Private Multisig

How to enable shared control without making balances public

‍

Paying a contractor, replacing an administrative key or pausing a bridge don’t all carry the same risk. The approval rules should reflect that.

Miden's private multisig lets teams choose how many signatures each action requires and which signature schemes to use. And most importantly, privacy adds protection: outsiders have no information about the funds, signers and contract controls they could target.

How we use it at Miden

We’re dogfooding our own product at Miden: our team uses the private multisig to manage the Miden-side contracts for our bridges, such as Circle’s CCTP bridge used for USDCx.

Changing a USDCx attester key requires more signatures than adjusting the minimum withdrawal amount. Pausing the bridge requires just one signer so someone can act quickly in an emergency. Unpausing can require broader agreement.

Teams can also choose which signature schemes an action requires, including post-quantum Falcon.

If an action requires signatures from two independent schemes, exploiting a flaw in one still leaves the attacker needing valid signatures from the other.

A familiar way to approve payments

With a public multisig, anyone can look up the treasury’s balance. On Miden, a team could keep most of its reserves in a private treasury multisig and move smaller amounts into an account for contractor payments or similar, without making its full reserve balance public. 

The approval flow is familiar to anyone who has used traditional non-private multisigs like Safe: one signer proposes a transaction, others approve it, and it can be executed once the required signatures are collected.

Guardian keeps signers “up-to-state”

Because the account state isn’t publicly visible, signers need a way to stay in sync. Guardian is that extra layer that coordinates updates so co-signers can all work from the latest state.

Teams can run their own Guardian or use an instance from an operator already supporting Miden on partner mainnet, such as LambdaClass, Gateway, Para or KODA. In either case, the Guardian cannot move funds on its own.

You can try the multisig at multisig.miden.xyz – it’s a fully functional implementation. If your team wants to know more about private treasury management or needs custom approval rules for a bridge or protocol, talk to us at bd@miden.team.