What Stellar already gives you
Stellar has had multisig since long before smart contracts. Any classic account can have extra signers with weights, and separate thresholds for low, medium and high-risk operations. It is real multisig, it is part of the protocol, and for many accounts it is the right answer.
What the protocol does not give you is a place for a decision to live while it is being made. A pending payment is a transaction envelope that someone builds and then passes around — in a chat, over email, through a coordination tool — collecting signatures until it has enough weight to submit. Nothing about that is on the ledger, because until it is submitted, there is nothing on the ledger.
What a vault adds
The proposal itself is on-chain
A vault stores the proposal, every vote cast on it, and its status on the ledger. Anyone can read what is pending and who has decided what, without trusting a screenshot or a message from whoever is holding the XDR. When the question later becomes "who authorized this payment", the answer is on Stellar rather than in someone's inbox.
Saying no is a real action
Native multisig has no way to record dissent. A signer either signs or does not, and "has not got to it yet" looks exactly like "refuses to sign". A vault records Vote Yes, Vote No and Abstain against each owner, so an objection is visible and a stalled decision can be told apart from a rejected one.
More than one thing can be in flight
A classic account has a single sequence number, and a signed pending transaction claims it. Prepare a second payment while the first is still collecting signatures and the two compete — submitting one invalidates the other. Teams work around this by serializing everything through one person.
Vault proposals each get their own id and resolve independently. Three payments can sit waiting on different people at the same time without interfering.
Contract calls get the same workflow
A classic account can invoke Soroban contracts perfectly well, multisig included — this is not something only a contract account can do. What differs is the work involved. Natively, a contract call is a transaction someone has to construct with the arguments encoded correctly, then circulate for signatures like any other envelope, and the people signing it are approving XDR.
A vault runs those calls through the same path as a payment: paste the contract address, pick a function from the ones it publishes, fill in a form generated from its own interface, and let the other owners vote on a proposal that shows them the contract, the function and the arguments in readable form.
What you give up
These are real trade-offs, and for some accounts they are decisive.
-
The address is a contract. A vault is a
Caddress, and classic Stellar payments can only be sent to aGaccount. Soroban-aware wallets handle this, but plenty of exchange withdrawal screens do not — see sending and receiving for what that means in practice, and buying for one way around it. A natively multisig classic account has no such problem: anything that can pay Stellar can pay it. - Contract state expires. Soroban entries carry a time to live and are archived when it runs out, which has to be paid to restore. Volta Circuit handles that restoration as part of delivering funds, but a classic account simply sits there indefinitely and a contract account does not.
- It costs more. A classic payment costs a fraction of a cent. Contract invocations are heavier — still small, but meaningfully more than a native transaction, and paid on every vote and execution.
- No weighted signers. A vault has one flat threshold and every owner counts equally. Stellar's native multisig is more expressive here: you can give one signer more weight than another, and require more approvals for changing the account than for spending from it. If you need that shape, the protocol does it and a vault does not.
- You are trusting a contract. Native multisig is enforced by the protocol itself. A vault is enforced by code — audited code, but code — which is a larger surface than "Stellar validates signature weights".
Which should you use
Native multisig fits an account that mainly receives and sends payments, needs to be payable by anything including exchanges, wants the lowest possible fees and no dependency beyond the protocol, or needs weighted signers.
A vault fits a group that has to coordinate: several people deciding together, who need to see what is pending and who has decided what, who want more than one payment moving at once, and who interact with Stellar contracts as well as sending assets.
They are not exclusive. Plenty of teams keep a classic account as the address they publish for incoming payments, and a vault for the funds that need collective control.