https://github.com/Trust-Machines/multisafe/blob/e5a3768e9cdbd65979bf076f4d88f8eb53f9b21f/contracts/safe.clar#L124-L130

There should be one more asserts! that ensures value is less than or equal 20.

Thinking this is more of an issue with Stacks API issue for testnet and that metadata is disabled on it, but logging here anyway as well since the presence of it makes it significantly more difficult to test the MultiSafe with various assets (since you can't differentiate them in the UI).

When we change min-confirmations from X to Y it affects both on going and future transactions. I think that each transaction should have its own fixed min-confirmation threshold that is set up when transaction is created.

It is not a bug per-se, but securing crucial functions with just tx-sender can be considered as security flaw.

Depending on your security strategy and approach I would suggest securing those functions with contract-caller or add 1uSTX transfer to crucial functions in order to enforce the need to construct TX with post-conditions.

Reference: https://github.com/LNow/clarity-notes/blob/main/security/function-calls.md

Adding 'get-owners' or 'get-info' function to safe-trait would allow on-chain verification of safe owner from other clarity contracts.

e.g. In LEOS project, this will help verify if a user have created multi-safe contract, is in the list of owners of that contract or not.

Made some changes in the test file; all tests do not pass yet ; some of them return different values than expected and some others have a runtime error; i plan to look into these tests next; 7 tests pass although for one of them i had to change the return values expected

I deployed my first safe to mainnet and deposited 5 STX but it doesn't appear in the UI:

• Safe deployment: https://explorer.stacks.co/txid/0x1bd774bf557059fef27b76e6f52fd9dfbc9967533a6951657b23dcc7289d670d?chain=mainnet
• Deposit: https://explorer.stacks.co/txid/0xc86b7ed4b01afc54edfb6b76f393147e650a357ad016ab005975ae0b1575ff6f?chain=mainnet

@talhasch

Hello, we just observed there is no License file in this repository -- we're interested in developing on top of MultiSafe and extending it via code contributions here but can't do so if there is no license defined since the opaqueness of not having one creates an undefined state of what is permissible use of this code.

Cc: @muneeb-ali

Does this initiative exist? Might be worth considering adding to this repo (or its own separate repo if that is preferred).

This will enable people to contribute to improving the UI, UX, etc. Speaking for myself, I noted some issues + opportunities and would be interested.

Example issue:

On the Transactions page, when loaded by for review an owner that was not the transaction originator, there is no REVOKE button. So hypothetically speaking, let's say one of the owner accounts was compromised and an unauthorized transaction was made by it. There is no revoke button for the other owners.

It's better to use SP3FBR2AGK5H9QBDH3EEN6DF8EK8JY7RX8QJ5SVTE.send-many-memo contract to make STX transfers instead of using stx-transfer function since using memo with transfers something mandatory while transferring money to centralized exchanges.

If safe have multiple owners, then one transaction can be executed more than once.

# switch to one of the owners
::set_tx_sender ST1SJ3DTE5DN7X54YDH5D64R3BCB6A2AG2ZQ8YPD5
# create new "transaction"
(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe submit 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.set-min-confirmation 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe .tx-sender u3)

# change to 2nd owner
::set_tx_sender ST2CY5V39NHDPWSXMW9QDT3HC3GD6Q6XX4CFRK9AG
# confirm transaction => 1st execution
(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe confirm u0 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.set-min-confirmation 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe)

# change to 3rd owner
::set_tx_sender ST2JHG361ZXG51QTKY2NQCVBPPRRE2KZB1HR05NNC
# confirm transaction => 2nd execution
(contract-call? 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe confirm u0 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.set-min-confirmation 'ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM.safe)

Add here: https://github.com/Trust-Machines/multisafe/blob/e5a3768e9cdbd65979bf076f4d88f8eb53f9b21f/contracts/safe.clar#L237-L244 one extra assert:

(asserts! (not (get confirmed tx)) ERR-TX-CONFIRMED)

On the Transactions page, when loaded by for review an owner that was not the transaction originator, there is no REVOKE button. So hypothetically speaking, let's say one of the owner accounts was compromised and an unauthorized transaction was made by it. There is no revoke button for the other owners.