Picoquorum is a small console that is one owner of a Safe. Each signer's key is a secure element,
on the console's board or on a small key that plugs in. The console shows what a transaction does on
its own screen, works out the Safe transaction hash itself, and asks the key to sign only after you
have seen every page and held the green Sign button. Reject is red and easy.
The same console also runs in your browser, with
your own passkey as its key. That version is one short folder you can read, check against this
README, and sign from on your own computer.
A pico quorum
A pico quorum is a small group that agrees before anything moves: a family's savings, a club's
treasury, a two-person company, a project's release keys. Two of three. Three of five. Too small for
a custody desk, too important for one laptop. Picoquorum gives each person in that group the same
small box and their own key, and makes every approval a deliberate thing you do with your hands.
Experimental. Early design. Use a testnet first, and only small amounts on mainnet. The Safe's
threshold is the real control: always keep owners on the Safe that are not this console.
Mono, the reference console
Mono is the hardware Picoquorum is working toward, and the one the rest is measured against: the
reference standard for a console. Mono is a working name.
- What it is. A 40 × 89.5 mm bar: a 1.14″ screen, three buttons under it, an RP2350, and the
secure element soldered on. It has no radio at all. Its USB-C reaches a serial chip and nothing
else: a computer passes on Safe's queue, and has no say in what gets signed.
- Where it stands. A design, written by a script and checked by KiCad and against JLCPCB's limits
(hardware/mono). Not ordered, and nothing is built. The board it comes
from, console-rp, is on the bench: five boards, the first one up
on a bench script. The console's firmware for these two isn't written yet. Today the firmware
runs on the dev console and in your browser.
- Its case. Two first drafts, drawn by scripts and not printed: the case,
and an industrial variant with cut corners
and grooves down its sides (
cad/consoles/mono_ind.py;
tools/case build mono-industrial rebuilds it).
- A dev board kit, possibly. Mono may become a kit for developers. Nothing is for sale, and no
date is set.
For developers and contributors. We may open Mono up to a first few developers and contributors
before anything wider. A sign-up sheet will come later. Until then, watch this repository or follow
@picoquorum, and try the firmware as it is today: in
your browser, or on a dev console you
build for about $35.
The two ESP32-S3 boards made before it, with their own Wi-Fi, are in
hardware/prototypes, and the designs before those in
hardware/archive. Every board and build, and where each stands:
hardware/README.md.
Four ideas
1. A key that can't leak
The key is a secure element: soldered on the console's board, or on a small board you plug in. Its
P-256 private key is generated inside the chip, never leaves it, and never exists as a seed phrase. There is nothing to write down,
photograph or phish. The chip has no command that reads a private key out, it is locked after
provisioning, and the console asks it to sign only a hash the console worked out itself.
Each key owns the Safe through Safe's audited passkey signer
(firmware/webauthn.py), with the same owner address on every chain. The
contracts it relies on were checked onchain on Base and Ethereum.
The USB-C key. key-c P2 is the key as a part you can
hold: an ATECC608C behind a USB-C receptacle on a 16 × 36 mm board, with an ESD
array between the connector and the chip.
- The receptacle is plain wires, not USB: D+ carries SDA, D− carries SCL, and VBUS is key power
that the console switches on only when the key is fully in.
- 5.1 kΩ on each CC pin tells the console a key is present.
- Five boards were assembled by JLCPCB and read on the bench from 2026-10-16. One went through the
key ceremony on 2026-10-22 and is a Safe owner.
Mono and console-rp carry the same chip soldered on. The dev console's key is an ATECC608 breakout or
an Infineon OPTIGA Trust M. The other key designs (card edge, pogo pads) are in
hardware/key-pcb/.
How a chip is locked: docs/LOCKING.md and docs/TRUSTM.md.
What a sealed key can't protect you from: docs/SECURITY.md.
2. A simple console that checks on its own
The console is a small board with a screen and a few buttons, running a small amount of MicroPython
you can read. Today that is the dev console, a Raspberry Pi Pico 2 W with a 240 × 240 screen;
Mono is the board it is headed for. It doesn't take anyone's word for
a transaction: not your
laptop's, not your browser's, not Safe{Wallet}'s, and not the transaction service's.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
