Citadel Protocol — Offline M-of-N Multisig Approval

Citadel provides air-gapped M-of-N approval on all 22 supported networks, including those that have no native multisig of their own. It is included in the Nyxor edition.

What enforces the threshold

Each approval is a secp256k1 signature over a digest of the exact transaction, made with a per-device identity key. Finalisation verifies every signature rather than counting them. The threshold is enforced by XColdPro on the user’s own devices, not by the blockchain — which is precisely what allows one workflow to run on every supported chain, since the network sees an ordinary transaction.

How coordination works

Cosigners exchange proposals and approvals offline, by QR code or USB. There is no server, no API, and no smart contract in the path.

What it is not

Anyone holding the seed can still spend outside XColdPro. Citadel is governance over how funds move within the software, not a custody-level lock enforced by the chain. For a chain-enforced threshold, the Bitcoin-only BTC Edition builds a P2WSH vault that Bitcoin consensus itself validates.