Multisig on Solana: transparent but public
Multisig programs require M-of-N approvals recorded on-chain. Explorers show signer sets and pending transactions—valuable for auditors, potentially sensitive for operational security. Rotation means updating on-chain permissions with another approved transaction. Committees like the evidentiary clarity; security teams worry about address graph exposure.
MPC: private signing, vendor-dependent logs
MPC splits key material so no single party holds a full private key. Signing occurs in coordinated sessions, often logged in vendor systems rather than entirely on-chain. Auditors rely on ceremony records, HSM attestations, and SOC reports. Ask vendors how logs map to specific Solana transaction signatures your reconciliation team can match.
Incident response comparison
If a signer is compromised, multisig rotation is an on-chain action visible to the world. MPC rotation may happen inside vendor infrastructure with less public visibility. Your incident runbook should define notification timelines for each model and who holds break-glass authority.
Latency and staking operations
Staking delegation and reward harvesting may require frequent signatures. MPC vendors often optimise for programmatic co-signing within policy limits; multisig may introduce manual approver bottlenecks unless you automate with strict guardrails. Neither model removes the need for human approval on anomalous destinations.
RFP questions that surface real differences
- Provide a sample audit trail linking an internal ticket to a Solana signature.
- Describe signer onboarding and offboarding SLAs for each model you offer.
- How are policy changes versioned and who can approve whitelist updates?
- What happens to client assets if your firm enters insolvency proceedings?
See glossary entries for MPC and multisig. Our flagship custody briefing includes a comparison worksheet you can attach to RFP appendices.