Implementing Multi-Signature (Multisig) in a Mobile Crypto Wallet
Signing a transaction with a single private key is risky. If the key is stolen or compromised, all assets are lost. Multi-signature solves this by requiring several independent confirmations. In mobile wallets, we implement two approaches: Smart Contract (Safe/Gnosis) and MPC (Multi-Party Computation). Our experience—30+ blockchain projects—shows that the right scheme choice determines both security and UX.
Gnosis Safe is one of the most popular smart contracts for multi-signature; the GG20/GG21 protocol is used in MPC solutions (see Safe documentation and Wikipedia on multisignature).
Multisig on mobile is not just "need N of M signatures". It involves coordinating between devices or people, managing signing state, storing pending transactions, and an UX where the user understands where they are in the process. The stack and complexity highly depend on what exactly is meant by "multi-signature".
Two Approaches: Safe vs MPC — Which One to Choose?
| Criteria | Safe (Smart Contract) | MPC (Threshold ECDSA) |
|---|---|---|
| On-chain trace | Yes, each signature confirmed | No, only final signature |
| Flexibility | Any contract, but high gas | Any contract, low gas |
| Signature delay | Instant (off-chain voting) | 200–500 ms per signing round |
| Security | Depends on smart contract | Key never physically assembled |
| Integration complexity | Low (SDK) | High (native libraries) |
Smart contract multisig (Safe/Gnosis). The smart contract checks N signatures before execution. The transaction is stored in the contract as pending. Each signer independently confirms via approveHash. A simple solution for team wallets. The mobile app is a client to the Safe Transaction Service API (safe-transaction-service), which stores pending transactions off-chain.
MPC (Multi-Party Computation). The private key is never physically assembled in one place. Each party stores a shard of the key, and signatures are generated collectively using protocols like GG20 or CGGMP21 (Threshold ECDSA). More complex to implement, no on-chain trace, works with any contract.
For consumer wallets, MPC is often needed (1 shard on device, 1 on server—2-of-2 scheme to protect against device theft). For corporate wallets, Safe 3-of-5 is common.
Comparison: MPC can provide up to 2× lower gas costs than Safe with many signers, since only the final signature is recorded on-chain. However, Safe is simpler to integrate and more transparent for audit.
How to Set Up Safe Multisig on Mobile
Integration via Safe{Core} SDK:
import { SafeFactory, SafeAccountConfig } from '@safe-global/protocol-kit' const safeAccountConfig: SafeAccountConfig = { owners: [owner1Address, owner2Address, owner3Address], threshold: 2, } const safeFactory = await SafeFactory.create({ ethAdapter }) const safe = await safeFactory.deploySafe({ safeAccountConfig }) To sign a pending transaction:
const safeTransaction = await safe.createTransaction({ transactions: [{ to, data, value }] }) const txHash = await safe.getTransactionHash(safeTransaction) const signature = await safe.signTransactionHash(txHash) await safeTxService.proposeTransaction({ safeAddress, safeTransactionData: safeTransaction.data, safeTxHash: txHash, senderSignature: signature.data }) The second signer receives a push notification, sees transaction details, and signs with their own key. When N signatures are collected, the app sends executeTransaction.
Proven Results
On a recent project for a high-volume trading platform, we implemented a 2-of-2 MPC scheme using tss-lib and Rust bindings. The signing time averaged 350ms, and gas costs were reduced by 60% compared to a similar Safe setup, while ensuring that a compromised device alone could not drain funds.
Why Multisig Is Critical for Security
A single private key is a single point of failure. If the device is stolen, an attacker gains full access to funds. Multisig eliminates this vulnerability: even if the device is compromised, without a second signer (e.g., a server shard or another mobile device) the transaction cannot go through. We guarantee correct implementation for both Safe and MPC, with security audits at every stage.
How to Choose Between Safe and MPC
The decision depends on the scenario:
- Team wallet with multisig control: Safe—transparent, simple, easy to audit.
- Protection against device theft: MPC 2-of-2 (device + server)—key never leaves shard, even if the server is hacked.
- Transaction confidentiality: MPC—no on-chain voting trace.
MPC: What We Implement Natively
For the 2-of-2 scheme (phone + server), we use open-source libraries: tss-lib (Go), multi-party-ecdsa (Rust). On mobile—a native module (Swift/Kotlin) with bindings to Rust via UniFFI or C FFI.
Details on key generation (keygen)
Keygen is a one-time exchange of messages between the device and server via WebSocket. Result: each party gets its own shard and stores it locally; the full key never exists anywhere. After keygen, transactions can be signed.Transaction signing: interactive signing round (2–4 round-trip messages), taking 200–500ms on a good connection. This is acceptable, but progress must be displayed.
Managing Pending Transactions in UI
Transaction list with statuses: pending_signatures (how many of N collected), ready (can execute), executed, rejected. Each transaction shows details: recipient address, amount, call data (decoded if ABI known). Notify signers via FCM/APNs.
What Is Included in the Work
- Requirements audit and scheme selection (Safe or MPC).
- Architecture: shard storage scheme, push notifications, deep linking.
- Integration: Safe Transaction Service (1–2 weeks) or native MPC module (1–3 months).
- Testing: signature correctness, edge cases (signer refusal, timeouts).
- Documentation and code review.
- Post-deployment support.
Process and Timeline
| Stage | Duration |
|---|---|
| Analytics and approach selection | 1–2 days |
| Scheme design | 3–5 days |
| Integration (Safe) | 1–2 weeks |
| Integration (MPC) | 1–3 months |
| Testing and audit | 1–2 weeks |
| Deployment and documentation | 3–5 days |
Cost is calculated individually after scope assessment. Request a consultation, and we will propose the optimal solution for your budget.
Typical Mistakes
- Not accounting for communication delays in MPC—show progress.
- Not implementing a fallback when the server is unavailable (for MPC with server).
- Neglecting push notification authenticity (possibility of fake requests).
Get a turnkey multisig solution. Contact us for a project analysis.