★ Low-threshold multisig vs TVL
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor assesses whether a protocol's multisig signing threshold is abnormally low relative to its TVL and peer cohort. Rather than scoring the raw threshold number in isolation, the measurement places it against the distribution of thresholds used by protocols in the same TVL bracket — flagging cases where the required signer count falls materially below what peers of equivalent size have adopted. A 2-of-3 threshold securing $5M may be unremarkable; the same configuration securing $500M is structurally indefensible.
**Why it matters** Low signing thresholds concentrate effective control into a small, compromisable set of signers. OpenZeppelin governance security guidance recommends using battle-tested multisig implementations with "publicly known" owners who can be "linked to specific individuals in the community" — the accountability argument collapses when two or three unknown signers collectively hold the keys to hundreds of millions. The dataset's largest bridge and protocol exploits share a structural feature: a threshold low enough that a nation-state actor, rogue insider, or targeted phishing campaign need only compromise two or three endpoints. Both Harmony Bridge and Radiant Capital II demonstrated that even a 3-of-11 threshold on a $53M protocol represents an unacceptable concentration of risk.
**Green / Yellow / Red** Green is assigned when the multisig threshold meets or exceeds peer norms for the TVL cohort (typically 5-of-8 or higher at $100M+ TVL) and signers are geographically and institutionally distributed. Yellow covers cases where the threshold is within one signer of the peer median or where distribution of signers is unclear. Red is assigned when the threshold is two or more signers below the peer median for the TVL bracket, or when a protocol above $50M TVL uses a threshold below 3-of-N.
**Common gray cases** This factor is grayed when the protocol does not publish a signer list and on-chain discovery is inconclusive, or when the TVL is below the $5M floor at which peer-cohort comparison becomes meaningful.
**Notable historical examples** - **Harmony Horizon Bridge** ($100M, 2022): 2-of-5 multisig with hot wallet signers; threshold compression made key compromise catastrophic. - **Radiant Capital** ($53M, 2024): 3-of-11 threshold on a large lending protocol; suspected DPRK-attributed compromise of three signers was sufficient for full control. - **Poly Network (2nd incident)** ($4.4M extracted, 2023): 3-of-4 threshold enabled forged cross-chain proofs with minimal key exposure. - **Orange Finance** ($843K, 2025): Multisig misconfigured as effectively 1-of-1; complete drain executed unilaterally.
**★ Critical factor** This factor alone is sufficient to trigger a D or F grade under rubric v1.7.0 — a single red assessment here overrides all other category scores. An abnormally low signing threshold relative to TVL is a structural vulnerability that makes every other security investment conditional on the safety of a small number of private keys.
Measurement what to look for #
Determine whether the multisig threshold is abnormally low relative to TVL peer cohort (e.g., 2-of-3 for a protocol with >$100M TVL where peer norm is 5-of-8).