Keep approval and execution tied together
By the end, explain the diagram in your own words, solve the case and justify the correction.
Prerequisites : Hot, warm and cold wallets · Multisig: policy, backups and recovery
Level 2 · Intermediate →Reading path · 31 / 35 · Intermediate
A withdrawal joins client intent, asset availability and signing authority.
The essentials
A withdrawal joins client intent, asset availability and signing authority. Check network, asset identity, destination and amount before approval. Bind the approval to the exact payload; approving an instruction that can subsequently change leaves a gap between the decision and the signature.
How it works
Beneficiary changes deserve their own controls. Separate adding an address from releasing funds to it. Depending on the service design, independent verification, a cooling-off period and transaction limits can reduce the consequences of a compromised account. Document exceptions rather than allowing an undocumented bypass.
What to watch
Track replay protection and retries. An uncertain API response does not prove that no transaction was sent. Use a stable instruction identifier and inspect the existing transaction state before generating another payment. Reconcile network fees separately from the amount attributed to the recipient.
Build your analysis
Treat an approval as permission for a specific instruction, not a reusable permission to spend. The approved record should bind the destination, network, asset and amount, with fees handled under an explicit policy. If a material field changes, the workflow should detect that the existing approval no longer covers the revised instruction.
Extend the workshop
Design three negative tests: change the beneficiary after approval, submit the same instruction twice and remove an approver’s access before signing. Describe the expected stopped state and the evidence showing why it stopped. Then explain how an authorised operator can resolve the exception without silently bypassing the original control.
Understand the details
A useful evidence chain records the requested destination, independent validation, approved payload, signer policy, transaction identifier and final ledger result. Failed screening or an unrecognized destination should have an assigned review path. This is a teaching control model, not a substitute for a service-specific compliance policy.
Boundaries and common mistakes
Multiple signatures cannot correct a wrong destination when every signer approves the same misleading display. Address validation must compare the full identifier and correct network.
The mechanism at a glance
- Validate intent
- Approve payload
- Sign once
- Reconcile outcome
Apply the lesson to a case
An operator changes a beneficiary after approval to fix a supposed typo. The amount is unchanged. A second operator asks whether the original approval can be reused. Describe the evidence that should be retained and the checks that must restart.
A destination change changes the authorized action. Preserve the original audit trail, explain the amendment and require the applicable independent checks before signing.
Prepare a correction note
Describe the passage and the proposed correction. This creates a local note for you to share; it sends nothing. Do not include personal or confidential information.