Protecting a DAO or company treasury
Signers, thresholds, timelocks, monitoring and incident plans: the controls that stop one mistake or one compromise from emptying a treasury.
Updated 14 Sept 2026 · Advanced · 2 min read
In short
- Many of the largest losses start with compromised keys or an approved malicious transaction rather than a smart-contract bug.
- Spread signing power across independent people and devices, and put delays on powerful actions.
- Watch everything continuously, and rehearse what you will do when something looks wrong.
Know where the power sits
Start with an inventory: every wallet, Safe and contract the treasury depends on, and for each one, who can move funds, upgrade code, pause, mint or change permissions. Our contract admin inspector reads proxy admins, owners and Safe configurations straight from the chain. Anything controlled by a single key is a single point of failure.
Multisig, done properly
- Threshold: high enough that no one person or small group can act alone, low enough that the treasury still works when someone is away. 3-of-5 and 4-of-7 are common.
- Independence: signers should be different people, on different devices, ideally in different places, each using a hardware wallet.
- Hygiene: remove signers who leave, promptly; review the owner list regularly; make sure no person controls two owner keys.
- Verification: every signer checks what they sign, independently. See verifying a Safe transaction.
Put delays on powerful actions
A timelock makes changes wait (for example 48 hours between an upgrade being scheduled and executed) so the team and users have time to notice and respond to a malicious or mistaken change. Use it for contract upgrades, parameter changes and permission grants, and keep a separate, smaller operational wallet for day-to-day payments so the delay does not get in the way.
Separate hot and cold
Keep most funds in cold storage or a high-threshold Safe, and only what operations need in a hot wallet with a lower threshold, refilled on a schedule. Exposure to any single custodian, stablecoin issuer or protocol is a risk too; decide deliberately how much to hold where.
Watch it continuously
Controls fail silently unless someone is watching. Wardcrest monitoring alerts your team when a Safe’s owners, threshold, modules or guard change; when a proxy is upgraded or ownership moves; when a pending Safe transaction contains a risky operation, before it executes; and when balances cross your thresholds. Alerts go to email, Slack, Discord, Telegram, PagerDuty or a signed webhook.
Plan the bad day
- Decide in advance who can pause what, and how to reach every signer within minutes.
- Keep an up-to-date list of the addresses and contracts involved, with their explorer links and admin functions.
- Agree how and when you will tell users what is happening.
- After an incident, write down what happened and change a control, not just a key.