An independent on-chain researcher has identified a structural overlap in multisig governance across two major DeFi protocols: a single signer holds keys in both Aave's Governance Guardian Safe and DeFi Saver's admin multisig. The finding, verified through direct on-chain inspection of Safe ownership structures, raises questions about concentration of control and the visibility gaps in how protocols manage their privilege architecture. The researcher, operating outside any formal affiliation with either protocol, published their methodology openly on GitHub and provided a live dashboard for reproduction.
DeFi Saver's administrative Safe operates as a 3-of-6 multisig controlling the protocol's root vault operations, while Aave maintains its Governance Guardian as a 5-of-9 multisig—both configurations assume operational independence and segregated trusted parties. The overlap means at least one individual or entity signing for DeFi Saver protocol decisions also participates in Aave's governance checkpoints. Neither protocol's documentation explicitly acknowledges this connection, suggesting it emerged either organically through key reuse or remained undisclosed. The researcher emphasized this is a neutral structural observation rather than an accusation, but the implication is significant: key concentration across unrelated protocols creates unexpected dependency chains that can amplify risk if that signer becomes compromised or unavailable.
The methodology underlying this finding is rigorous and reproducible. Rather than relying on third-party indexers or APIs, the researcher executed getOwners() calls directly against Safe contracts, cross-referencing results against protocol documentation sourced from official GitHub repositories and permission registries. The broader project examined 339 protocols across 553 confirmed multisigs, reportedly identifying eight named individuals holding trusted signer roles across multiple unrelated systems. This suggests the DeFi Saver–Aave overlap is one instance of a wider pattern: governance fragmentation hasn't eliminated individual key holders accumulating influence across ecosystem boundaries, even as protocols ostensibly operate independently.
The finding exposes a gap between governance best practices and governance reality in DeFi. Multisig designs aim to distribute trust, but without explicit cross-protocol signer transparency, that trust distribution remains opaque to the broader ecosystem. Aave and DeFi Saver now face a choice: either formalize and justify the overlap if it's intentional, or evaluate whether key separation aligns better with their security posture. For the broader industry, this research demonstrates the need for standardized multisig disclosure frameworks that surface signer participation across protocols, transforming hidden structural risks into managed governance knowledge.