multisig: Pinocchio Solana program

AvhiMaz/multisig is a Solana multisig program written in Pinocchio. No allocator. Zero-copy account layouts. An owner proposes a transaction. Owners vote. Once approvals hit the threshold, anyone may execute. Owner and threshold changes are ordinary proposals against this program. They cost the same threshold as a spend.

Program ID in source: 4X5zUZ8apTxg8XJSwyxCR6TpDbLFBxm9TjECocLTKpAm. Crate multisig 0.1.0. Default branch master.

Same shape as Squads V4, not the same product. create_key seeds the PDA. Vaults are indexed. Members have initiate, vote, and execute bits. Config is an ordinary proposal. Time lock. Compiled message plus address lookup tables. The repo never names Squads. This is Pinocchio, no allocator, max 10 owners, program 4X5zUZ8…. Squads stays SQDS4…. Do not treat them as interchangeable. Keep Squads multisig and Grid.

Accounts

Multisig PDA ["multisig", create_key]. Transaction PDA ["transaction", multisig, index]. Vault PDA ["vault", multisig, vault_index]. Buffer PDA ["buffer", multisig, creator, index]. Ephemeral signer PDA ["ephemeral", transaction, index], max 4. Max owners 10. That bound is baked into account length. Max time lock three months of seconds. Max compiled message 4096 bytes. Max accounts on one inner instruction 32.

Init is the only instruction a plain wallet signs. Accounts: creator (payer), create_key (signer seed), the new PDA, System Program. Owners array is full width, first owners_count used, strictly ascending. Threshold in 1..=owners_count.

Proposals

A proposal holds a compiled message in Solana wire format: deduplicated keys, instructions by index, address lookup tables. Lookup tables are resolved and verified on-chain. One approval can settle several CPIs atomically. The vault signs, or ephemeral PDAs derived from the proposal, so created accounts can sign for themselves. Messages too large for one tx upload in chunks against a length and SHA-256 committed up front.

Instruction bytes from entrypoint.rs: 0 init, 1 create transaction, 2 approve, 3 reject, 4 execute, 5 cancel, 6 close transaction, 7 buffer create, 8 buffer extend, 9 buffer close, 10 create from buffer. Config actions inside a self-targeted proposal: add/remove owner, change threshold, change time lock, set rent collector, set permission, close multisig. Permission bits: initiate 1, vote 2, execute 4.

Client and CU

Feature client builds off-chain instruction helpers. The on-chain program does not link that module. Tests drive the program through the client, not hand-rolled bytes. Mollusk SVM benches on 4 Sep 2026, Agave 4.2.1: init 1725 CU, create transaction 2248, approve 420, execute transfer 3785, execute two transfers 6697, buffer extend 153.

cargo test
cargo bench --bench compute_units

# client feature for builders
multisig = { git = "https://github.com/AvhiMaz/multisig", features = ["client"] }

Resources

• github.com/AvhiMaz/multisig
• Pinocchio
• @avhidotsol