# `gno.land/p/nym-moultest123/safe`

> 🚧 **API sketch, mostly unimplemented.** 13 of the 22 functions
> `panic("not implemented")`, including every proposal path. It compiles and
> its shape is testable; it does not work.

A Gnosis-Safe-shaped multisig interface for gno: an m-of-n set of members, a
queue of proposals, and explicit approve / execute / cancel.

## What runs today

```go
func NewSafe() Safe          // 1-of-1, owned by the calling realm's address
func (s safe) Name() string
func (s safe) Members() []address
func (s safe) Threshold() uint
func (s safe) Size() uint
```

## What panics

Everything that would make it a multisig: `ProposeAddingMember`,
`ProposeRemovingMember`, `ProposeUpdatingThreshold`, `GetProposal`,
`ApproveProposal`, `ExecuteProposal`, `CancelProposal`, `NextProposal`,
`UpcomingProposals`, `PreviousProposals`, `Render`, and both `String` methods.

## The shape being proposed

The interesting decision is that membership changes are themselves proposals,
so there is one code path for "do a thing" and no privileged side door for
"change who may do things". `Proposal` exposes `Executed()` and `Voters()`, and
proposals are split into upcoming and previous rather than a single log, which
is what a UI actually needs.

For multisig that works today, use the tm2 account-level multisig
(`gnokey multisign`), not this.

<!-- BEGIN GNOCONTRACTS FOOTER (generated by `make readmes`; do not edit below) -->

---

Part of **[moul/gno-contracts](https://github.com/moul/gno-contracts)** — moul's versioned gno.land contracts. See the repository for the full catalog, build/test tooling, and usage.

> ⚠️ **Disclaimer:** provided as-is, without warranty; not security-audited. Full disclaimer: [DISCLAIMER](https://github.com/moul/gno-contracts/blob/main/DISCLAIMER.md).

<!-- END GNOCONTRACTS FOOTER -->