Multisig

In HypeSafe, a multisig account is controlled by a group of owners and a threshold.

Owners are the addresses authorized to approve actions. The threshold is the minimum number of owner approvals required before an action can be executed on Hyperliquid.

For example, a team may configure four owners and require two approvals before a treasury withdrawal can be submitted. Each owner reviews the same proposal and signs the same payload. HypeSafe verifies the signatures, tracks progress, and shows when the task is ready for execution.

Owners

Owners are responsible for reviewing intent and authorizing execution. An owner can approve from a browser wallet or from a self-hosted safe-node controlled by that signer.

HypeSafe only counts a signature if the recovered address is an authorized owner for the multisig account. Unknown signers do not contribute to the threshold.

Threshold

The threshold defines how many owners must approve a task before it becomes executable.

Common configurations include:

• 1/N: one owner can execute. This is convenient, but it does not provide shared control.
• N/N: every owner must approve. This is strict, but it can block execution when a signer is unavailable.
• M/N: a subset of owners must approve. This is the common setup for teams that want shared responsibility with operational flexibility.

Signing tasks

HypeSafe represents an account action as a signing task. A task fixes:

• the multisig account;
• the leader who can execute after approvals are collected;
• the template and user inputs;
• the nonce and network context;
• the exact typed payload every owner approves.

Changing the leader, inputs, or nonce means creating a new task, because the signed payload has changed.

Approvals

Approvals can come from browser wallets or from a self-hosted node. In both cases, the gateway recovers the signer address from the signature and only counts it if the signer is authorized for that multisig account.

The gateway's approval count is an execution readiness signal. Hyperliquid still validates the final multisig action when it is submitted.

Execution

When the threshold is met, the selected leader submits the final multisig action to Hyperliquid. The leader can be a human using the frontend or a safe-node instance running with the leader key and a local policy that allows the task.

Benefits

• Reduced single-key risk: no single signer has to carry all operational authority.
• Clear accountability: every proposal records who approved, rejected, or executed.
• Flexible governance: teams can choose a threshold that matches their operating model.
• Programmable workflow: safe-node can apply local policy before automated signing or execution.
• Non-custodial operation: HypeSafe coordinates the workflow without taking custody of keys or assets.