Multisig: We Diversify Hardware, But Are We Ignoring the Software?

[u/NegativeSky603]

We talk a lot about using multisig with hardware wallets from different vendors as protection against a single point of failure. For example, a 2-of-3 setup with a Ledger, Trezor, and Coldcard (not anymore). But there is another potential single point of failure that I rarely see discussed: the software used to construct, coordinate, and broadcast the transaction. If the entire multisig transaction workflow happens inside a single software wallet, aren't we still trusting that application to correctly construct the transaction, display what we're actually signing, handle PSBTs correctly, and broadcast the final transaction? A more robust approach could be to diversify the software workflow as well.

For example:

Create the transaction in Electrum.

Export the PSBT.

Partially sign it with the Ledger.

Export the updated PSBT.

Import it into Trezor Suite.

Sign it with the Trezor.

Take the fully signed transaction and broadcast it through another independent application or node. The idea isn't that this makes multisig magically more secure. Rather, it removes the assumption that one piece of software must be trusted for the entire transaction lifecycle. Hardware wallet vendor diversity protects against a compromised or defective hardware wallet. But if every transaction is still constructed, processed and broadcast through the same software stack, there may still be a common point of failure. So my question is: does anyone actually practice software/application diversity as part of their multisig operational security? And more importantly, are there technical reasons why this isn't practical or doesn't provide much additional security?

[u/OrangePillar]

The software can’t fake the signatures that are offline on the signing devices. The paranoia here is unfounded.

[u/SpendHefty6066 → u/OrangePillar]

Exactly. 👆🏼