A 2-of-3 multisignature wallet does not give each signer one-third of the money; it lets any two authorize the whole transaction. The threshold distributes approval power, not balances.
What the signatures actually approve
In a Safe, the transaction hash covers the destination, native-token value, calldata, operation type, and nonce. Owners sign that exact payload, and the contract checks that enough distinct owners signed before executing it. The person who submits the final transaction may be a signer or a relayer; pressing “execute” adds no spending authority.
That distinction matters because the wallet does not understand economic intent. It can send ETH, call an ERC-20 transfer, grant an allowance, or invoke a contract method on Curve Finance. A transaction that appears to move no tokens may approve a router to move them later. The Safe validates the authorized call; the token or protocol contract enforces what that call does.
The same issue appears when a treasury holds Frax Dollar and Frax Share. Two of three owners can approve a trade, an allowance, or a transfer of the entire position. They are not each limited to a personal slice. A treasury using Frax Swap should therefore inspect the router address, calldata, and approval amount—not just the headline token and amount.
What changed with modules
Modern smart-account multisigs can add a second layer of authority through modules. An allowance module, for example, can let an operator spend up to a daily limit without collecting the full owner threshold for every payment. The owners still need to approve enabling that module, but afterward its code can call the Safe through the module execution path.
This replaces the crude choice between approving every small payment and giving someone a hot-wallet key. It also changes the review question: ask not only “how many signatures are required?” but “which addresses can execute, under which limits, and through which contracts?” A module is an authority delegation, not a softer version of multisig.
The practical rule
Use the threshold for treasury movement, owner changes, module changes, and large protocol actions. Use a tightly bounded module for recurring operations. Review token approvals as spending authority, and monitor changes to owners, thresholds, modules, and guards on-chain. If a signer cannot explain the calldata, that signature is not routine administration; it is a vote on an unknown transaction.
FAQ
Does 2-of-3 mean each signer can spend one-third?
No. Any two valid signatures can authorize the complete transaction, subject to the wallet’s current state.
Can a module bypass the threshold?
An enabled module can execute through its own rules without the normal owner-signature path. Enabling or removing it requires the configured threshold, so module code and permissions deserve the same scrutiny as owners.