Multisig

Use AirWallet's offline device as one signer of a Bitcoin multisig, a Safe on Ethereum or a Squads multisig on Solana.

A multisig needs several keys to approve a payment. AirWallet's offline device can hold one of those keys, for three kinds of multisig:

AirWallet doesn't create or run the multisig itself. The other app does that, and sends each transaction to the offline device for its signature by QR code.

Only the offline device signs for a multisig: the connection codes are under Receive → Use with another app…, which only the offline device has, and only for recovery-phrase wallets (a single Solana key can join a Squads multisig too).

#Bitcoin: one cosigner of a multisig

#Set it up

1. On the offline device, open the wallet, select Receive, then Use with another app….
2. On the Bitcoin apps tab, select For a multisig: its key. The code shows this wallet's cosigner key (a P2WSH key at the standard multisig path, BIP48). It's only a public key. Copy as text gives the same key as text.
3. Add it to the multisig in your app:
   • Sparrow: in the multisig wallet's settings, pick a keystore → Airgapped Hardware Wallet → Scan.
   • Nunchuk or BlueWallet: add a key by QR.

#Sign

1. The app makes a transaction and shows it as a QR code (a PSBT).
2. On the offline device, open Scan to sign and scan it.
3. Check the review: it names the multisig ("2 of 3", for example) and its keys by fingerprint, then each payment, the change and the fee. Then select Sign.
4. Scan the offline device's answer with the app. It collects the other signatures and sends the transaction.

#What the offline device checks

The offline device signs a coin only when:

• the coin's script really is an m-of-n multisig, with distinct keys
• it contains this wallet's key, at the path the PSBT gives
• all coins in the transaction belong to the same multisig

When the PSBT carries the multisig's account keys (xpubs), as Sparrow's does, every key must come from them, and this wallet's own must be among them. The device then recognizes the change and shows it as change. Without them, it still signs, but shows every output as a payment and warns you: check in the app that the extra outputs are your multisig's change.

Apps don't always include the earlier transactions the coins came from, so the fee shown is the app's claim. AirWallet remembers each coin it signs and the amount claimed for it, and refuses a later request that claims a different amount for the same coin.

Not supported: legacy (P2SH) and nested (P2SH-P2WSH) multisig, Taproot multisig, and AirWallet's online copy as the multisig's coordinator.

#Ethereum: one owner of a Safe

#Set it up

1. On the offline device, open the wallet, select Receive, then Use with another app….
2. On the MetaMask tab, connect the wallet to MetaMask or Rabby as a QR hardware wallet (the tab shows the steps for each).
3. Make that account an owner of your Safe.

Safe{Wallet}, Rabby's Safe support, Den and other apps built on Safe's contracts then send the Safe's transactions to MetaMask or Rabby, which pass them to the offline device by QR code.

#What the review shows

The offline device reads the Safe transaction from the exact fields it signs, and shows:

• payments, and token transfers (a token that isn't on your list is shown in raw units, with a warning)
• changes to the Safe itself: owners, threshold, modules, guards, the fallback handler
• a batch (MultiSend) of those, as numbered lines
• the Safe transaction hash, to compare with the one Safe{Wallet} shows

It also says what your signature does: "This signs it as one owner of the Safe: it goes through once enough owners have signed and someone executes it." If you're the owner who executes it, the review says so instead.

#What it asks about, and what it refuses

It asks once more before signing anything that gives a contract power over your Safe: enabling a module, setting a guard or fallback handler, or replacing the Safe's code. Sign only if every owner agreed on that exact address.

It refuses:

• running another contract's code inside your Safe (a delegatecall), except Safe's own official batch contracts. This is how the Bybit theft worked.
• a delegatecall inside a batch
• paying whoever executes it a refund out of the Safe
• approvals and other contract calls it can't show
• Safe messages (logins, orders, permits)
• tokens on networks it doesn't know, and a request whose network doesn't match its Safe transaction

#Solana: one member of a Squads multisig

#Set it up

1. On the offline device, open the wallet, select Receive, then Use with another app….
2. On the Solflare tab, connect the wallet to Solflare or Backpack as a Keystone (the tab shows the steps), and pick the account.
3. Add that account as a member of your Squads multisig, and use the Squads app through Solflare or Backpack.

#What the review shows

When you create a proposal in the Squads app (a payment from the multisig's vault, for example), the offline device reviews the payment inside it by the same rules as any Solana send from your own wallet, with the vault as the sender. What those rules refuse, it refuses.

Changes to the multisig itself (adding or removing a member and their permissions, the threshold, the time lock) are shown, with a warning to check each change with the other members.

#Approving a proposal someone else made

This is the one place AirWallet can't show you everything. When you approve or execute a proposal another member made, what it does is stored on the blockchain, not in the code you scan, and the offline device can't read the blockchain.

So the review names the proposal's number, warns you, and asks once more: approve it only if you've checked that proposal in the Squads app, on another device if you can. Rejecting or cancelling a proposal doesn't need the second question, because nothing moves. The Help & FAQ answer "What won't the signer sign?" says the same.

#What it refuses

Batches, buffers, spending limits (setting them up or using them), changing the rent collector, creating a multisig, and transactions that also need another wallet's signature, use lookup tables or vote on a second proposal.

#Other chains

AirWallet has no multisig for Monero (it needs several online rounds between all the signers) or Zcash (its multisig isn't in Zodl yet).

For everything the offline device checks on single-key payments, see What the signer checks.