safuSECURITY
Security
Pending work should survive the service.
Safu’s security work is in making proposals available, linking approvals to the right payload, and letting independent clients reconstruct pending work.
What the coordination layer must preserveEarly-stage project. No security audit completed.
SafeAlready enforces owners, threshold, and execution rules.
COORDINATION INTEGRITY
Preserve what another client needs.
Safe already supports signatures and onchain hash approvals. Safu targets the missing coordination record: the full pending proposal, discoverable approvals, and enough information to rebuild the queue.
Readable records still need verification. A client must check the payload and current account state rather than trust an index or summary.
Complete data
A client must recover the full payload, not just a hash or summary.
- Full transaction
- Exact Safe hash
Valid approvals
An approval record must refer to the exact proposal and a valid owner.
- Signer provenance
- Proposal binding
Independent reads
An index can help with discovery. It should not be the only copy of pending work.
- Chain records
- Rebuilt queue
Public intent
Publishing a proposal reveals its contents before execution.
- Visible calldata
- Pending actions
INDEPENDENT RECONSTRUCTION
Rebuild from shared records.
- 01
Find the records
Discover the Safe’s proposal and approval records without relying on the original service.
- 02
Recover the payload
Reconstruct every signed field and check that the complete transaction matches its Safe hash.
- 03
Check against the Safe
Read current owners, threshold, and nonce from the contract. Reconcile consumed proposals and validate each approval before presenting pending work.
PLANNED COORDINATION
Public before execution
Publishing complete proposals makes pending intent visible, including destinations, values, and calldata. This changes availability and privacy, so it must be an explicit choice.
A hash alone does not provide the transaction contents. The design must make the full payload recoverable and define how clients discover and interpret approval records.
Onchain publication and independent reconstruction are part of the design. Publishing a proposal does not authorize its execution.
Passkeys and recovery
Device-based approval changes how owners sign. Enrollment, lost devices, and the loss of Safu’s website all need to be accounted for.
Device-based approval and independent recovery remain design goals.
Owner enrollment
Verify which device can approve and how it affects the account’s threshold.
Independent recovery owners
Keep a recovery route when an original signing device is lost or unavailable.
Recovery without the website
Exercise recovery with Safu’s domain unavailable, using an independent client.
VERIFICATION
Prove independence.
The coordination design needs to work with the original service unavailable: another client must recover the complete pending proposals and verify their approvals. Device signing and recovery need their own acceptance tests.