Secure Your Treasury

Managing a treasury in a Web3 project is one of the most critical responsibilities for founders, DAOs, and protocol teams. A compromised treasury can lead to devastating losses, damaged reputation, and loss of community trust. This document outlines key practices to keep your treasury secure.

---

Principles of Treasury Safety

• Minimize single points of failure — no single individual should have the ability to move all funds.
• Defense-in-depth — combine multiple layers of security (on-chain, off-chain, operational).
• Transparency with accountability — the community should understand how treasury funds are safeguarded and used.

---

Key Practices

1. Use Multi-Signature Wallets

• Deploy a multi-sig (e.g., Gnosis Safe) for treasury management.
• Require at least 2/3 or 3/5 approvals to move funds.
• Regularly review signers’ activity and update signer sets when members change.

2. Role Separation

• Separate operational wallets (day-to-day payments) from treasury wallets (long-term reserves).
• Keep treasury funds in a more secure setup with higher signer thresholds.

3. Access Control and Signer Security

• Signers should use hardware wallets (Ledger, Trezor) rather than browser extensions.
• Enable passphrase protection and biometric/PIN locks.
• Keep seed phrases offline and geographically distributed.

4. On-Chain Safeguards

• Consider time-lock contracts for large treasury actions, giving the community time to review before execution.
• Use spending limits for operational wallets to prevent draining in case of compromise.

5. Diversification of Assets

• Avoid keeping 100% of funds in a single token or chain.
• Diversify between stablecoins, ETH, BTC, and protocol-native tokens.
• If holding stablecoins, diversify across issuers (USDC, USDT, DAI).

6. Insurance and Custody Options

• For larger treasuries, explore crypto insurance providers.
• Consider qualified custodians if regulatory or institutional requirements apply.

7. Continuous Monitoring

• Set up real-time alerts (e.g., Tenderly, Forta, OpenZeppelin Defender) for unusual transactions.
• Regularly audit treasury contracts and signers.
• Run internal drills to simulate compromised keys or stolen funds.

8. Governance Security

• If treasury spending is controlled by governance:

  • Use guarded launch strategies to avoid malicious proposals.
  • Employ veto powers or emergency pause mechanisms.
  • Audit the governance contracts regularly.

Emergency Planning

• Prepare a disaster recovery plan: what happens if a signer is compromised or unavailable?
• Ensure backup signers can be onboarded quickly.
• Document procedures for community communication in case of incidents.