Repository navigation
Multisig creation allows a multisig account as a signer, creating an unexecutable multisig #708
Description
Reported publicly on X (Oct 11-12): a user created a 3-of-3 multisig with another multisig as one of the signers. The app allowed it without warning. Because votes in this design are ML-DSA signatures and a multisig account holds no private key, that signer can never approve, so the multisig cannot execute. The user who hit this got out on Oct 12, but only through hand-run CLI steps.
I checked the org's open issues before filing; this does not appear to be tracked yet.
Two parts: (1) creation-time guard, still missing: detect when an added signer address is itself a multisig account and block or warn explicitly. (2) Recovery: the Oct 12 recovery was manual CLI work; a supported path or a documented procedure would close it.
Happy to take either part.
Activity
exocognosis commentedon Oct 20, 2026
Update from the original X thread: the user did recover the 50 QTC via CLI on Oct 12, with manual steps. So part (2) is less "recovery is impossible" and more "recovery currently means hand-run CLI commands"; a supported path or a documented procedure would close it. Part (1), the creation-time guard, stands as filed.
[-]Multisig creation allows a multisig account as a signer, creating an unexecutable multisig (funds locked)[/-][+]Multisig creation allows a multisig account as a signer, creating an unexecutable multisig[/+]exocognosis commentedon Oct 20, 2026
Both halves of this now have code behind them:
Creation guard: #715 warns before a multisig account is added as a multisig signer.
Recovery: Quantus-Network/quantus-cli#189 adds multisig propose/approve, so a multisig that signs another multisig can cast its vote through its own members.
Happy to adjust either one to how the team wants it shaped.
Warn before adding a multisig account as a multisig signer