Citadel Protocol
Last updated: August 18, 2026
Citadel Protocol — Air-Gapped Multi-Party Approval
Nyxor Edition
The Citadel Protocol is XColdPro's air-gapped multi-party transaction approval system. It supports M-of-N signature schemes — multiple independent approvals required before a transaction can be broadcast.
How It Works
The initiating signer creates a transaction proposal within XColdPro. This generates a portable data package that can be transferred to other signers by QR code, USB drive, or another offline method.
Each additional signer opens the proposal on their own device, reviews the transaction details (recipient address, amount, network, fees), and then either approves or rejects it.
Once the required threshold of signatures has been collected, the fully signed transaction can be broadcast from any online device.
The entire approval process operates offline. No signer is required to be connected to the internet or to communicate with other signers in real time.
Security Guarantees
Citadel proposals do not contain private keys, seed phrases, or sensitive wallet data. They include only the unsigned transaction data and any collected signatures. If a proposal is intercepted in transit, it cannot be used to extract wallet information, redirect funds, or authorize a transaction on its own.
Citadel vs Traditional Multi-Sig
| Feature | Citadel | Typical Online Multi-Sig |
|---|---|---|
| Coordination layer | Offline only | API/server dependent |
| Smart contract exposure | None required | Often required on-chain |
| Hot wallet dependency | No | Usually yes |
| Threshold flexibility | Any M-of-N | Often limited presets |
Use Cases
- Business partners: Joint accounts requiring consensus before large transfers
- Families: Shared asset management with multi-member approval
- Organizations: Treasury management without third-party custodial services
- Individuals: Additional coercion protection — compromising one device is not enough
Implementation Checklist
- Define signer roster, threshold, and escalation path before production use
- Each signer should maintain a separate device with XColdPro installed
- Standardize proposal verification fields (network, recipient, amount, proposal ID)
- Run quarterly drill with non-critical transactions