Governance Facilitator Multisigs

Governance facilitator multisigs are multisignature wallets that enable designated governance participants within Sky Protocol to execute operational functions—such as distributing compensation, adjusting bounded protocol parameters, and triggering emergency security actions—without requiring a full executive vote for each individual action. These wallets implement threshold signing schemes (for example, requiring 2-of-3 or 3-of-5 signers to approve a transaction) to prevent any single individual from unilaterally controlling protocol funds or parameters.

As of February 2026, the Sky ecosystem maintains over two dozen distinct multisig wallets spanning core governance operations, BEAM parameter adjustments, emergency security freezes, and Star Agent liquidity layer management. Each multisig is documented in the Sky Atlas with its on-chain address, signing threshold, and signer composition, creating a verifiable chain of accountability that community members can audit directly on-chain ^{[1] [2]}.

The multisig framework evolved from MakerDAO's earlier core unit wallet system, which was formalized under MIP47 (MakerDAO Multisignature Wallet Management) ^[9]. That governance proposal established the principle that all multisig wallets holding protocol funds must be disclosed to governance, considered owned by Maker Governance, and subject to community oversight. The current Sky Protocol multisig architecture builds on this foundation while introducing more granular role separation between Core Facilitators, Core GovOps, Ecosystem Actors, and specialized operational agents.

Multisig Framework and Standards

Sky Protocol uses Gnosis Safe (now rebranded as Safe) as the standard multisig implementation across the ecosystem ^[9]. Safe is an industry-standard smart contract wallet that supports flexible multi-signature schemes, allowing governance to configure any M-of-N threshold. This standardization provides several advantages: consistent security properties across all operational wallets, well-audited contract code, compatibility with existing blockchain tooling, and transparent on-chain verification of all transactions and signer compositions.

The governance framework distinguishes between several categories of multisig wallets based on their operational scope and the authority they exercise. Each category serves a distinct function within the protocol's operational hierarchy, and the signing threshold and signer composition are calibrated to balance operational efficiency with security requirements. The Sky Atlas codifies the exact parameters for each multisig, meaning any changes to addresses, thresholds, or signers must pass through the formal governance process ^[1].

Multisig Categories

The Sky ecosystem organizes its multisig wallets into four primary categories based on function:

• Treasury Multisigs — Manage protocol fund disbursements for compensation, budgets, and operational expenses. These include the Core Council Buffer and Aligned Delegates Buffer multisigs, which hold funds allocated by executive votes and distribute them according to Atlas-defined rules ^{[1] [2]}.
• BEAM Operator Multisigs — Control bounded parameter adjustments for protocol stability mechanisms. Operators can only modify parameters within governance-set bounds (minimum, maximum, step size, and cooldown periods), preventing unauthorized changes to core protocol economics ^{[6] [7]}.
• Emergency and Security Multisigs — Enable rapid response to security threats by pausing or freezing affected protocol components without waiting for the standard Governance Security Module delay. These multisigs trade decentralization for speed in crisis scenarios ^{[3] [5]}.
• Star Agent Liquidity Layer Multisigs — Manage cross-chain capital allocation operations for each Star Agent (Spark, Grove, Keel, OBEX). Each Star has a standardized three-multisig structure: Prime Relayer, Core Operator Relayer, and Freezer ^{[11] [14] [17] [22]}.

Signer Roles

The primary signer roles across Sky Protocol multisigs are:

• Core Facilitator — The primary governance enforcer responsible for Aligned Delegate management, compensation calculations, and operational compliance. Controls signer slots on treasury and bridge security multisigs ^{[1] [2]}.
• Core GovOps — The operational governance team that shares signing authority with the Core Facilitator on treasury multisigs and manages Core Operator Relayer functions across multiple Star Agents ^{[1] [15]}.
• Operational GovOps Amatsu — A specialized operational entity that serves as Core Operator Relayer signer for Grove and Keel liquidity layer multisigs ^{[15] [18]}.
• Core Executor Agent Atlas Axis — Controls the BEAM operator multisigs that adjust protocol stability parameters within bounded ranges ^{[6] [7]}.
• Ecosystem Actors — External entities such as Phoenix Labs (Spark) and Star-specific teams that hold signer slots on their respective liquidity layer multisigs ^{[11] [12]}.

Core Governance Multisigs

The core governance multisigs manage the most sensitive operational funds within Sky Protocol—the budgets that fund Aligned Delegates, governance facilitators, and core operations. Both treasury multisigs share an identical signer structure that distributes control between the Core Facilitator and Core GovOps, ensuring no single governance role can unilaterally access protocol funds.

Core Council Buffer Multisig

The Core Council Buffer serves as the primary operational treasury for Sky's core governance infrastructure. Executive votes allocate funds from the protocol surplus to this multisig, which then disburses them according to Atlas-defined budgets and schedules.

The 3-of-4 threshold means that at minimum one signer from each role (Core Facilitator and Core GovOps) must approve any transaction, plus one additional signer from either role ^[1]. This design prevents either the Core Facilitator or Core GovOps from acting alone while still allowing transactions to proceed if one signer from either side is unavailable.

Aligned Delegates Buffer Multisig

The Aligned Delegates Buffer holds funds earmarked for monthly compensation payments to recognized Aligned Delegates. The Core Facilitator calculates compensation amounts based on delegate participation rates and rankings, then initiates payouts through this multisig.

The signer structure mirrors the Core Council Buffer, maintaining the same cross-role approval requirement ^[2]. Monthly compensation distributions follow the Atlas-defined schedule, with Ranked Delegates receiving annual allocations of 400,000 USDS (Level 1), 175,000 USDS (Level 2), or 48,000 USDS (Level 3), paid in monthly installments contingent on meeting the 95% governance voting participation threshold.

BEAM Operator Multisigs

BEAM (Bounded External Access Module) operator multisigs enable designated agents to adjust specific protocol parameters within governance-defined bounds without requiring an executive vote for each change. This mechanism provides operational agility for time-sensitive stability adjustments while constraining the maximum possible impact of any single parameter change. The BEAM Payload Safety framework establishes strict bounded ranges—including minimum values, maximum values, step sizes, and cooldown periods—that operators cannot exceed.

Both BEAM operator multisigs are controlled by the Core Executor Agent Atlas Axis, the entity responsible for executing operational protocol changes in accordance with Atlas mandates.

Stability Parameter BEAM Operator Multisig

The SP-BEAM (Stability Parameter BEAM) operator multisig controls adjustments to stability fees, the DAI Savings Rate, and the Sky Savings Rate. These parameters directly affect protocol revenue and user yields, making their management one of the most operationally significant multisig functions in the ecosystem.

The 2-of-3 threshold allows operational continuity even if one signer key is unavailable, while still requiring multi-party approval ^[7]. All parameter changes must fall within governance-set bounds, and an on-chain cooldown period (tau) prevents rapid successive adjustments.

stUSDS BEAM Operator Multisig

The stUSDS BEAM operator multisig manages parameters specific to the stUSDS mechanism, including the stUSDS rate, SKY borrow rate, deposit caps, and debt ceilings.

The same 2-of-3 threshold and bounded parameter constraints apply as with the SP-BEAM multisig ^[6]. If either BEAM multisig is compromised, governance can execute a Halt Spell to immediately disable the affected BEAM without waiting for the Governance Security Module delay.

Emergency and Security Multisigs

Emergency multisigs provide rapid-response security capabilities for scenarios where the standard governance process (propose, vote, wait for GSM delay, execute) would be too slow to prevent damage. These multisigs typically have lower signing thresholds to enable faster action, balanced by strict scope limitations—they can only pause or freeze affected components, not modify protocol parameters or move funds.

SparkLend Security Access Multisig

The SparkLend Security Access Multisig is authorized to pause or freeze markets within SparkLend in response to code exploits, oracle failures, or other technical vulnerabilities. It is added as a ward in the FreezerMom contract, granting it the specific authority to trigger SparkLend's emergency freeze mechanism.

This multisig is notable for having individually named signers rather than role-based signer slots ^[5]. The 3-of-5 threshold provides resilience against key compromise while requiring majority agreement among security-focused community members. All emergency actions taken by this multisig must be reported to the Sky community within a reasonable timeframe on the Sky Forum, maintaining accountability for crisis interventions.

LayerZero Bridge Freezer Multisigs

The LayerZero bridge freezer multisigs provide emergency pause capabilities for the cross-chain bridge infrastructure connecting Ethereum and Solana. These multisigs are restricted to emergency use only—specifically in response to code exploits or technical vulnerabilities that threaten bridged assets.

Ethereum LayerZero Freezer Multisig

The Ethereum-side freezer multisig uses the same Core Facilitator / Core GovOps signer structure as the treasury multisigs, but with a lower 2-of-4 threshold to enable faster emergency response ^[3]. This means a single signer from each role can freeze the bridge without waiting for additional approvals.

Solana LayerZero Freezer Multisig

The Solana-side freezer multisig uses a different signer composition—Amatsu and Keel rather than Core Facilitator and Core GovOps—reflecting the operational entities with direct presence on Solana infrastructure ^[4].

Star Agent Liquidity Layer Multisigs

Each Sky Star that operates a liquidity layer maintains a standardized three-multisig structure for managing cross-chain capital allocation. This architecture separates concerns into three distinct operational functions, each with its own address, threshold, and signer composition tailored to the specific Star's operational model. The three multisig types serve complementary roles: Prime Relayers handle routine capital movements, Core Operator Relayers manage operational governance functions, and Freezer multisigs enable emergency intervention.

Spark Liquidity Layer

Spark is the largest Star Agent by total value locked and operates across Ethereum, Base, and Arbitrum. Its multisig structure reflects its scale, with Ecosystem Actor Phoenix Labs playing a central operational role alongside governance signers.

Spark Prime Relayer Multisig

The 1-of-2 threshold on the Prime Relayer enables rapid capital movements, as routine allocation operations require minimal delay ^[11]. This lower threshold is acceptable because Prime Relayer actions are bounded by the governance-approved allocation parameters.

Spark Core Operator Relayer Multisig

The Core Operator Relayer has the most diverse signer composition of any Spark multisig, distributing control across three entities ^[12]. Phoenix Labs may create and propose transactions, but execution requires the 2-of-5 threshold, ensuring cross-entity approval.

Spark Freezer Multisig

The 1-of-4 threshold on the Freezer multisig prioritizes speed of emergency response—any single signer can trigger a freeze ^[13]. This design accepts higher trust assumptions in exchange for the ability to halt operations within a single block when a vulnerability is detected.

Grove Liquidity Layer

Grove operates on Ethereum mainnet with a governance structure that emphasizes internal control through its own team while using Operational GovOps Amatsu for Core Operator functions.

Grove's Prime Relayer has the highest threshold ratio (4-of-7) of any Star Agent, requiring majority approval among Grove's own signers for routine capital movements ^[14]. The Freezer multisig uses individually named community signers rather than role-based slots, similar to the SparkLend Security Access Multisig approach.

Keel Liquidity Layer

Keel is the only Star Agent currently operating across both Ethereum and Solana, requiring separate multisig deployments on each chain. The Ethereum multisigs use Gnosis Safe while the Solana multisigs use Squads (the Solana-native multisig standard).

Keel Ethereum Multisigs

Keel's Ethereum Freezer multisig has the most diverse signer composition of any Star Freezer, spanning three distinct entities ^[19]. This distribution reflects governance's emphasis on cross-entity oversight for emergency actions affecting a multi-chain Star.

Keel Solana Multisigs

The Solana Freezer multisig address is deployed, but the specific signer composition had not been finalized in the Atlas as of February 2026 ^[21].

OBEX Liquidity Layer

OBEX operates on Ethereum mainnet with a governance structure that uses Operational GovOps Ozone (distinct from Operational GovOps Amatsu) for Core Operator functions.

OBEX mirrors Grove's high-threshold Prime Relayer design (4-of-7), while its Freezer is controlled entirely by OBEX's own signers rather than cross-entity community members ^{[22] [24]}.

Security Model and Considerations

The multisig architecture across Sky Protocol reflects a deliberate set of security tradeoffs that balance operational speed against the risk of compromise. Understanding these design choices is essential for evaluating the protocol's governance security posture.

Threshold Design Principles

Signing thresholds follow a consistent pattern across the ecosystem: higher thresholds for fund-holding treasury multisigs, moderate thresholds for operational and Core Operator functions, and lower thresholds for emergency freeze capabilities. The Core Council Buffer and Aligned Delegates Buffer both use 3-of-4, requiring cross-role approval for any fund movement ^{[1] [2]}. BEAM operator and Core Operator Relayer multisigs generally use 2-of-3, enabling operations when one signer is unavailable while still requiring multi-party approval ^{[6] [7]}. Emergency Freezer multisigs use the lowest thresholds—as low as 1-of-4 for Spark—prioritizing speed of response over consensus ^[13].

Signer Diversity and Role Separation

The protocol implements role separation by requiring signers from distinct organizational entities. Treasury multisigs split control between Core Facilitator and Core GovOps. Star Agent Core Operator Relayers are managed by Operational GovOps entities (Amatsu or Ozone) rather than the Stars themselves, creating external oversight of operational functions ^{[15] [23]}. This separation ensures that the entity proposing a transaction is not the same entity that ultimately controls its execution.

Accountability and Transparency

All multisig addresses and configurations are published in the Sky Atlas, making them publicly auditable ^[1]. Any changes to multisig parameters—addresses, thresholds, or signer compositions—must pass through the formal executive vote process. Emergency actions taken by security multisigs carry a mandatory reporting requirement: all interventions must be disclosed to the Sky community on the Sky Forum within a reasonable timeframe ^[5].

Known Limitations

The current multisig architecture has several limitations that governance participants should be aware of:

• Key compromise risk — BEAM operator multisigs controlled by a single entity (Core Executor Agent Atlas Axis) mean that compromising that entity's keys could enable unauthorized parameter changes within bounded ranges ^{[6] [7]}.
• Incomplete signer disclosure — While the Atlas publishes multisig addresses and thresholds, individual signer addresses are not always linked to public identities, limiting community ability to verify signer independence.
• Cross-chain complexity — Keel's dual-chain deployment introduces additional coordination overhead, and the Solana Freezer multisig's signer composition remained unspecified as of February 2026 ^[21].
• Gnosis Safe signing friction — Multisig wallets using Gnosis Safe cannot easily produce signed messages required by certain governance processes (such as Aligned Delegate recognition), creating operational friction for participants who prefer multisig security over externally owned accounts ^[9].

Historical Context

The current multisig framework evolved from MakerDAO's earlier core unit wallet system. MIP47, adopted during the MakerDAO era, established the foundational principle that all operational multisig wallets must be disclosed to and considered owned by the governance community ^[9]. The legacy GovAlpha core unit maintained a governance-administered multisig at 0x01D26f8c5cC009868A4BF66E268c17B057fF7A73, which was disclosed on the MakerDAO forum in accordance with MIP47 requirements ^[10].

All multisig operations ultimately exist downstream of the Pause Proxy (0xbe8e3e3618f7474f8cb1d074a26affef007e98fb), the governance-controlled execution proxy through which executive votes take effect on-chain ^[8].

The transition from MakerDAO's core unit structure to Sky Protocol's facilitator and agent model brought significant changes to multisig governance. The earlier system used relatively simple per-unit multisigs with ad hoc signer compositions. The current Atlas-driven model standardizes multisig parameters, codifies signer roles, and introduces the three-multisig pattern (Prime Relayer, Core Operator Relayer, Freezer) across all Star Agent liquidity layers, creating a more systematic and auditable governance structure.

Complete Multisig Reference

The following table provides a consolidated view of all governance facilitator and operational multisigs documented in the Sky Atlas as of February 2026:

Related Articles

• Aligned Delegates — Covers the Aligned Delegate compensation framework that the AD Buffer multisig disbursed funds for
• BEAM Payload Safety — Details the bounded parameter adjustment mechanism controlled by BEAM operator multisigs
• Executive Votes — Explains the governance process through which multisig parameters are established and modified
• Governance Security Module — Describes the time-lock mechanism that emergency multisigs can bypass during crises
• Sky Governance Voting — Covers the voting infrastructure including recent multisig configuration updates
• Spells — Details the MOM (Module Oversight Manager) contracts that interact with emergency multisigs
• Sky Atlas — The constitutional document that codifies all multisig parameters and governance rules

Sources

1. Core Council Buffer Multisig Address - A.2.3.1.4.1.1.1.1
2. Aligned Delegates Buffer Multisig Address - A.2.3.1.4.1.2.1.1
3. Ethereum LayerZero Freezer Multisig Address - A.1.9.4.1.3.1.1.1
4. Solana LayerZero Freezer Multisig Address - A.1.9.4.1.3.1.2.1
5. SparkLend Security Access Multisig Address - A.1.9.4.2.1.5
6. stUSDS BEAM Operator Multisig Address - A.4.4.1.3.8.4.1.1
7. SP-BEAM Operator Multisig Address - A.3.7.1.3.5.1.1
8. Pause Proxy Address - A.4.6.1.1.2.1.1
9. MIP47: MakerDAO Multisignature Wallet Management
10. GovAlpha Administered Multi-sig | MakerDAO Forum
11. Spark Prime Relayer Multisig Address - A.6.1.1.1.2.6.1.2.1.2.2.1.1
12. Spark Core Operator Relayer Multisig Address - A.6.1.1.1.2.6.1.2.1.2.2.2.1
13. Spark Freezer Multisig Address - A.6.1.1.1.2.6.1.2.1.2.2.3.1
14. Grove Prime Relayer Multisig Address - A.6.1.1.2.2.6.1.2.1.2.2.1.1
15. Grove Core Operator Relayer Multisig Address - A.6.1.1.2.2.6.1.2.1.2.2.2.1
16. Grove Freezer Multisig Address - A.6.1.1.2.2.6.1.2.1.2.2.3.1
17. Keel Prime Relayer Multisig Address (Ethereum) - A.6.1.1.3.2.6.1.2.1.2.2.1.1
18. Keel Core Operator Relayer Multisig Address (Ethereum) - A.6.1.1.3.2.6.1.2.1.2.2.2.1
19. Keel Freezer Multisig Address (Ethereum) - A.6.1.1.3.2.6.1.2.1.2.2.3.1
20. Keel Core Operator Relayer Multisig Address (Solana) - A.6.1.1.3.2.6.1.2.1.2.3.3.1
21. Keel Freezer Multisig Address (Solana) - A.6.1.1.3.2.6.1.2.1.2.3.4.1
22. OBEX Prime Relayer Multisig Address - A.6.1.1.5.2.6.1.2.1.2.2.1.1
23. OBEX Core Operator Relayer Multisig Address - A.6.1.1.5.2.6.1.2.1.2.2.2.1
24. OBEX Freezer Multisig Address - A.6.1.1.5.2.6.1.2.1.2.2.3.1