How approval works
Every action a vault takes — a payment, a swap, a contract call — starts as a proposal. It sits in the dashboard where all owners can see it, collecting votes. When the number of Yes votes reaches the threshold, the transaction can be submitted to Stellar. Before that it is inert: nothing has moved and nothing is committed.
Each owner has three buttons on a pending proposal:
- Vote Yes — approve it. These are the votes counted against the threshold.
- Vote No — object to it.
- Abstain — decline to take a side, while still using up your vote. Read the section below before using it, because it is not as neutral as it sounds.
Choosing a threshold
The threshold is the trade-off between safety and friction, and it is worth spending a minute on rather than accepting a default.
- Two of three suits a small team. Any two people can act, and losing one key is survivable.
- Three of five suits a larger group where people are sometimes unavailable, and tolerates losing two keys.
- One of anything is not offered. The lowest threshold you can choose is two, so a vault can never be moved by one person acting alone. A vault therefore needs at least two owners.
- All of N means one lost key locks the vault forever. Avoid it unless you have a specific reason and a recovery plan.
A threshold is a bar, not a majority
This trips people up, so it is worth being explicit: the threshold is the number of Yes votes needed to pass. It is not a poll that the majority wins. No votes do not cancel out Yes votes, and a proposal most people dislike is not automatically dead.
Take a two-of-five vault where three owners vote No. It is tempting to read that as three against, so dead. But only two Yes votes are needed and two owners have not voted yet, so the transaction can still pass. It stays open precisely because it is still reachable.
A proposal dies only when too few owners remain to reach the threshold — the contract marks it Rejected the moment the Yes votes already cast, plus every vote still outstanding, add up to less than the threshold. In that same vault that takes four No votes: with one owner left, two Yes votes can no longer happen.
Abstaining is where this catches people out. An abstention does not object to anything, but it does spend your vote — which lowers the number of owners who could still say Yes. In that two-of-five vault, three No votes leave the proposal alive; one abstention on top of them ends it, because only one undecided owner remains and two Yes votes are needed.
Set the threshold to reflect how you actually want decisions made. If you want a genuine majority of five owners, the threshold is three.
Changing owners or the threshold
Owners and thresholds can be changed after the vault exists, but the change is itself a proposal that must clear the current threshold. A two-of-three vault needs two Yes votes to add a fourth owner.
Practical advice
- Do not put every key in one place. Owner keys held on the same laptop, or derived from one seed phrase, give you the appearance of multi-signature without the protection.
- Name owners honestly. The names appear next to each vote. "Finance — hardware wallet" is far more useful during an incident than "Owner 2".
- Rehearse recovery. Know in advance which keys you would use if one were lost, and confirm those holders can still sign.