6-Point Checklist Before You Add a New DAO Multisig Signer

TL;DR - Screen a prospective signer's wallet for sanctions, mixer, and stolen-funds exposure before the vote grants them access to the treasury.

Most DAO treasury losses don't start with a smart-contract bug. They start with a wallet nobody screened before the governance vote added it as a signer. This checklist applies any time a DAO, protocol, or project is about to grant a new address signing rights on a Safe multisig - a core-team hire, a community-elected delegate, a security council seat, or a replacement after a resignation. Run it before the vote closes, not after the new signer already holds keys to funds they could move, freeze, or hold hostage in a stalled quorum.

Before you start

You don't need the candidate's real-world identity to run this check, and you don't need their cooperation either. Wallet screening reads public blockchain data - what an address has sent, received, and touched - the same ledger anyone can already query. The one thing you need before you start is the exact address the candidate will sign from, confirmed in writing, not copied from a Discord thread where a look-alike address could already be swapped in.

A manual check is possible. Open the address on Etherscan and scroll the transaction list, looking for anything that looks obviously wrong. That shows you what moved, not what it means - spotting a mixer contract or a sanctioned counterparty by eye takes practice most treasury admins don't have time for. Instead of reading a raw transaction history, screen the address with Plastron and get one risk score covering sanctions, mixer, and stolen-funds exposure before the proposal goes to a vote. That screen checks the candidate's address against Plastron's own corpus of 3,901 labeled risk addresses plus 780 OFAC SDN entries, not a single sanctions-list lookup.

What happens if you skip screening a signer's wallet?

The risk isn't that the candidate is secretly a thief. It's that a multisig signer inherits every downstream consequence of that wallet's prior history, and a DAO treasury is a far bigger target than one freelancer's invoice.

• Sanctions exposure follows the whole treasury. A signer address with a direct or near-direct link to an OFAC-listed entity puts every transaction that wallet co-signs under the same shadow, not just that signer's personal funds.
• A single compromised wallet becomes everyone's problem. On February 21, 2025, attackers linked to North Korea's Lazarus Group used a compromised Safe developer machine to alter what three of Bybit's own signers saw on their hardware wallets, turning an approval for a routine transfer into a $1.5 billion drain of the exchange's cold wallet. The signers weren't malicious - the interface they trusted was compromised instead. A DAO that grants signing rights to an address it never checked is accepting a smaller, slower version of that same blind trust.
• Removal is slow. If a signer later turns out to be compromised or uncooperative, voting them off a threshold multisig needs the remaining signers to coordinate, a process that can stretch for weeks while funds sit exposed.

The checklist

Run through these 6 checks before the proposal to add a new signer goes to a final vote.

1. Get the exact candidate wallet address in writing.
   • Pull it from a signed message or a dated governance-forum post, never from a chat screenshot that could already carry the wrong address.
   • Confirm it's the address the candidate will actually sign from on the target chain, not a different wallet they used once.
2. Screen the address for sanctions, mixer, and stolen-funds exposure in one pass.
   • Treat a clean result as permission to proceed, not as a background check on the person behind the wallet.
3. Check how old the address is and how it has actually been used.
   • A wallet funded 3 days before the nomination carries different risk than one with 2 years of ordinary activity.
   • A long-dormant address reactivated right before the vote is worth a direct question to the candidate, not an automatic rejection.
4. Check whether the address has touched a known hack or exploit's proceeds.
   • Funds that passed through a bridge hack or a drained protocol carry that exposure forward to every wallet downstream, signer included.
5. Require a signed verification message from that exact address before the on-chain vote closes.
   • This confirms the wallet connected to governance is the one you screened, not a substitute swapped in afterward.
6. Put the signer's wallet on a recurring re-screen schedule, starting the day they're added.
   • A clean result at onboarding says nothing about what the address does next.

How do you read a flagged result before the vote?

A flagged result isn't a verdict on the candidate's character. It's a reason to ask a direct question before the proposal moves forward, not an automatic disqualification.

Ask the candidate about the source of the exposure, and request a different signing address if the link looks material - a direct sanctions hit, or a traced connection to a hack's stolen funds. A distant, low-confidence match from years back is usually worth no more than a note in the governance thread. A sanctioned multisig behaves differently from a sanctioned individual wallet, so don't assume the whole Safe freezes the moment one signer's personal address shows exposure. Document the screening result in the same forum post where the vote happens, so the decision has a paper trail if anyone asks later.

How often should you re-screen a signer's wallet?

Quarterly, at minimum, and immediately after any signer's wallet shows a transaction you didn't expect. A signer's risk profile isn't fixed at onboarding - it shifts every time that address transacts with someone new, the same way a long-dormant wallet reactivating can itself trigger a flag at an exchange.

Treat the re-screen as a standing calendar item tied to the signer roster, not a one-time gate at the vote. A DAO running 5 signers through a quarterly check is running the same screen 20 times a year. Cheap insurance, against the alternative of finding out a signer's wallet went bad only after a transaction already cleared.