.. _sphx_glr_api_gallery_contracts_wallets:

Multisig wallets
----------------

The two Parity incidents: a wallet re-initialized, and a library destroyed.


.. raw:: html

  <div id='sg-tag-list' class='sphx-glr-tag-list'></div>


.. raw:: html

    <div class="sphx-glr-thumbnails">

.. thumbnail-parent-div-open

.. raw:: html

    <div class="sphx-glr-thumbcontainer" tooltip="Parity&#x27;s multisig wallet kept its logic in a shared library. Each wallet was a small stub holding the ether and the storage, which forwarded every unknown call to the library with DELEGATECALL: the library&#x27;s code ran on the wallet&#x27;s storage, as the wallet.">

.. only:: html

  .. image:: /api/gallery/contracts/wallets/images/thumb/sphx_glr_plot_01_parity_multisig_hack_thumb.png
    :alt:

  :doc:`/api/gallery/contracts/wallets/plot_01_parity_multisig_hack`

.. raw:: html

      <div class="sphx-glr-thumbnail-title">The Parity multisig hack: an unprotected initializer (July 2017)</div>
    </div>


.. raw:: html

    <div class="sphx-glr-thumbcontainer" tooltip="After the July hack, Parity deployed a fixed library whose initWallet runs only on uninitialized storage. Every wallet initialized itself at deployment, so no wallet could be taken over again. But the library was a contract too, with storage of its own, and nobody had initialized it.">

.. only:: html

  .. image:: /api/gallery/contracts/wallets/images/thumb/sphx_glr_plot_02_parity_library_freeze_thumb.png
    :alt:

  :doc:`/api/gallery/contracts/wallets/plot_02_parity_library_freeze`

.. raw:: html

      <div class="sphx-glr-thumbnail-title">The Parity library freeze: selfdestruct behind DELEGATECALL (November 2017)</div>
    </div>


.. thumbnail-parent-div-close

.. raw:: html

    </div>


.. toctree::
   :hidden:

   /api/gallery/contracts/wallets/plot_01_parity_multisig_hack
   /api/gallery/contracts/wallets/plot_02_parity_library_freeze