Ledger Support Added to Our Ethereum Multisig Smart Contract
We are excited to release a new version of our Ethereum multisig smart contract. This release adds support for Ledger hardware wallets and was re-audited by the security firm Hosho.
After the Parity hacks of 2017, we were extremely suspicious of complicated, unaudited, unmaintained multisig smart contracts. We needed a smart contract designed for simplicity, security, and native-interoperability with the hardware wallets we use to protect funds in our business.
We decided to write our own Solidity contract to implement 2-of-3 multisig against hardware wallets. In Spring 2018 we released and open sourced this contract alongside a dapp (see our prior blog post). To date, our open-source Ethereum multisig smart contract has gone through both a private audit (by Hosho) and a public bug bounty, and is in active use to protect millions of dollars worth of ETH. Hosho audited both versions of our Ethereum multisig smart contracts and found zero vulnerabilities. As Hosho stated in their blog post after the v1 audit, ”For the first time since Hosho was founded, Unchained Capital provided us with a codebase that was given a clean audit report with 0 vulnerabilities found.”
If you have two friends and a few Trezors/Ledgers among you, you can use a hosted copy of the dapp to try out our smart contract right now.
If you’re a developer, please check out the GitHub repo for more details on how you can use our code in your own projects.
Technical Details
Our multisig smart contract is written to support the signing semantics of hardware wallets directly, making it easy to connect users’ hardware wallets to the blockchain in any application (such as the included dapp). When we first released our contract, the two different hardware wallet manufacturers we wanted to support, Ledger and Trezor, unfortunately had different Ethereum signing semantics. We shipped v1 of our contract with only Trezor support, planning to add Ledger support via a new signing pathway in a future version.
As of firmware version v1.6.2, Trezor hardware wallets switched to using the same signing semantics as other ethereum wallets. Version 2 of our contract uses these new semantics, making it compatible with both Trezors and Ledgers. You can even build a quorum combining Trezors and Ledgers together.
