Admin pause or freeze powers
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
Funds at rest cannot be frozen: the account Safe has no guard, its only modules are the user's Delay and Roles modifiers, and Gnosis Pay holds no key over them. Card settlement is different. Every card spend is Spender.spend(), which only an enabled delegate can call, and the one delegate is EOA 0x9c48bc73... A single EOA can stop or selectively withhold settlement, which meets anchor 0 on its own. The delegate list is controlled by spender Safe 0x896a695d... It is 2-of-3, its three EOA signers are not named in any document I found, it has no guard, and there is no timelock (the documented user exit is 3 minutes). It misses every anchor-2 condition. Module check (red team R7): the spender Safe's only module is the spender modifier itself (avatar = target = owner = the Safe). Through it, one delegate key can make the Safe call execTransactionWithRole on any account it names. The inner payload is fixed to token.transfer(receiver, amount), the modifier's generic exec functions are emptied, and changing delegates, owners or settings still needs 2 signatures. On user accounts the payload is limited by each account's Roles scope, read from the setup events (see S1): one token, receiver = settlement Safe 0x4822521E..., amount within the daily allowance. So the module does bypass the 2-of-3 threshold, but only to pull up to each account's remaining allowance into Gnosis Pay's settlement Safe. Separately, the Terms let Gnosis Pay block an individual card on Monavate's instruction. The EOA-held delegate (verified) and the card-block power (documented) each meet anchor 0.
Evidence (10)8 verified · 2 documented
- Verified
Account setup swaps the Safe owner to 0x...02, enables only the Roles and Delay modifiers, and hands Roles ownership to a Bouncer; no pause, freeze or blacklist function is configured anywhere in the account.
gnosispay/account-kit · src/entrypoints/accounts-actions/accountSetup.ts
- Verified
Spender modifier owner() is the Gnosis Pay spender Safe 0x896a695d5cCDd21F9e3Bb18307a558befCCb8428 (2-of-3 EOAs, no timelock), which can enable or disable the delegate keys that execute every card spend; its only enabled delegate is EOA 0x9c48bc73841FD98456cB52f8A28580266d74d4df.
- Verified
Spender Safe getThreshold() = 2 with owners 0x2FD460fD9aE6d71ee3231DfB827B85FCeC31Fa4f, 0x09Ab2E7F1E40D2Becc7da265f147aA7aaDd3d141, 0x9F7dfAb2222A473284205cdDF08a677726d786A0 (all EOAs, no code at block 48629765); I found no document naming who holds these keys.
- Verified
Spender Safe getModulesPaginated(0x1,10) returns exactly one module, 0x5f07734E2B9C4dE6f9C32253d485741800da3F8a (the spender modifier, whose avatar(), target() and owner() are all this Safe); isModuleEnabled(0x5f07...) = true.
- Verified
Spender Safe guard slot 0x4a204f62...c34c8 is zero (no transaction guard); fallback handler slot holds the Safe 1.3.0 CompatibilityFallbackHandler 0xf48f2B2d2a534e402487b3ee7C18c33Aec0Fe5e4. No timelock contract sits between the Safe and the spender modifier.
- Verified
Spender modifier getModulesPaginated(0x1,10) returns one delegate, 0x9c48bc73841FD98456cB52f8A28580266d74d4df; isModuleEnabled(0x9c48...) = true. Any one enabled delegate can call spend() with no Safe signature.
- Verified
The spend delegate 0x9c48bc73... has no code and nonce 0 at block 48629765, so it is a single EOA key that signs offchain; spends are submitted by relayer EOA 0x90830Ed558f12D826370DC52E9D87947A7F18De9.
- Verified
setUp sets avatar = target = owner; execTransactionFromModule and execTransactionFromModuleReturnData are overridden with empty bodies; spend() (moduleOnly) makes the target Safe call account.execTransactionWithRole(asset, 0, transfer(receiver, amount), Call, roleKey, true), with account, receiver, amount and roleKey chosen by the delegate.
- Documented
Terms of Service say that if Monavate tells Gnosis Pay not to fund a card transaction from the Safe, or to block the card, Gnosis Pay will act on it without liability; elsewhere they let Gnosis Pay suspend services or account access with or without notice.
- Documented
Terms of Service document the user exit delay as 3 minutes on non-card transactions from the Safe (the Delay modifier cooldown, 180 s onchain).