The last check between
signed and sent

Settlin Guard sits between your multisig and the chain. Signers sign as they always have, and a transaction only lands if it passes your rules.

Book a demoHow it works
The Settlin Guard dashboard showing a multisig, three proposals and how Settlin decided the blocked one
Every one fully signedSettlin still decidesEvery check, in order
Proposal #3 needs your PINTreasury: Send 5 SOL to M3Nt⁠…⁠wdv8
Settlin blocked proposal #4Treasury: Let fLKr⁠…⁠5c3g spend 2 SOL without a vote
Proposal #2 executedTreasury: Send 0.5 SOL to M3Nt⁠…⁠wdv8
Settlin blocked a delegatecallOps Safe: Delegatecall to 0x91⁠…⁠e07b
Transfer executedOps Safe: Pay 1,200 USDC to a trusted address
Owner change needs your PINOps Safe: Swap owner 0x3f⁠…⁠a91c
Proposal #7 executedGrants: Send 2 SOL to 9xQ4⁠…⁠m2Lp
Approval needs your PINOps Safe: Approve unlimited USDC
Settlin blocked proposal #9Grants: A batch Settlin can’t run
Proposal #11 needs your PINTreasury: Over the 3 SOL a day Settlin runs alone
Proposal #8 executedGrants: Send 0.25 SOL to 4hTz⁠…⁠pQ7c
New module needs your PINOps Safe: Enable module 0x7a⁠…⁠11d4
Settlin blocked proposal #12Grants: Add a spending limit

Works with the multisigs teams already run

  • Safe
  • Squads
  • Ethereum
  • Arbitrum
  • Base
  • Optimism
  • Polygon
  • BNB Chain
  • Avalanche
  • Gnosis
  • Solana

The biggest multisig drains all had enough signatures. The signers were tricked or hacked, and the multisig did what it was told.

What a valid signature has cost

Publicly reported losses

Every transaction gets one of three answers

Set your rules once. Settlin applies them to every proposal, however convincing it looks.

  1. Runs

    Inside your limits, to addresses you trust. Settlin executes it on its own.

    Send 0.5 SOL toM3Nt…wdv8Executed

  2. Waits

    Over a limit or out of the ordinary. Nothing moves until an admin approves it with a PIN.

    Send 5 SOL toM3Nt…wdv8Needs your PIN

  3. Never runs

    Spending limits, unknown delegatecalls, anything Settlin can’t read. It doesn’t matter how many people signed.

    LetfLKr…5c3gspend 2 SOL without a voteBlocked
Read it.
Check it.
Stop it.

Signers sign. Settlin decides what lands.

  • Delegatecalls
  • Owner changes
  • Threshold changes
  • Guard changes
  • New modules
  • Token approvals
  • Spending limits
  • Member changes
  • Unknown programs
  • Oversized transfers
  • Gas refunds
  • Unreadable calls

stop here

Send 0.5 SOLExecutedDelegatecall to 0x91…e07bBlockedSend 5 SOLNeeds your PINPay 1,200 USDC to a trusted addressExecutedAdd a spending limitBlockedSwap owner 0x3f…a91cNeeds your PINApprove unlimited USDCNeeds your PINRun a batch on SquadsBlockedEnable module 0x7a…11d4Needs your PIN

See every decision, and why

The dashboard your admins use to read, release and freeze. Shown here with sample data.

See why it was held. Every proposal shows what Settlin checked, in order, and which rule decided it.

How Settlin decided a blocked proposal, check by check

Release it with a PIN. The amount, the recipient, the rule and what’s left in the vault, on one screen, before anything moves.

The approval dialog for a 5 SOL transfer, asking for the admin PIN

Write the rules once. Limits per transaction and per day, trusted recipients and allowed programs. On Squads, a policy change needs your members’ vote.

The policy table: SOL transfers, spending limits and multisig changes

Nobody goes around it. Members keep Initiate and Vote. Settlin’s executor holds Execute, and it’s the only one that does.

The members table, where only Settlin’s executor has the Execute permission

A cap the chain enforces. On Squads, the executor’s daily limit lives in Settlin’s guard program, whatever the policy allows.

The executor’s daily limit: 0.5 of 100 SOL used

Where it runs

Safe

Chains: Ethereum, Arbitrum, Base, Optimism, Polygon, BNB Chain, Avalanche, Gnosis

How it’s wired: A transaction guard set on your Safe

Who can land it: Settlin’s executor

Hard stops: Delegatecalls, gas refunds, malformed token calls

Way out: Signed transactions can run without Settlin after a public delay of 2 to 30 days

Status: Ready to deploy

Squads

Chains: Solana

How it’s wired: Settlin’s executor becomes the only member with Execute

Who can land it: Settlin’s executor, a program account with no private key

Hard stops: Spending limits, batches, anything it can’t read

Way out: The executor’s owner can appoint another guardian

Status: On devnet, audit pending

Guarded contracts

Chains: EVM chains

How it’s wired: Risky calls queue behind a delay in your contract

Who can land it: Your contract, once the delay passes and the rules allow it

Hard stops: Anything outside a function’s allowed values

Way out: Members can exit while a guardian change waits

Status: Built for vaults

You stay in control

  • Your keys stay yours

    Settlin never holds a signer’s key. Funds stay in your multisig, and its executor can only run what your members already approved.

  • You can always leave

    Settlin can’t strand a treasury. Every setup has a way to run without it, spelled out above for each chain.

  • Nothing happens quietly

    Every decision shows what was checked and who approved it, and anything held or blocked goes straight to your admins’ phones.

What we’re adding

In build now. Each one moves into the product as it ships.

  • Cooling-off delay

    Upgrades, authority transfers and member changes wait, and anyone on the team can cancel.

    In build

  • Solana’s dangerous actions, by name

    Program upgrades and authority changes called out for what they are, and durable nonces watched.

    In build

  • Two people for large releases

    A second admin above the amount you set.

    In build

  • Alerts where teams work

    Slack, Telegram, PagerDuty and webhooks, beside the phone alerts you get today.

    In build

  • Freeze everything

    One button across every multisig in a protocol.

    In build

  • Balance previews on Solana

    See exactly what changes before you approve.

    In build

  • Authenticator and passkeys

    A second factor on every release, with backup codes.

    In build

  • Continuous contract analysis

    Watches your contracts for code changes and risky patterns, and alerts your team when something moves.

    In build

Questions teams ask first

No. They keep proposing and signing in Safe{Wallet} or Squads, with the wallets they use today. What changes is who can execute.

No. Funds stay in your multisig and every signer keeps their own key. Settlin’s executor can only run what your members have already approved.

Nothing moves without it, and nothing is stranded. Safe owners can run a signed transaction after a public delay they choose, from 2 to 30 days. On Squads, the executor’s owner can appoint another guardian.

Whatever they approve still has to pass your policy, so anything unusual waits for an admin’s PIN or never runs. On Safe they could announce an escape, but that’s public, takes days and alerts your team, who can reject it first.

A PIN alone does nothing. Every release also needs a signature from an authorized admin wallet, and five wrong tries lock the PIN for 15 minutes.

Not on its own. Settlin stops bad transactions from your multisig and guarded contracts. A bug in a pool contract still needs an audit and monitoring, which is why continuous contract analysis is on the way.

Not yet. An independent audit comes before mainnet. Ask us where it stands and we’ll walk you through the code and the threat model.

Put a check between signed and sent

Book a demo