Search
Search for projects and tokens by name or address
SafeSafe
About
Safe is a multisig wallet: a contract account that executes transactions once enough of its owners have signed. This page covers Safe v1.3.0, v1.4.1 and v1.5.0, whose implementations are immutable and have no owner.
About
Safe is a multisig wallet: a contract account that executes transactions once enough of its owners have signed. This page covers Safe v1.3.0, v1.4.1 and v1.5.0, whose implementations are immutable and have no owner.
Each Safe account is a proxy of an immutable implementation with no owner, and keeps its own owners, threshold and settings. Anyone can create an account through any version’s factory, which sets it up in the same transaction when given setup data.
Transactions
A transaction executes once enough owners, the threshold, have signed it, and anyone can submit it. Signatures cover the account’s nonce, so a transaction cannot be replayed. A signature can come from a key, from a contract owner through EIP-1271, or from an onchain approval.
A transaction can also be a delegatecall, which runs another contract’s code inside the account. Safe’s libraries use this to batch transactions, deploy contracts and sign messages. A delegatecall can also rewrite the account’s settings.
Modules, guards and the fallback handler
- Modules can execute transactions without owner signatures. From v1.5.0, a module guard can check and reject them.
- A guard checks owner transactions and can reject them, including the one that would remove it. From v1.4.1 it must declare the guard interface, while v1.3.0 accepts any address, so a wrong one locks the account.
- The fallback handler answers calls the account does not implement. The default one lets the account receive ERC-721, ERC-1155 and ERC-777 tokens and answer EIP-1271 signature checks.
Upgrades
No upgrade applies to all accounts. Only an account’s owners, or a module they enabled, can move it to another implementation, through a delegatecall.
Offchain services
The Safe{Wallet} interface and the Safe transaction service, both run by Safe Labs, help owners collect signatures. They are optional: any tool that can call the account works.
L2Layer 2 (L2) is a category of technical solutions aimed to scale the base layer in a trust minimized way. This category includes solutions like rollups as well as state channels and plasma. Other solutions are able to scale further, but with the introduction of additional trust assumptions, which are therefore not trust minimized. Sometimes the term Layer 2 is used to refer to include these solutions too, like validiums and optimiums, but to distinguish between trust minimized and non trust minimized solutions they are often referred to as "light" L2s, opposed to "strong" L2s like rollups. variants
Each version’s L2 variant also emits an event for every executed transaction, so Safe activity can be indexed on chains without transaction tracing.
This project has no external dependencies: no oracle, bridge, or other third-party contract is required for its contracts to operate.
Ossification
Contracts our research team classifies as critical form the project's critical perimeter. Its clock starts at the ossification genesis, and every critical change resets it (changes within 24 hours count as one). The ossification score is the share of recorded code-bug exploits whose exploited code was younger than this perimeter is today. Battle-tested exposure is the value secured, summed over that unchanged period.
Discovery updates
2026 October 27, 09:29 UTC27changesInitial discovery of the canonical Safe v1.3.0, v1.4.1 and v1.5.0 deployments: the implementations and their L2 variants, the proxy factories, the fallback handlers, and the libraries accounts delegatecall into.
Initial discovery of the canonical Safe v1.3.0, v1.4.1 and v1.5.0 deployments: the implementations and their L2 variants, the proxy factories, the fallback handlers, and the libraries accounts delegatecall into.
Initial discovery
| + | Status: CREATED |
| contract SimulateTxAccessor_v1_5_0 (eth:0x07EfA797c55B5DdE3698d876b277aBb6B893654C) [safe/SimulateTxAccessor] | |
| +++ description: Library that Safe tooling delegatecalls from an account to simulate a transaction and estimate its gas. | |
| + | Status: CREATED |
| contract SafeProxyFactory_v1_5_0 (eth:0x14F2982D601c9458F93bd70B218933A6f8165e7b) [safe/SafeProxyFactory] | |
| +++ description: Deploys Safe accounts as proxies and, when given setup data, sets them up in the same transaction. A proxy deployed without it can be set up by anyone, and the first to do so chooses its owners. The factory has no owner and no control over the accounts it created. | |
| + | Status: CREATED |
| contract MultiSend_v1_5_0 (eth:0x218543288004CD07832472D464648173c77D7eB7) [safe/MultiSend] | |
| +++ description: Library that Safe accounts delegatecall to execute a batch of transactions, each a call or a delegatecall. | |
| + | Status: CREATED |
| contract SafeL2_v1_4_1 (eth:0x29fcB43b46531BcA003ddC8FCB67FFE91900C762) [GnosisSafe] | |
| +++ description: Same as the v1.4.1 implementation, but it also emits an event for every executed transaction, for indexing on chains without transaction tracing. | |
| + | Status: CREATED |
| contract CreateCall_v1_5_0 (eth:0x2Ef5ECfbea521449E4De05EDB1ce63B75eDA90B4) [safe/CreateCall] | |
| +++ description: Library that Safe accounts delegatecall to deploy contracts with CREATE or CREATE2. | |
| + | Status: CREATED |
| contract MultiSend_v1_4_1 (eth:0x38869bf66a61cF6bDB996A6aE40D5853Fd43B526) [safe/MultiSend] | |
| +++ description: Library that Safe accounts delegatecall to execute a batch of transactions, each a call or a delegatecall. | |
| + | Status: CREATED |
| contract SimulateTxAccessor_v1_4_1 (eth:0x3d4BA2E0884aa488718476ca2FB8Efc291A46199) [safe/SimulateTxAccessor] | |
| +++ description: Library that Safe tooling delegatecalls from an account to simulate a transaction and estimate its gas. | |
| + | Status: CREATED |
| contract GnosisSafeL2 (eth:0x3E5c63644E683549055b9Be8653de26E0B4CD36E) [GnosisSafe] | |
| +++ description: Same as the v1.3.0 implementation, but it also emits an event for every executed transaction, for indexing on chains without transaction tracing. | |
| + | Status: CREATED |
| contract CompatibilityFallbackHandler_v1_5_0 (eth:0x3EfCBb83A4A7AfcB4F68D501E2c2203a38be77f4) [safe/CompatibilityFallbackHandler] | |
| +++ description: Default fallback handler for Safe accounts: lets them receive ERC-721, ERC-1155 and ERC-777 tokens and answer EIP-1271 signature checks. It has no owner and no state. | |
| + | Status: CREATED |
| contract MultiSendCallOnly_v1_3_0 (eth:0x40A2aCCbd92BCA938b02010E17A5b8929b49130D) [safe/MultiSendCallOnly] | |
| +++ description: Like MultiSend, but the batch can only contain regular calls. | |
| + | Status: CREATED |
| contract Safe_v1_4_1 (eth:0x41675C099F32341bf84BFc5382aF534df5C7461a) [GnosisSafe] | |
| +++ description: Implementation of Safe v1.4.1 multisig accounts, which are proxies that delegatecall it. Accounts have M-of-N owners and optional modules, guard and fallback handler. Immutable and ownerless; it locks itself at deployment. | |
| + | Status: CREATED |
| contract SafeProxyFactory_v1_4_1 (eth:0x4e1DCf7AD4e460CfD30791CCC4F9c8a4f820ec67) [safe/SafeProxyFactory] | |
| +++ description: Deploys Safe accounts as proxies and, when given setup data, sets them up in the same transaction. A proxy deployed without it can be set up by anyone, and the first to do so chooses its owners. The factory has no owner and no control over the accounts it created. | |
| + | Status: CREATED |
| contract SignMessageLib_v1_5_0 (eth:0x4FfeF8222648872B3dE295Ba1e49110E61f5b5aa) [safe/SignMessageLib] | |
| +++ description: Library that Safe accounts delegatecall to mark a message as signed for EIP-1271 checks. | |
| + | Status: CREATED |
| contract SimulateTxAccessor_v1_3_0 (eth:0x59AD6735bCd8152B84860Cb256dD9e96b85F69Da) [safe/SimulateTxAccessor] | |
| +++ description: Library that Safe tooling delegatecalls from an account to simulate a transaction and estimate its gas. | |
| + | Status: CREATED |
| contract CreateCall_v1_3_0 (eth:0x7cbB62EaA69F79e6873cD1ecB2392971036cFAa4) [safe/CreateCall] | |
| +++ description: Library that Safe accounts delegatecall to deploy contracts with CREATE or CREATE2. | |
| + | Status: CREATED |
| contract MultiSendCallOnly_v1_4_1 (eth:0x9641d764fc13c8B624c04430C7356C1C7C8102e2) [safe/MultiSendCallOnly] | |
| +++ description: Like MultiSend, but the batch can only contain regular calls. | |
| + | Status: CREATED |
| contract CreateCall_v1_4_1 (eth:0x9b35Af71d77eaf8d7e40252370304687390A1A52) [safe/CreateCall] | |
| +++ description: Library that Safe accounts delegatecall to deploy contracts with CREATE or CREATE2. | |
| + | Status: CREATED |
| contract MultiSend_v1_3_0 (eth:0xA238CBeb142c10Ef7Ad8442C6D1f9E89e07e7761) [safe/MultiSend] | |
| +++ description: Library that Safe accounts delegatecall to execute a batch of transactions, each a call or a delegatecall. | |
| + | Status: CREATED |
| contract SignMessageLib_v1_3_0 (eth:0xA65387F16B013cf2Af4605Ad8aA5ec25a2cbA3a2) [safe/SignMessageLib] | |
| +++ description: Library that Safe accounts delegatecall to mark a message as signed for EIP-1271 checks. | |
| + | Status: CREATED |
| contract GnosisSafeProxyFactory (eth:0xa6B71E26C5e0845f74c812102Ca7114b6a896AB2) [safe/SafeProxyFactory] | |
| +++ description: Deploys Safe accounts as proxies and, when given setup data, sets them up in the same transaction. A proxy deployed without it can be set up by anyone, and the first to do so chooses its owners. The factory has no owner and no control over the accounts it created. | |
| + | Status: CREATED |
| contract MultiSendCallOnly_v1_5_0 (eth:0xA83c336B20401Af773B6219BA5027174338D1836) [safe/MultiSendCallOnly] | |
| +++ description: Like MultiSend, but the batch can only contain regular calls. | |
| + | Status: CREATED |
| contract SignMessageLib_v1_4_1 (eth:0xd53cd0aB83D845Ac265BE939c57F53AD838012c9) [safe/SignMessageLib] | |
| +++ description: Library that Safe accounts delegatecall to mark a message as signed for EIP-1271 checks. | |
| + | Status: CREATED |
| contract GnosisSafe (eth:0xd9Db270c1B5E3Bd161E8c8503c55cEABeE709552) [GnosisSafe] | |
| +++ description: Implementation of Safe v1.3.0 multisig accounts, which are proxies that delegatecall it. Accounts have M-of-N owners and optional modules, guard and fallback handler. Immutable and ownerless; it locks itself at deployment. | |
| + | Status: CREATED |
| contract SafeL2_v1_5_0 (eth:0xEdd160fEBBD92E350D4D398fb636302fccd67C7e) [N/A] | |
| +++ description: Same as the v1.5.0 implementation, but it also emits an event for every executed transaction, for indexing on chains without transaction tracing. | |
| + | Status: CREATED |
| contract CompatibilityFallbackHandler_v1_3_0 (eth:0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4) [N/A] | |
| +++ description: Default fallback handler for Safe v1.3.0 accounts: lets them receive ERC-721, ERC-1155 and ERC-777 tokens and answer EIP-1271 signature checks. It has no owner and no state. | |
| + | Status: CREATED |
| contract CompatibilityFallbackHandler_v1_4_1 (eth:0xfd0732Dc9E303f09fCEf3a7388Ad10A83459Ec99) [safe/CompatibilityFallbackHandler] | |
| +++ description: Default fallback handler for Safe accounts: lets them receive ERC-721, ERC-1155 and ERC-777 tokens and answer EIP-1271 signature checks. It has no owner and no state. | |
| + | Status: CREATED |
| contract Safe_v1_5_0 (eth:0xFf51A5898e281Db6DfC7855790607438dF2ca44b) [GnosisSafe] | |
| +++ description: Implementation of Safe v1.5.0 multisig accounts, which are proxies that delegatecall it. Accounts have M-of-N owners and optional modules, guards and fallback handler. Immutable and ownerless; it locks itself at deployment. | |
Ethereum
Library that Safe tooling delegatecalls from an account to simulate a transaction and estimate its gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources..
Deploys Safe accounts as proxies and, when given setup data, sets them up in the same transaction. A proxy deployed without it can be set up by anyone, and the first to do so chooses its owners. The factory has no owner and no control over the accounts it created.
Library that Safe accounts delegatecall to execute a batch of transactions, each a call or a delegatecall.
Same as the v1.4.1 implementation, but it also emits an event for every executed transaction, for indexing on chains without transaction tracing.
Library that Safe accounts delegatecall to deploy contracts with CREATE or CREATE2.
Library that Safe accounts delegatecall to execute a batch of transactions, each a call or a delegatecall.
Library that Safe tooling delegatecalls from an account to simulate a transaction and estimate its gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources..
Same as the v1.3.0 implementation, but it also emits an event for every executed transaction, for indexing on chains without transaction tracing.
Default fallback handler for Safe accounts: lets them receive ERC-721, ERC-1155 and ERC-777 tokens and answer EIP-1271 signature checks. It has no owner and no state.
Like MultiSend, but the batch can only contain regular calls.
Implementation of Safe v1.4.1 multisig accounts, which are proxies that delegatecall it. Accounts have M-of-N owners and optional modules, guard and fallback handler. Immutable and ownerless; it locks itself at deployment.
Deploys Safe accounts as proxies and, when given setup data, sets them up in the same transaction. A proxy deployed without it can be set up by anyone, and the first to do so chooses its owners. The factory has no owner and no control over the accounts it created.
Library that Safe accounts delegatecall to mark a message as signed for EIP-1271 checks.
Library that Safe tooling delegatecalls from an account to simulate a transaction and estimate its gasA virtual fuel used to execute smart contracts on a rollup. The EVM (or other VM within the rollup) uses an accounting mechanism to correspond the consumption of gas to the consumption of computing resources, and to limit the consumption of computing resources..
Library that Safe accounts delegatecall to deploy contracts with CREATE or CREATE2.
Like MultiSend, but the batch can only contain regular calls.
Library that Safe accounts delegatecall to deploy contracts with CREATE or CREATE2.
Library that Safe accounts delegatecall to execute a batch of transactions, each a call or a delegatecall.
Library that Safe accounts delegatecall to mark a message as signed for EIP-1271 checks.
Deploys Safe accounts as proxies and, when given setup data, sets them up in the same transaction. A proxy deployed without it can be set up by anyone, and the first to do so chooses its owners. The factory has no owner and no control over the accounts it created.
Like MultiSend, but the batch can only contain regular calls.
Library that Safe accounts delegatecall to mark a message as signed for EIP-1271 checks.
Implementation of Safe v1.3.0 multisig accounts, which are proxies that delegatecall it. Accounts have M-of-N owners and optional modules, guard and fallback handler. Immutable and ownerless; it locks itself at deployment.
Same as the v1.5.0 implementation, but it also emits an event for every executed transaction, for indexing on chains without transaction tracing.
Default fallback handler for Safe v1.3.0 accounts: lets them receive ERC-721, ERC-1155 and ERC-777 tokens and answer EIP-1271 signature checks. It has no owner and no state.
Default fallback handler for Safe accounts: lets them receive ERC-721, ERC-1155 and ERC-777 tokens and answer EIP-1271 signature checks. It has no owner and no state.
Implementation of Safe v1.5.0 multisig accounts, which are proxies that delegatecall it. Accounts have M-of-N owners and optional modules, guards and fallback handler. Immutable and ownerless; it locks itself at deployment.