Is there a design pattern in order to protect private keys in a Multi SigWallet?

Question

I've developed a MultiSig Wallet for my company. For timing reason i've used as "code base" the Ethereum Multi Sig Smart Contract by BitGo (here the link of the repository: https://github.com/BitGo/eth-multisig-v4). I have edited it a bit in order to customize the functions inside it by following my needs. I've already tested it and all works perfectly.

My question is related more to a possible design pattern to implement for storing the private keys of the accounts that have the rights to operate directly on the smart contract.

My Wallet Multisig is 2/3 signers, this mean for making a withdrawal operation two signers must give their permission in order to move the funds from the sender (the wallet multisig) to a recipient (whatever address you want).

Now, since i have a backend that will be the initiator of the withdrawal operation, i need to recover my private keys from external sources (it's not secure storing the private keys directly on the backend or in a database because if someone hack my server could be a security problem). So my idea was to store private keys separately, in 3 external secure sources (e.g AWS) to solve the problem.

For recovering the private keys i would need to call this external services but this not solve the problem since if i got hacked by someone, the hacker could make the call directly from my backend in order to retrieve the private keys and steal them to me.

So, this is the scenario and my question is the following: Do exists a design pattern i can follow in order to protect my private keys even if a hacker break my backend code?

If someone could help me also using a different approach i'll be happy to hear suggestions. Thanks

Answer 1

A multisig defeats the point if one party is able to retrieve all the private keys from a single location, regardless of how many places you store the private keys in. That one party would be a single point of failure in this situation. If a hacker is able to break your backend and get at least 2 of the 3 required private keys, there is nothing you can do to protect the wallet.

To protect your wallet, split the private keys among different parties. That could be different people, each holding a key, or different fully isolated systems, with no way to send a transaction through a single system.