d | 3-of-5 | 15 Mar 2026 | ✅ Active now |
| Community Expansion 1 | 4-of-7 | After community voting is live | Planned |
| Community Expansion 2 | 5-of-9 | After one stable community-signer term | Optional later |
Current Signers
| # | ID | Address | Safe | Status |
|---|---|---|---|---|
| 1 | G.M. | 0x6b36687b0cd4386fb14cf565b67d7862110fed67 | Treasury + Community + LP Reserve | ✅ Active |
| 2 | M.G. | 0x17F8DD6dECCb3ff5d95691982B85A87d7d9872d4 | Treasury + Community + LP Reserve | ✅ Active |
| 3 | A.M. | 0x0c4893DcF730E0Ddc7D18CF9723932784Fb4ED74 | Treasury + Community + LP Reserve | ✅ Active |
| 4 | Y.K. | 0xA0860f872a9cAB34817D9a764e71ab43B942b275 | Treasury + Community + LP Reserve | ✅ Active |
| 5 | A.P. | 0x32cF8b4F29A8F211804857EcF8BF0847f0BC0fE9 | Treasury + Community + LP Reserve | ✅ Active |
Phase 3: DAO Transition Planned
4-of-7 → 5-of-9 — staged community signer expansion before full DAO governance transition. The recommended model is mixed selection: eligibility filter, public nomination, community vote, security review, term limits, and emergency replacement rules. Read the full signer expansion plan.
What Signers Can Do
| Action | Mechanism |
|---|---|
| Submit governance proposals | Via Governance contract (propose()) |
| Execute proposals after 48h | Via Governance contract (execute()) |
| Cancel malicious proposals | Guardian role (cancel()) |
| Rotate the Governance guardian | TreasurySafe, as Governance owner, can call untimelocked setGuardian(). Since the guardian migration (completed 5 October 2026, CWA-09) the IFRLock, Vesting, PartnerVault, LiquidityReserve and BurnReserve guardians are the TreasurySafe as well; only the immutable BuybackVault and BuybackController guardian stays the Deployer EOA (pause only). |
| Transfer Governance admin | Only the current owner, the TreasurySafe (3-of-5), can transfer it. On the deployed Governance contract setOwner() is owner-callable and therefore not behind the 48-hour delay (tracked as CWA-25). |
What Signers Cannot Do
| Restriction | Reason |
|---|---|
| Directly access token supply | No mint function exists. Supply can only decrease. |
| Bypass the current proposal delay | Proposal execution cannot bypass the current delay. setDelay must execute through Governance itself and is bounded from 1 hour to 30 days. |
| Change fee above 5% | Hard cap enforced in InfernoToken contract. |
| Move locked user tokens | IFRLock only allows the original depositor to withdraw. |
| Execute protocol proposals instantly | No. Proposals use the 48-hour delay. The untimelocked exceptions are owner-only guardian rotation through setGuardian and transferring the deployed Governance contract’s ownership through owner-only setOwner (tracked as CWA-25). |
Who Can Become a Signer?
Signer selection is transparent and community-driven. Candidates are evaluated based on:
- Technical competence — ability to verify and understand governance proposals
- Independence — no two signers should share organizational affiliations
- Track record — verifiable on-chain history and community presence
- Hardware wallet — all signers must use hardware wallets (Ledger/Trezor)
Signer additions and removals are on-chain transactions visible to everyone. The community can verify the current signer set at any time via the Gnosis Safe interface.
Future community seats: after community voting is live, Inferno plans to add community-elected signers through a security-filtered process. Large IFR holders or locked IFR holders can be positive signals, but signer selection should not be pure whale voting. Random selection can only be used inside a pre-qualified candidate pool. See Community Signer Expansion.
On-Chain Verification
| Contract | Role | Controlled By |
|---|---|---|
| InfernoToken | owner() |
Governance (timelock) |
| LiquidityReserve | owner() |
Governance (timelock) |
| BuybackVault | owner() |
Governance (timelock) |
| BurnReserve | owner() |
Governance (timelock) |
| Governance | admin() |
Treasury Safe 3-of-5 (transferred 20.03.2026 — TX) |
| PartnerVault | admin() |
Governance (current admin; transferable through setAdmin) |
| IFRLock | guardian() |
TreasurySafe (pause-only; since 3 October 2026) |
| Vesting | guardian() |
TreasurySafe (pause/unpause; moved through transferGuardian on 3 October 2026) |
| FeeRouterV1 | governance() |
Governance (immutable) |
Project Continuity
Inferno Protocol is designed to outlive any single contributor, company, or team. The protocol is permanently decentralized infrastructure:
- Open source — all code lives on GitHub. Anyone can fork, audit, or continue development.
- Verified on-chain — all 15 deployed contracts are published on Etherscan. The bytecode is public and immutable.
- Governance protects — proposals use the 48-hour timelock. The untimelocked exceptions are owner-only guardian rotation through
setGuardianand transferring the deployed Governance contract’s ownership through owner-onlysetOwner(tracked as CWA-25). - Multisig prevents failure — no single key loss can freeze the protocol. Threshold increases over time.
- Community can continue — if the original team disappears, anyone with the contracts, ABI, and governance access can operate the protocol.
- No off-chain dependencies — the core protocol (token, lock, governance, fees) runs entirely on Ethereum. No servers required.
Inferno Protocol is fully open source and community-owned. No single entity controls the protocol. All contracts are verified on Ethereum Mainnet and protected by Gnosis Safe multisig. Protocol parameter changes go through Governance proposals with a 48-hour timelock. The deployed Governance contract’s ownership itself can be transferred directly by its owner, the Treasury Safe (3-of-5), without that delay (tracked as CWA-25). The protocol lives on-chain — permanently.