TRON's account permission model checks each transaction against its selected permission. The transaction's Permission_id identifies Owner as 0 or an Active permission as 2 through 9 .

Owner can authorize any contract type, while an Active permission also requires the requested type in its operations bitmap. A single-key Active permission can therefore allow transfers even when Owner requires several signers.

Witness permission, ID 1 , handles Super Representative block production and cannot authorize ordinary transactions.

Weights and thresholds determine both single-key authority and tolerance of missing keys; counting controllers alone cannot establish either.

Can Owner multisig leave a single-signer transfer path?

All settings in this TRON example are hypothetical, and each controller initially holds a usable key.

View image file

Owner configuration

Threshold: 15 weight units. Controller A: 5 weight units; Controller B: 8 weight units; Controller C: 12 weight units.

Only Active permission

Threshold: 1 weight unit. Controller A: 1 weight unit. Its operations bitmap enables only TransferContract (ID 1 ), for TRX transfers.

Controllers A and B supply 5 + 8 = 13 Owner weight units, below the threshold of 15. Controllers A and C supply 5 + 12 = 17 , enough to meet that threshold.

Controller A alone meets the Active threshold for a TRX transfer: 1 = 1 . The larger Owner threshold does not apply when the transaction selects this Active permission.

If Controller C loses access to its key, A and B retain only 13 usable Owner weight units. They cannot authorize an Owner permission update, and the only Active permission excludes AccountPermissionUpdateContract (ID 46 ). Controller A retains Active authority for TRX transfers.

The current Owner permission normally authorizes a permission update. An Active permission can also authorize it when the transaction selects that permission and its bitmap enables AccountPermissionUpdateContract (ID 46 ).

Before changing a funded account, verify controller addresses and usable keys, then check each permission's remaining weight under planned key-loss conditions. Rehearse the configuration and intended signer combinations on Shasta or Nile.

In TronLink Extension, open More > Account Permissions , then choose Edit Permission under My Account to view the configuration controls.

Because an update replaces the complete permission configuration, its payload must contain the new Owner permission and complete Active-permission list. Super Representative accounts must also supply their Witness permission; non-SR accounts omit it or use null .

Setting Owner to one key with threshold 1 changes only Owner. Existing Active permissions retain their configured signing authority until an update changes them too.

If Owner cannot reach its threshold and no usable Active permission enables ID 46 , the account cannot authorize permission changes. Access to assets still depends on any usable Active permissions and the operations they allow.

View image file

TRON's Account Permission Management documentation lists a Mainnet permission-update fee of 100 TRX. It lists an additional 1 TRX surcharge, once per transaction, when the transaction carries at least two signatures.

Because governance can change both amounts, query getUpdateAccountPermissionFee and getMultiSignFee with wallet/getchainparameters before relying on those figures. Normal Bandwidth or Energy costs apply in addition.

The wallet/getsignweight API inspects collected signing weight on a partial transaction; wallet/getapprovedlist lists the addresses that have already signed it.

View image file

Reaching the selected threshold establishes sufficient signing weight, but an Active permission must also allow the requested contract type. A weight check does not establish broadcast, on-chain confirmation or completion of the requested transfer.