# Multisig and security questions

**URL:** <https://bisq.community/t/multisig-and-security-questions/589>\
**Category:** Development\
**Created:** [September 1, 2016, 10:33am UTC](https://bisq.community/t/multisig-and-security-questions/589 "2016-09-01T10:33:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![BitConcerned](https://bisq.community/letter_avatar/bitconcerned/32/6_22734026db12803ebb3e059622ac3534.png) [@BitConcerned](https://bisq.community/u/BitConcerned)\
**Post date:** [September 1, 2016, 10:33am UTC](https://bisq.community/t/multisig-and-security-questions/589/1 "2016-09-01T10:33:19Z")

</div>

After reading the White paper and arbitration process docs, I’m left a bit confused and concerned about ‘multisig’ and escrow addresses.

Does the escrow address actually ‘exist’ in the Bitcoin network?

Who ‘owns’ the escrow address during a buy/sell contract?

The arbiter seems to have an awful lot of _control_ over the escrow address! He can issue refunds, partial refunds, split refunds etc. Why/how is that? If the address is a 2 of 3, then it seems the buyer and seller have pre-signed (pre-agreed) to some things ‘behind the scenes’ i.e. from within the bitsquare client without being told _explicitly_ what they are.

I’d like to know what these things are?

Can the arbiter withdraw the funds to his own address?

---

<div class="post-metadata">

**Author:** ![marc](https://bisq.community/letter_avatar/marc/32/6_22734026db12803ebb3e059622ac3534.png) [@marc](https://bisq.community/u/marc)\
**Post date:** [September 1, 2016, 5:01pm UTC](https://bisq.community/t/multisig-and-security-questions/589/2 "2016-09-01T17:01:01Z")

</div>

> [@BitConcerned](#):
>
> Does the escrow address actually ‘exist’ in the Bitcoin network?

It does.

> [@BitConcerned](#):
>
> Who ‘owns’ the escrow address during a buy/sell contract?

Buyer, seller and escrower, each hold a key to a 2 of 3 multisig adress.

> [@BitConcerned](#):
>
> I’d like to know what these things are?

Hypothetically speaking, the arbiter + either buyer or seller could release the funds to any address. You need two private keys to move the funds. The funds could be moved to several addresses just like with any transaction. That is not intended in the Bitsquare software, where this happens in the background to keep the process clean and simple.

The transactions aren’t pre-signed. They are signed when you click confirmation buttons in the client.

---

<div class="post-metadata">

**Author:** ![BitMasterSquare](https://bisq.community/letter_avatar/bitmastersquare/32/6_22734026db12803ebb3e059622ac3534.png) [@BitMasterSquare](https://bisq.community/u/BitMasterSquare)\
**Post date:** [September 1, 2016, 9:26pm UTC](https://bisq.community/t/multisig-and-security-questions/589/3 "2016-09-01T21:26:54Z")

</div>

On a related note, I was thinking, having one arbitrator with one critical key seems a bit risky… what if he / she dies when a large transaction is being disputed? I think a better approach might be 3 of 4 … that is; buyer, seller and two arbitrators

---

<div class="post-metadata">

**Author:** ![marc](https://bisq.community/letter_avatar/marc/32/6_22734026db12803ebb3e059622ac3534.png) [@marc](https://bisq.community/u/marc)\
**Post date:** [September 2, 2016, 8:51am UTC](https://bisq.community/t/multisig-and-security-questions/589/4 "2016-09-02T08:51:11Z")

</div>

> [@BitMasterSquare](#):
>
> what if he / she dies when a large transaction is being disputed?

Oh, wow quick escalation here 🙂 You’re right for the moment, but when the arbitration is fully implemented, there will be safety nets. Edit: Risk is reduced by trade limits.

I’d like to point out here: Risk mitigation is taken care of in all of the protocol. It’s the combination of methods, that makes Bitsquare safe. Arbitrator interaction is only the last line of defense when something goes wrong. At the moment it’s almost exclusively bug reporting or people not following the protocol. Scam attempts haven’t happened so far.

---

<div class="post-metadata">

**Author:** ![BitMasterSquare](https://bisq.community/letter_avatar/bitmastersquare/32/6_22734026db12803ebb3e059622ac3534.png) [@BitMasterSquare](https://bisq.community/u/BitMasterSquare)\
**Post date:** [September 2, 2016, 9:07am UTC](https://bisq.community/t/multisig-and-security-questions/589/5 "2016-09-02T09:07:17Z")

</div>

I understand. If it’s not too much trouble, what is the vision of how arbitration will work?