FluidRWA Learn
Safe Wallet Tutorial: A Testnet Treasury Approval Workflow
What this treasury rehearsal proves
You will create a new two-of-three Safe account on Ethereum Sepolia and send 0.0001 test ETH to a separate test recipient. Signer A prepares and signs, signer B independently checks and signs, and an executor broadcasts the approved operation. Signer C is a reserve participant for the availability drill. This is the standard threshold path without spending-limit modules, recovery modules or automation.
A Safe is a smart-contract account, not another name for a signer's wallet. Its address holds the test treasury balance. The signer wallets authorize actions; a wallet broadcasting execution also needs test gas in the basic execution path. Two signatures are not the same as an executed payment.
Validation boundary: this guide is researched against current Safe help, but no authenticated Safe deployment or signer ceremony is claimed. The diagram and example amounts are instructions, not evidence of a completed on-chain run. Record your own acceptance evidence below.
Before you start
Use the official Safe web app, a desktop browser, three test-only signer wallets A/B/C with distinct addresses, and a separate recipient address R. Ideally three people use independently controlled devices. One person may rehearse with test wallets, but three accounts under one recovery phrase or one device are not meaningful organizational separation. Never reuse production recovery phrases.
Make test networks visible in your signer wallet, select Ethereum Sepolia (chain ID 11155111), and obtain free test ETH through the network's official faucet references. Fund the deploying signer and intended executor for gas, and keep extra test ETH to deposit in the Safe. Do not buy assets, connect a live treasury, or use Ethereum mainnet. Faucet limits or missing Sepolia support are stop conditions, not reasons to switch to mainnet.
Write a short approval brief before opening the app: purpose = treasury drill; network = Sepolia; asset = test ETH; amount = 0.0001; recipient = full R address; signers = A/B/C; threshold = 2; modules = none added for this exercise. Confirm R through a trusted channel independent of transaction history.
Step 1: Open the official app and select Sepolia
Start at app.safe.global through Safe's official creation guide. Check the domain before connecting signer A. Enable testnets in the app's network selector/settings if necessary and choose Sepolia. Check the wallet network too; matching address text on different chains does not mean the account or balance is the same.
Choose Create new account or the current equivalent. Name it FluidRWA treasury drill - Sepolia. The label is for your convenience, not an on-chain identity or proof of ownership. If the app does not offer Sepolia for your account/version, stop and consult current Safe documentation rather than substituting a chain silently.
Step 2: Enter three signers and a threshold of two
Add the full public addresses of A, B and C. Compare each complete address with the corresponding signer on that person's device. Do not copy signers from transaction-history suggestions or accept an unverified address replacement from a message. Set the confirmation threshold to 2 of 3.
Ask each participant to confirm which address they control before continuing. Two-of-three permits one unavailable signer, but not two. A duplicate address, inaccessible key or wrong threshold can make the exercise unusable. You cannot simply reset the threshold without the existing authorization required by the Safe.
Review all settings together. Do not enable spending limits, modules, guards or optional recovery paths for this lab. Some extensions introduce alternate authorization paths; a threshold alone does not describe every possible permission in a configured treasury.
Step 3: Deploy now and verify the account
For this multisigner exercise choose immediate deployment, paying only Sepolia test gas. Do not depend on a sponsored or pay-later path; availability varies and Safe's current help distinguishes single-signer gasless creation from multisig setup. Reject any wallet confirmation on mainnet or involving an unexpected asset or purchase.
Review the deployment transaction in signer A, submit on Sepolia and wait for a successful receipt. Save the Safe address, deployment hash and network. Reopen the account in the Safe app and inspect Settings / signers or owners to confirm A/B/C and threshold 2. The deployed account's state matters, not only the values entered into the creation form.
Expected result: a deployed Sepolia Safe with three intended signers and threshold two. A counterfactual address shown before deployment is not sufficient for this checkpoint. If deployment fails, inspect the receipt and signer test-ETH balance before retrying.
Step 4: Deposit a small test treasury balance
Copy the Safe's receiving address from the Sepolia account. From a test wallet send a small amount such as 0.001 test ETH to that address on Sepolia, keeping enough in the executor's separate wallet for gas. Check the full address and network before sending. This is a deposit into the Safe, not an approval transaction.
Wait for the successful Sepolia receipt, then check the Safe asset balance. Record the starting Safe balance and recipient R balance. Do not proceed until the Safe has more than 0.0001 test ETH. A deposit on another network does not fund this Sepolia Safe; never bridge or buy assets to rescue a training exercise.
Step 5: Propose the transfer as signer A
In the Safe choose New transaction, then Send tokens or the current equivalent. Select native ETH on Sepolia, enter R and 0.0001. Add a reference such as Treasury drill 01 where the interface supports a description. Do not select a token allowance, swap, batch, arbitrary contract call or Transaction Builder for this simple exercise.
Compare the review screen with your approval brief: Safe address, network, recipient, amount, asset and current Safe nonce. For a plain native transfer you should not see instructions changing signers, threshold, implementation, modules or token approvals. Unexpected delegate-call or security warnings require you to stop and understand the payload; a green check is not an independent guarantee either.
Sign with A to propose/confirm and leave the transaction in the queue. If offered combined sign-and-execute, do not execute yet. Expected result: one of two required confirmations and no recipient balance increase. Record the Safe transaction identifier/hash and nonce. This Safe transaction hash is not the eventual blockchain execution hash.
Step 6: Independently approve as signer B
Signer B opens the official app independently, connects their own wallet and opens the same Sepolia Safe. In Transactions / Queue, expand the pending operation and compare it with the approval brief obtained outside the queue. Check the full recipient, asset, amount, network, nonce and decoded action; do not approve only because A says the transaction is ready.
B signs only after that comparison. Use a separate confirmation without execution if the UI offers it, so you can observe the state change. The queue should now indicate that the two-signature threshold is satisfied, but the transfer is not complete until execution. If the interface combines B's signature and execution, inspect both stages and record that you did not observe a separate ready-to-execute pause.
A signer confirmation is commonly an off-chain signature coordinated by the transaction service; it must not be confused with an ERC-20 spending approval. Preserve the agreed transaction details in your evidence, not private keys or recovery words.
Step 7: Execute and reconcile the receipt
Select Execute on the threshold-approved transaction using the basic wallet-paid execution path. Confirm the executor wallet is on Sepolia and has test ETH. Review any gas estimate and the operation again. Do not purchase a subscription or authorize a mainnet fee to finish this lab. Sponsorship or relay features are not assumed.
After submission, wait for the execution receipt. Save its chain transaction hash separately from the Safe transaction hash. Verify success on the Sepolia explorer, confirm that the intended Safe operation succeeded rather than merely seeing an outer transaction included, and check that the Safe history records the transfer as executed.
With no other activity, R should increase by 0.0001 test ETH and the Safe should decrease by 0.0001. In the basic wallet-paid path the executor pays gas separately, so its balance also falls. If your actual configuration displays Safe-paid gas/refunds or a sponsored path, record that difference rather than forcing these balances to match. The Safe nonce should advance by one after successful execution.
Step 8: Rehearse signer unavailability safely
Before proposing another payment, have B disconnect without deleting keys or changing the signer set. A alone must not meet the two-signature requirement for a new standard transaction. This is a check on a new operation: disconnecting B does not invalidate a signature B already supplied for an earlier operation.
Have C connect and confirm the Safe is visible with the expected signer set. If you want an on-chain availability rehearsal, create a second tiny transfer with a fresh nonce, approve with A and C, then execute and record it as a second payment. Do not mistake it for a retry of drill 01. With B and C both unavailable, stop; the standard threshold cannot be met by A alone.
Do not lower the threshold to bypass an unavailable reviewer. A threshold change is itself a governed on-chain action. Document recovery and signer replacement separately before any production deployment.
| Availability | Expected standard-path result |
|---|---|
| A only, new transaction | One confirmation is insufficient. |
| A + B or A + C | Two distinct valid signer confirmations can meet the threshold. |
| B disconnected after signing | Existing signature is not revoked by disconnecting. |
| Two signers unavailable | Cannot reach threshold without a separately configured authorized recovery path. |
Step 9: Understand rejection before rehearsing it
A queued signature cannot reliably be taken back by disconnecting a wallet or deleting a local entry. For a deliberate cancellation drill, propose a separate tiny test transfer and leave it unexecuted. Use the queue's Reject flow, review the cancellation with the same Safe nonce, collect the required threshold and execute the cancellation on Sepolia. This also consumes test gas.
Only after the cancellation succeeds on-chain at that nonce should you regard the original operation as no longer executable at that nonce. An off-chain deletion or a rejection signature alone is not equivalent. Do not approve competing operations casually: whichever valid operation executes first consumes the nonce. Stop if the original has already executed; a confirmed transfer is not reversed by rejection.
Troubleshooting without bypassing approval
| Problem | Safe next step |
|---|---|
| Signer cannot see the Safe | Check the full Safe address, Sepolia selector and connected signer; add/open the existing account rather than deploying another. |
| Enough signatures, but no receipt | Check whether execution was submitted, executor test ETH and earlier queued nonces. Threshold approval alone does not broadcast the transfer. |
| Execution reverts | Inspect the actual receipt, Safe balance, nonce and decoded operation. A failed call may still cost gas; do not send another payment until reconciled. |
| Unexpected contract/settings warning | Stop signing. Compare raw/decoded data and verify with the other signers through a trusted channel. |
| Queue or service unavailable | Do not infer the payment failed or use an unfamiliar recovery website. Preserve transaction IDs and check chain state through official tooling. |
| Wrong address or wrong chain | Do not repeat. Verify whether the transaction executed; recovery may not be possible. This is why the lab uses only test assets. |
Acceptance evidence and handoff
Keep the following evidence in a shared review record without secrets. Screenshots may help explain states but should be redacted and accompanied by public addresses/hashes and timestamps. An illustration, queue label or signature count is not a substitute for the final receipt.
A successful testnet rehearsal is not a production security certification. Before using real treasury assets, assess independent signer custody, incident ownership, transaction-data verification, backups, enabled modules, recovery, monitoring and organizational approval policy. Do not buy a production plan or move real funds as part of this guide.
| Evidence | Required result |
|---|---|
| Account record | Sepolia chain ID, Safe address, deployment receipt, three checked signers, threshold 2. |
| Approval brief | Exact recipient R, 0.0001 test ETH, purpose and expected nonce. |
| Approval trail | A and B independently reviewed the same Safe transaction; approval distinguished from execution. |
| Execution | Chain hash, successful Safe operation, recipient delta and incremented nonce. |
| Gas accounting | Record who actually paid test gas and distinguish it from the transfer amount. |
| Availability/cancellation | Document observed drill states; explicitly mark any optional cancellation not run. |
FAQs
Is two-of-three always the best setup?
No. It is an illustrative threshold for this rehearsal. Production choices depend on signer independence, availability, recovery, threat model and operating policy.
Does disconnecting a signer cancel their approval?
No. It does not revoke an already supplied signature. A successful competing cancellation at the same Safe nonce is different from removing a local queue entry.
Must I buy ETH or a Safe plan?
No. Use Sepolia test ETH and the basic execution path. If a faucet or product-access restriction blocks you, record the limitation and stop without purchasing assets or services.