MinaGuard · User Guide

A multi-sig wallet, enforced on-chain.

MinaGuard is a multi-sig wallet on the Mina blockchain. Funds move only when the required number of owners approve, and the chain enforces this with a zero-knowledge proof. No server or individual owner can move funds alone.

This guide covers the core terminology, the propose, approve, and execute lifecycle, and the steps to create and operate a vault.

Every action follows the same three stages. Nothing is committed on-chain until the final stage.

The application uses a small, consistent vocabulary.

Vault

A wallet holding MINA and a list of owners. On-chain, a multisig smart contract.

Owner

An address permitted to propose and approve. Your connected wallet is marked You; a vault you do not own is shown as View-only.

Threshold

The number of approvals a proposal requires before it can execute. Shown in Settings as Required Confirmations.

Proposal

A drafted action awaiting approvals.

Confirmations

The approvals collected so far, displayed as a checklist of owners.

Nonce

A per-vault counter that orders executions and prevents replays. The form supplies the next value.

Delegate

The block producer the vault's stake supports. Setting or clearing it moves no funds.

Blind signing

Wallets cannot render a full proposal, so they sign an opaque hash. Confirm the details in the app before signing.

SubVault

A vault owned by another vault. Nesting is limited to one level.

LOCAL vs REMOTE

LOCAL actions affect the current vault. REMOTE actions are proposed on a Vault and take effect on one of its SubVaults.

Config nonce

A counter that increments when the owner set or threshold changes. A proposal is bound to the config nonce under which it was created, so a later governance change invalidates it.

Verification key

The on-chain fingerprint of a vault's contract, used to verify proofs.

Creating a vault takes four steps and confirms after roughly three minutes.

1. 1

   Connect a wallet

   Connect Auro (browser extension) or Ledger (USB, via WebHID). Ledger also requires a Vault Index, the account number on the device (default 0).

   
2. 2

   Start a vault

   From Your Vaults, select Create Vault. Enter a local nickname and choose a network. Only Testnet is currently available.

   
3. 3

   Set owners and threshold

   The vault address is generated automatically. Add each owner address (up to twenty; your wallet is included by default) and set the threshold.

   
4. 4

   Deploy

   Select Deploy Vault. A single transaction creates the vault and installs its owners, confirming after the next block.

   

Once a vault is deployed, every action follows this sequence.

1. 1

   Propose

   Open a vault and select New Proposal. Choose an action, complete the form (the nonce is prefilled), and select Submit Proposal. Proposing records the proposer's first approval.

   
2. 2

   Approve

   Each remaining owner opens the proposal and selects Approve Proposal. Confirmations accrue until the threshold is met. If a proposal cannot proceed, the app disables the action and states why, right on the proposal.

   
3. 3

   Execute

   When the threshold is met, select Execute Proposal. Any party can execute. If the vault balance is insufficient, execution is blocked.

   

Every action is one of the following types. The chips indicate whether an action affects the current vault (LOCAL) or a SubVault (REMOTE), and whether it changes the config nonce.

transfer

Send MINA

Send MINA to up to nine recipients.

LOCAL

addOwner

Add Owner

Add a signer to the owner set.

LOCALChanges config

removeOwner

Remove Owner

Remove a signer. Blocked if it would drop the owner count below the threshold.

LOCALChanges config

changeThreshold

Change Threshold

Change the number of approvals required.

LOCALChanges config

setDelegate

Set Delegate

Set or clear the block-producer delegate. Moves no funds.

LOCAL

createChild

Create SubVault

Deploy a SubVault owned by this Vault.

REMOTE

allocateChild

Allocate to SubVaults

Fund one or more SubVaults from this Vault.

LOCAL

reclaimChild

Reclaim from SubVault

Return an amount from a SubVault to this Vault.

REMOTE

destroyChild

Destroy SubVault

Drain a SubVault's balance to this Vault and permanently disable its multisig. Irreversible.

REMOTEIrreversible

enableChildMultiSig

Toggle SubVault Multi-sig

Enable or disable a SubVault running its own proposals.

REMOTE

Deleting a proposal is not a separate action. The app creates a zero-effect proposal that reuses the target nonce, cancelling the original once approved. Not available for Create SubVault.

A SubVault is a vault owned by another vault, used to separate funds into compartments the owning Vault controls. Nesting is limited to one level.

1. 1

   Create

   On a top-level vault, open SubVaults and select Create SubVault. Owners and threshold are prefilled from the Vault. Propose it, have the Vault owners approve, then execute to initialize the SubVault.

   
2. 2

   Fund and reclaim

   Allocate to SubVaults sends MINA to SubVaults. Reclaim from SubVault returns an amount to the Vault, capped at the SubVault balance.

   
3. 3

   Autonomy

   Toggle SubVault Multi-sig controls whether a SubVault can run its own proposals. When disabled, the SubVault is controlled only by its Vault; Vault-authorized actions still apply.

   
4. 4

   Destroy

   Destroy SubVault drains the SubVault to its Vault and permanently disables it. The action is irreversible and requires confirmation.

   

To keep an owner key on a machine that is never online, use air-gapped signing. Propose, approve, and execute each offer an Online and Offline option.

1. 1

   Name the signer

   On the Offline tab, enter the Signer Address (Fee Payer): the public key of the key held on the offline machine. No wallet connection is required.

   
2. 2

   Get the CLI

   Under Instructions, download mina-guard-cli for your platform and verify it against the published SHA256SUMS.

3. 3

   Export the bundle

   Select Export Bundle. The app downloads a JSON file describing exactly what will be signed, and warns of any fee-payer balance or account-creation costs.

4. 4

   Sign it offline

   Transfer the bundle to the offline machine and run:

   MINA_PRIVATE_KEY=EK… ./mina-guard-cli bundle.json > signed.json

   The CLI prints a readable summary and requires you to type y before signing.

5. 5

   Broadcast

   Return signed.json to an online machine and upload it. The app verifies it is bound to the correct vault and proposal, then broadcasts it.