LP-039: Lux Safe + Quasar Signer Pattern

Abstract

This LP fixes the canonical eight-signer set used with the luxfi/standard

Safe deployment. Every Lux mainnet/testnet/devnet Safe — and every

white-label Safe deployed on top of @luxfi/standard (Zoo, Hanzo, Pars,

Osage, …) — composes its owner set from this fixed registry. The list

is closed by design: one and only one way to express each signing

primitive.

Slots 7–9 form the Quasar consensus signer triad. Pulsar + Corona are

mandatory; Magnetar is gated by the enabled constructor flag and rejects

every signature when disabled. Renames from earlier prototypes: "Corona"

is gone — the canonical name is Corona.

Specification

Eight (+ optional ninth) signer set

Every Safe deployed with the Lux PaaS template registers the eight

mandatory signers as Safe owners. Magnetar registration is conditional

on the ENABLE_MAGNETAR deploy-time flag. Threshold m is chosen per

deployment and stored in the Safe itself.

Real public keys are supplied per-deployment via the matching factory

(SafeCoronaFactory, SafePulsarFactory, SafeMagnetarFactory, …).

Genesis deploys ship with deterministic placeholder pubkeys so the

singletons can be set up before the operator handoff that swaps the

real pubkeys in.

Precompile addresses (LP-099 page 5)

Single-signer Safes use the IERC1271 path (isValidSignature); threshold

co-signers use the dedicated verifyCoSignature path so that the precompile

verification is gated by the Safe address.

Compatibility

• Safe v1.5.0 audited surface, used via @safe-global/safe-smart-account.
• All signers implement IERC1271 (current + legacy) so Safe execTransaction

signature mixing works without changes.

• Validation gate: `grep -rn 'Corona\|corona\|CORONA' contracts/ src/

--include='*.sol' MUST return zero hits across luxfi/standard`,

luxfi/dao, zooai/safe, and any other white-label package.

Rationale

• Composable over inheritance: Quasar's signer triad wraps existing

threshold primitives instead of extending them. Each signer is

independently complete and validatable.

• Optional Magnetar: hash-based signatures are large and slow. We

ship the wiring, but each deployment chooses whether to require the

third primitive via a single boolean — no silent forks of the signer

set.

• One canonical name: "Corona" is the value's name regardless of

where the type lives. "Corona" was the prototype label; it does not

appear in any production source.

Reference deployments

luxfi/standard/script/DeployLuxDAO.s.sol deploys this pattern in one

script (Foundry, no Hardhat) against any of 96369 (mainnet C-Chain),

96368 (testnet), 96370 (devnet). Per-network outputs land in

deployments/<network>/<chainid>-c-chain/lux-dao.json.

Security considerations

• Pulsar and Corona are both Module-LWE (distinct parameter sets /

codebases — implementation diversity, not family-disjoint). Magnetar

is hash-based (the cross-family leg).

• All eight mandatory signers are independently sufficient to sign a

Safe transaction; the Safe owner-set + threshold m decides what

combination is required.

• The placeholder pubkeys baked into the deploy script are NOT

authoritative — operators MUST factory-deploy real signers with real

pubkeys before granting the Safe live custody.