Explore
Product navigation
Custody
Multisig
Authority transfer
Custody Workspace
Multisig and authority transfer are now an explicit launch workflow
This route turns the custody story into a live operating surface. It keeps the signer split, transfer sequence, and evidence checklist visible without pretending the external ceremony has already happened.
Live proofs
2
Baseline proof and dedicated V3 proof packet are both reviewer-facing
ZK anchors
3
On-chain proof anchors exposed in the Testnet evidence path
Wallets
50
Multi-wallet Testnet rehearsal already captured and packaged
Commercial rails
4
Grant, fund, gaming, and enterprise service packs remain part of the UI
Canonical custody proof
Repo-backed multisig and authority proof, with active evidence targets and explorer-linked readiness points
ready-for-transfer · 16/25
PrivateDAO is Testnet-live and internally hardened; real-funds mainnet production remains gated on external audit, custody completion, monitoring, runtime wallet captures, verifier-CPI or audited residual-trust acceptance for privacy settlement, and the final release ceremony.
Multisig and timelock
Implementation: Squads Protocol
Multisig address: thHmF7VYNtxE1MaDzYXbfPCiq13RF6JwuWnjvDZuSmF
Threshold: 2-of-3
Creation signature: 67S63JAUNvvCED3hE9h6bCXW9iJ3EYzJLARvj8Lki5x2dJEgLnrfES9mp6bAxfsH6vfmor2ocqNaEd68uVN68DNJ
Rehearsal signature: Awaiting external record
Existing devnet rehearsal: EqbW1xQRABPNmPM4TMkdygp6j94i7A3DSbgFKTpqXvJE
Rehearsal creation proof: 4KSyTYQTzeNpBDWou7GFLmvUpAhLgmNKkNdd4PZqndLpCWmUnArffYRQUwe6zrTmQD5uCbBfBR6pakf9Gz8dviRp
Configured timelock: 48h
Timelock config proof: 67S63JAUNvvCED3hE9h6bCXW9iJ3EYzJLARvj8Lki5x2dJEgLnrfES9mp6bAxfsH6vfmor2ocqNaEd68uVN68DNJ
Signer roster
Slot 1 · founder-operator
Public key: 4Mm5YTRbJuyA8NcWM85wTnx6ZQMXNph2DSnzCCKLhsMD
Storage class: cold-or-hardware
Backup documented: yes
explorerSlot 2 · independent-security-or-ops-signer
Public key: BBBPcpUnnBi3CWUhcv6vLTqaY9pugAGuhgw2Axjpvcr2
Storage class: cold-or-hardware
Backup documented: yes
explorerSlot 3 · recovery-or-governance-signer
Public key: 2KpA69UB55tfWUSkKj5j7Tvebd3eG22hEs9hjXUq7pf5
Storage class: cold-or-hardware
Backup documented: yes
explorerAuthority transfer proof
program upgrade authority
Program ID: EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Destination authority: CALHrBqx6jbzcPn2NVcinqSAHeod65v9LcDuTxsdPqBv
Transfer signature: EzwLLrAchBpj3eLTUFuv1uo9rSLKgKNbQgp1DkCevJycT31Eou9TSJsJsEfMjLt4q87pKwXaZUTqCZ1NduNc1vy
Post-transfer readout: Program Id: EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva; ProgramData Address: FKyt5DcmRQcCF8kzMGjCvfGb3ZPHMQnH1SqiG9Mi8xEc; Authority: CALHrBqx6jbzcPn2NVcinqSAHeod65v9LcDuTxsdPqBv; Last Deployed In Slot: 405189011
dao authority
Program ID: EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Destination authority: Awaiting external record
Transfer signature: Awaiting external record
Post-transfer readout: Awaiting external record
treasury operator authority
Program ID: EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Destination authority: Awaiting external record
Transfer signature: Awaiting external record
Post-transfer readout: Awaiting external record
Active evidence targets
rehearsal signature
dao authority destination authority
dao authority transfer signature
dao authority post-transfer readout
dao authority post-transfer readout reference
treasury operator authority destination authority
treasury operator authority transfer signature
treasury operator authority post-transfer readout
treasury operator authority post-transfer readout reference
Next readiness gate and sources
Gate: upgrade-authority-multisig
Severity: critical
Status: pending-external
Move production upgrade authority and operational authorities to a documented multisig or governance-owned path and rehearse rotation.
Observed chain readouts
Current Testnet deployed program readout after Squads transfer
testnet · observed
Address: EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Authority: CALHrBqx6jbzcPn2NVcinqSAHeod65v9LcDuTxsdPqBv
ProgramData: FKyt5DcmRQcCF8kzMGjCvfGb3ZPHMQnH1SqiG9Mi8xEc
Owner: BPFLoaderUpgradeab1e11111111111111111111111
Last deploy slot: 410689759
Balance: 10.35334104 SOL
Executable: yes
Current reviewer-facing Anchor 1.0.1 Testnet program. This is the live custody surface for judging; archived Devnet readouts are no longer the current program baseline.
observed at 2026-05-26T03:08:02.746Z
solana program show EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva --url testnet
Current Testnet DAO anchor readout
testnet · observed
Address: FEz2hCLGpDhJ3cdAm5CCWFzrKv8vDDzmmt9UjdF2fApZ
Owner: EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Balance: 0.00235248 SOL
Executable: no
Canonical Testnet DAO PDA used for the post-timelock DAO authority handoff.
observed at 2026-05-26T03:08:03.512Z
solana account FEz2hCLGpDhJ3cdAm5CCWFzrKv8vDDzmmt9UjdF2fApZ --url testnet --output json
Current Testnet treasury PDA readout
testnet · not-found
Address: 46F4oV4edtepPTGqLBfFJeBKdccgfnkk9e4WK7Z1MZD3
Observed error: Error: AccountNotFound: pubkey=46F4oV4edtepPTGqLBfFJeBKdccgfnkk9e4WK7Z1MZD3
Derived Testnet treasury PDA for the canonical DAO. It may remain uninitialized until the DAO receives a deposit.
observed at 2026-05-26T03:08:04.262Z
solana account 46F4oV4edtepPTGqLBfFJeBKdccgfnkk9e4WK7Z1MZD3 --url testnet --output json
Target network program readout
mainnet-beta · not-found
Address: EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Observed error: Error: Unable to find the account EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Mainnet is not claimed for the current product. This readout exists only to prove the public packet is Testnet-scoped and does not imply production mainnet deployment.
observed at 2026-05-26T03:08:04.777Z
solana program show EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva --url mainnet-beta
Target network treasury readout
mainnet-beta · not-found
Address: 46F4oV4edtepPTGqLBfFJeBKdccgfnkk9e4WK7Z1MZD3
Observed error: Error: AccountNotFound: pubkey=46F4oV4edtepPTGqLBfFJeBKdccgfnkk9e4WK7Z1MZD3
Mainnet treasury visibility is intentionally not claimed. Real-funds production readiness requires a separate mainnet cutover packet.
observed at 2026-05-26T03:08:05.220Z
solana account 46F4oV4edtepPTGqLBfFJeBKdccgfnkk9e4WK7Z1MZD3 --url mainnet-beta --output json
Treasury product-grade
Treasury product-grade bundle
Keep treasury sender discipline and reviewer-facing payments truth next to custody proof, so the ceremony route never drifts away from the business-facing rails it must justify.
Treasury network
Solana Testnet
Next readiness gate
upgrade-authority-multisig
next operating milestone
Payments fit
strong
Treasury intake and payout framing are already live and ready to be strengthened with the next execution evidence.
Next readiness lift
9 items
Move from live treasury intake into stronger custody evidence and production-grade operating confidence.
Strict sender checklist
1Confirm whether the request is a treasury top-up, pilot-funding packet, vendor payout, or contributor payout before selecting a rail.
2Copy the exact public receive address and explorer link for the selected asset rail. Do not reuse a rail from memory.
3Attach a reference string that includes payer, purpose, amount, and settlement context so the intake packet can be matched later.
4Open the proof and trust surfaces before describing the current treasury rail, the operating posture, and the next production milestone to a sender, buyer, or judge.
5Treat the current rails as live Testnet treasury intake with a clear path toward stronger custody evidence and production-safe release readiness.
Reference-linked rails
SOL
Native SOL
AZUroiNeGAjNdD84eEHnAKHHFwqAFmkjr2g1eoF7Ek5c
Use this rail for treasury top-ups, operator funding, and governed SOL transfers on Testnet.
Mint: Configured at deployment / public receive rail only
USDC
USDC
AZUroiNeGAjNdD84eEHnAKHHFwqAFmkjr2g1eoF7Ek5c
Use this rail for governed payouts, vendor settlement, and stable-value treasury requests when USDC is the active stable asset.
Mint: Configured at deployment / public receive rail only
AUDD
AUDD
AZUroiNeGAjNdD84eEHnAKHHFwqAFmkjr2g1eoF7Ek5c
Use this rail for Australian-dollar merchant settlement, treasury reserves, invoice collection, and governed AUD-denominated payout flows.
Mint: Configured at deployment / public receive rail only
PUSD
Palm USD
AZUroiNeGAjNdD84eEHnAKHHFwqAFmkjr2g1eoF7Ek5c
Use this rail for non-freezable stablecoin treasury payments, confidential payroll, grant distribution, and gaming DAO reward settlement.
Mint: Configured at deployment / public receive rail only
USDG
USDG
AZUroiNeGAjNdD84eEHnAKHHFwqAFmkjr2g1eoF7Ek5c
Use this rail for alternative stable settlement when the team or customer operates with USDG-compatible treasury flows.
Mint: Configured at deployment / public receive rail only
Commercial + payments focus alignment
DAO tooling
strong
The core live product already covers DAO creation, proposal lifecycle, private voting, treasury motion handling, trust packets, telemetry, and reviewer-safe surfaces.
Next lift: The highest-value next step is to keep treasury professionalism and custody continuity extremely tight as the product advances toward mainnet operations.
Developer tooling
strong
PrivateDAO already provides reviewer telemetry, generated packets, hosted-read proof, runtime diagnostics, and a developer route tied to real product infrastructure.
Next lift: The best uplift is continued strengthening of exported telemetry, runtime evidence summaries, and infrastructure-facing docs for external engineers.
Payments
strong
Treasury request routing, confidential payout framing, payments-oriented intake flows, and reviewer-safe custody truth are already visible in the live product.
Next lift: The strongest version still requires strict sender discipline, explorer-linked rails, and completed authority-transfer evidence for real-funds credibility.
Next production gate
upgrade-authority-multisig
Move production upgrade authority and operational authorities to a documented multisig or governance-owned path and rehearse rotation.
Severity: critical
Current operating state: pending-external
Next evidence set: rehearsal signature · dao authority destination authority · dao authority transfer signature · dao authority post-transfer readout
Strict custody ingestion
Record ceremony evidence in the exact shape needed by the canonical custody proof
4/6 gates
This surface no longer collects free-form notes only. It builds a strict, reviewer-safe JSON packet that maps directly into
docs/multisig-setup-intake.json. Only public keys, public transaction signatures, and readout references belong here.Define signer set
Repo-ready
Freeze the real 3-signer roster and backup procedures before any authority movement.
Record multisig package
Strict ingestion live
Collect the implementation, address, creation signature, rehearsal signature, and timelock references in one structured packet.
Capture authority transfer evidence
External execution next
Record the destination authority, transfer signature, and post-transfer readout reference for each operational surface.
Apply and rebuild canonical proof
Repo automation ready
Save the JSON packet into `docs/custody-evidence-intake.json` and run the apply command to update canonical proof artifacts.
Multisig package
Implementation, address, creation signature, and rehearsal signature
Next step
Need implementation, multisig address, creation signature, and rehearsal signature.
Threshold and timelock
Capture the final threshold and 48+ hour configuration evidence
Valid
Threshold and timelock evidence are fully recorded.
Signer roster
Record each signer slot with a real public key and backup confirmation
Valid
Slot 1 · founder-operator
Valid
Public key and backup discipline recorded.
Slot 2 · independent-security-or-ops-signer
Valid
Public key and backup discipline recorded.
Slot 3 · recovery-or-governance-signer
Valid
Public key and backup discipline recorded.
Authority transfer surfaces
Each surface needs destination authority, transfer signature, and post-transfer readout reference
program-upgrade-authority
EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Valid
Destination, signature, and readout reference are all recorded.
dao-authority
EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Next step
Need destination authority, transfer signature, readout text, and a reference link.
treasury-operator-authority
EP9xE8MJZ6FfyEwLqns6HDdUZBknEa7WGYs1Jzsecuva
Next step
Need destination authority, transfer signature, readout text, and a reference link.
Authority split
Mainnet requires a hard separation between upgrade authority, treasury authority, and admin authority. PrivateDAO should not carry a single-wallet super-admin posture into production.
Upgrade authority must be isolated from treasury execution.
Treasury authority must remain bound to proposal execution and treasury policy.
Admin authority should stay bounded and explicitly reduced before launch.
Production ceremony
Authority transfer has to be observable and reviewable. The credible path is a documented multisig ceremony with signer inventory, role assignment, and transaction-backed handoff evidence.
Create the production multisig and define signer roles.
Transfer upgrade authority with transaction evidence.
Transfer treasury authority and record the evidence path.
Launch boundary
Until the ceremony is complete, authority hardening remains part of the explicit production-gate surface. This is a strength when shown clearly rather than implied away.
Remove unnecessary single-signer powers.
Keep the next trust steps visible to reviewers and buyers.
Treat authority transfer as a trust event, not an internal note.
Strict intake packet
How to close this fast
When the real ceremony values arrive, download the JSON packet below, save it as
docs/custody-evidence-intake.json, then run npm run apply:custody-evidence-intake. That command updates the canonical intake and rebuilds canonical custody proof, reviewer packet, and launch trust packet artifacts together.Ingestion readiness
4/6 structured gates passed
ready-for-transfer
This local packet remains reviewer-safe. It accepts only public keys, public transaction signatures, and docs or explorer references.
Current packet preview
Multisig implementation: Squads Protocol v4
Multisig address: CALHrBqx6jbzcPn2NVcinqSAHeod65v9LcDuTxsdPqBv
Timelock configured hours: 48
Signer keys populated: 3/3
Authority transfers with signatures: 1/3
Never include secrets
No seed phrases, private keys, unencrypted keypair exports, or screenshots containing secret material belong in this packet.