Staking Data
Ratings API

Monitored Protocols & Events

The complete inventory of DeFi protocols, contracts, and on-chain events monitored by the Staking Rewards on-chain alerting pipeline, and how each maps to an alert incident type and severity.

DeFi alerts returned by the List DeFi Alerts endpoint are generated by on-chain monitors that watch governance- and risk-relevant contracts for each rated protocol. This page is the human-readable inventory of what is covered: which protocols and contracts are watched, which on-chain events trigger an alert, and the incident type and severity each maps to.

This page is maintained by hand alongside the monitors. If a protocol or event appears in an alert but not here, treat this page as lagging — the monitors are the source of truth.

Incident types

Every alert is classified into exactly one of seven incident types. The incident_type filter on the alerts endpoint matches these values.

Incident typeWhat it tracks
ContractUpgradeProxy upgrades, implementation changes, version updates, upgrade proposals/cancellations
TimelockChangeTimelock delay changes, call scheduling/execution/cancellation
AdminChangeOwner transfers, admin updates, pending-owner set/accepted, authority changes
MultisigChangeSafe owner add/remove, threshold changes, module/guard/fallback-handler updates
RoleChangeRole grants/revocations, role-admin changes, minter/pauser/oracle role assignments
ProtocolParameterChangeFee changes, reserve configs, rate limits, caps, cooldown durations
EmergencyActionPause/unpause, bunker mode, staking halt, seizure, emergency shutdown, reserve freeze

Severity levels

SeverityMeaning
CRITICALFunds-at-risk or protocol-halting events (pauses, seizures, emergency shutdown)
ERRORHigh-impact governance/upgrade events (implementation upgrades, admin transfers, timelock delay decreases)
WARNINGNotable governance/parameter changes (role grants, fee changes, multisig membership)
INFORoutine or low-impact updates (minor parameter tweaks, proposal scheduling)

The severity filter matches these values (case-insensitive).

Coverage summary

ProtocolChainProducts
AaveEthereumprotocol-wide + per-reserve
BlackRockEthereumbuidl
CoinbaseEthereumcbeth
CompoundEthereumusdt + protocol-wide
EthenaEthereumsusde
EtherFiEthereumeeth, weeth, liquid-eth + protocol-wide
HyperLendHyperEVMprotocol-wide + per-asset
KelpEthereumrseth
Lido (earnETH)Ethereumearneth
Lido (earnUSD)Ethereumearnusd
Lido (stETH)Ethereumsteth
Lido (strETH)Ethereumstreth
LombardEthereumlbtc
Looping CollectiveEthereumlcbtc
MapleEthereumsyrupusdc, syrupusdt
Moonwell Flagship ETHBasemoonwell-flagship-eth
MorphoEthereumper-vault
OndoEthereumusdy, ousg
PufferEthereumpufeth
Rocket PoolEthereumreth
SkyEthereumsusds
SparkEthereumspweth, spusdc, spusdt + per-reserve
StaderEthereumethx
StakeWiseEthereumoseth
USD.aiArbitrum Onesusdai, usdai
Valantis (stHYPE)HyperEVMsthype

Aave (aave)

  • Chain(s): Ethereum
  • Products: the rated Aave Ethereum Core Market assets — weth, usdc, wbtc, eurc, usdt, wsteth, cbbtc, weeth, usde. Protocol-wide events (governance/admin/oracle/upgrades) apply to all of them; asset-scoped events only page for the rated assets (changes on other reserves are tracked on the dashboard at INFO)
  • Contracts monitored:
    • Pool — 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2
    • PoolConfigurator — 0x64b761D848206f447Fe2dd461b0c635Ec39EbB27
    • PoolAddressesProvider — 0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e
    • ACLManager — 0xc2aaCf6553D20d1e9d78E365AAba8032af9c85b0
    • ExecutorLvl1 — 0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A
    • ExecutorLvl2 — 0x17Dd33Ed0e3dD2a80E37489B8A63063161BE6957
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (ACLManager — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key that can administer every other role — effectively whole-protocol control. This is the highest-trust change Aave can make, so it pages at top urgency.
RoleGranted (ACLManager — POOL_ADMIN / EMERGENCY_ADMIN / ASSET_LISTING_ADMIN)RoleChangeERRORA new address gains a powerful privileged role: pool administration (including upgrading the tokens that hold user funds), the ability to pause the protocol, or control over which price oracles are used. Each can materially affect funds or availability, so granting it pages.
RoleGranted (ACLManager — RISK_ADMIN / BRIDGE)RoleChangeWARNINGA new address gains a bounded operational role — tuning risk parameters within limits, or bridge minting capped by configuration. Expected governance activity, so it is recorded for visibility but does not page.
RoleGranted (ACLManager — FLASH_BORROWER)RoleChangeINFOA new address is exempted from flash-loan premiums. This carries no governance power and cannot affect other users, so it is logged for completeness only.
RoleGranted (ACLManager — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name is granted. Because an unmapped or custom role could be powerful, it is treated as potentially dangerous and paged ("fail loud") rather than silently ignored.
RoleRevoked (ACLManager — DEFAULT_ADMIN / EMERGENCY_ADMIN / POOL_ADMIN)RoleChangeERRORA role whose loss is dangerous is removed — the root key (removal can lock out governance), the emergency-pause ability (losing it removes the protocol's exploit brake), or pool administration. Worth paging even though revocations usually reduce risk, because these can also signal a hostile takeover or an operational mistake.
RoleRevoked (ACLManager — other roles)RoleChangeWARNINGA lower-impact role (e.g. risk admin, flash borrower) is removed. Reducing privilege is generally safe, so it is recorded but does not page.
RoleAdminChanged (ACLManager)RoleChangeCRITICALThe rule for who may grant or revoke a role is rewired — a structural change to the access-control graph itself, not just who holds a role. This is meta-authority over the entire permission system: changing the admin of a powerful role (e.g. POOL_ADMIN or the root DEFAULT_ADMIN) is a direct privilege-escalation / takeover vector. This is not part of Aave's normal operations, so any occurrence is maximally anomalous (a classic way an attacker entrenches control) — paged at the highest severity, same tier as a root-authority or oracle swap.
OwnershipTransferred (Executor)AdminChangeCRITICALOwnership of a governance executor moves to a new address. The executor is where Aave's power actually resides — it holds pool-admin and root access-control rights and owns the AddressesProvider — and its owner can make it execute an arbitrary call from that privileged address (upgrade the fund-bearing token contracts, grant any role, swap the oracle). Owning the executor is therefore total control of the protocol. The legitimate owner is the governance payload-controller, never a person; ownership moves only as part of a governance migration, so any other occurrence is a top-urgency, funds-at-risk event.
ACLAdminUpdatedAdminChangeERRORChanges which address is registered as the ACL admin — the account tied to the ACLManager's root DEFAULT_ADMIN role that ultimately grants and revokes every other role. A root-of-trust change, so it always pages.
ACLManagerUpdatedContractUpgradeCRITICALRepoints the protocol at a different ACLManager contract. Because permission checks resolve the manager at runtime, a swap immediately changes the authority behind every privileged action — a malicious manager could make anyone a pool admin and drain funds. Outside the protocol's initial setup this is not a normal operation, so any occurrence is a top-urgency, funds-at-risk event.
PoolUpdatedContractUpgradeERRORUpgrades the implementation behind the core Pool proxy — replacing the code of Aave's main lending contract while funds and storage stay in the unchanged proxy. Governance-gated and routine, but because it ships new code for the contract at the heart of the protocol, every upgrade pages so it can be matched to a known governance proposal.
PoolConfiguratorUpdatedContractUpgradeERRORUpgrades the implementation behind the PoolConfigurator proxy — the privileged contract that sets every reserve's risk parameters (caps, collateral config, freeze/pause). Governance-gated; each upgrade pages so the new code can be matched to a known governance proposal.
PriceOracleUpdatedContractUpgradeCRITICALSwaps the protocol's entire price-oracle contract. Pricing is resolved at runtime, so a swap instantly repoints all collateral valuation and liquidations — a malicious or buggy oracle is one of the fastest ways to drain a lending pool. Outside initial setup this is not a normal operation; any occurrence is a top-urgency, funds-at-risk event. (Routine per-asset feed changes use a different event.)
PriceOracleSentinelUpdatedContractUpgradeERRORSets the PriceOracleSentinel — L2 machinery that blocks borrows/liquidations during sequencer downtime. This monitor covers only Aave's Ethereum-mainnet deployment, which has no sequencer, so the sentinel is inert here and is not set on this deployment; an occurrence is anomalous and pages. (On Aave's L2 markets the sentinel is live safety infrastructure; those deployments are outside this monitor's current scope.) Worst case if misconfigured is freezing liquidations — a slow solvency risk, not an instant drain.
PoolDataProviderUpdatedContractUpgradeWARNINGSwaps the PoolDataProvider, a read-only view/aggregation helper UIs and integrators call to read reserve data. It holds no funds, grants no privileges, and isn't used in any state-changing path, so a swap can at most return wrong data to off-chain readers — dashboard-only.
OwnershipTransferred (AddressesProvider)AdminChangeCRITICALOwnership of the PoolAddressesProvider — the market's master registry — moves to a new address. Its owner is the single key that can swap the Pool, the PoolConfigurator, the ACLManager, and the price oracle, i.e. it can trigger every one of the funds-at-risk events above. Transferring it is the protocol's top root-of-trust change. Ownership moves only as part of a governance migration (the legitimate owner is the governance executor), so any other occurrence is a top-urgency, funds-at-risk event.
ProxyCreatedContractUpgradeINFOThe AddressesProvider deploys a brand-new proxy for a registry slot. This fires only the first time a proxied component (the Pool, the PoolConfigurator, etc.) is registered, and always co-fires with the meaningful event for that component (PoolUpdated, AddressSetAsProxy) — which carries the real severity. On its own it grants no privileges and moves no funds, so it is recorded for completeness only. It fires only when proxied components are first registered, at protocol setup.
AddressSetAsProxyContractUpgradeERRORUpgrades the implementation behind a registered proxy via the generic registry path — the same mechanism as PoolUpdated, but for a registry slot that doesn't have its own dedicated setter. It swaps the executing code of a governance-controlled proxy, so it carries the same risk class as a Pool/Configurator upgrade and pages, to be matched against a known governance proposal. It fires only at protocol setup to register a proxied component, and is not part of routine operations.
AddressSetContractUpgradeERRORThe owner edits one entry in the market's address registry (its "phone book") for an id that has no dedicated setter — the dangerous core pointers (oracle, ACL manager, ACL admin, data provider) have their own events and do not flow through here. The risk is indirection: contracts resolve components by id at runtime, so a poisoned entry can redirect a trusted integration to an attacker's contract. Impact depends on who reads that id — e.g. the UMBRELLA entry wires in Aave's safety module that covers reserve bad debt. Owner-only and rare, so each occurrence pages to be matched against a known proposal.
ReserveFactorChanged (≤50%)ProtocolParameterChangeINFOThe reserve factor — the share of borrow interest diverted to the protocol treasury rather than to suppliers — is changed for an asset. A routine, frequently-adjusted economic knob the risk stewards tune; it does not touch fund custody, collateral safety, or solvency. Normal values sit in a 5–50% band, so changes within it are tracked on the dashboard, not paged.
ReserveFactorChanged (>50%)ProtocolParameterChangeWARNINGThe new reserve factor exceeds 50%, outside the normal operating band. The only values this high on record are Aave's GHO stablecoin at 100% (by design) and an asset being offboarded (SNX at 95%) — legitimate but unusual, so the change is surfaced for confirmation that it is an intended offboarding or special-asset setting. It does not page.
FlashloanPremiumTotalUpdated (≤1%)ProtocolParameterChangeINFOThe total flash-loan premium (the fee on a flash loan) is changed. This is the lowest-stakes fee on the protocol — it cannot reach funds or solvency (a high premium just makes flash loans expensive, a zero premium just makes them free; the loan must still be repaid in the same transaction). Historically it has only ever been 5–9 bps, so normal changes are tracked on the dashboard, not paged.
FlashloanPremiumTotalUpdated (>1%)ProtocolParameterChangeWARNINGThe new flash-loan premium exceeds 1% — roughly a tenfold jump over the 5–9 bps norm. There is no legitimate reason for such a value, so it is surfaced as a likely misconfiguration or tampering signal. It does not page.
FlashloanPremiumToProtocolUpdatedProtocolParameterChangeINFOChanges how the flash-loan premium is split between the protocol treasury and the liquidity suppliers (a bounded 0–100% share). The borrower's total fee is unchanged — only who receives it moves — so no setting carries fund or solvency risk, and 100% (all premium to treasury) is a legitimate endpoint governance has used. Tracked on the dashboard, not paged.
BridgeProtocolFeeUpdatedProtocolParameterChangeWARNINGChanges the protocol's cut of the fee on Aave's Portal feature (cross-chain "unbacked" minting). The fee itself is harmless, but the Portal subsystem is dormant on Ethereum mainnet — this fee and the bridge role are unused here — and it is higher-risk if activated. Any change is therefore treated as a canary that someone is configuring Portal on mainnet and is surfaced for review (correlate with a bridge-role grant). It does not page.
LiquidationProtocolFeeChanged (≤30%)ProtocolParameterChangeINFOThe protocol's cut of the liquidation bonus for an asset is changed. The liquidation bonus is what pays liquidators to keep the protocol solvent; the standard cut is 10% (historical band 0–20%), so changes within range are tracked on the dashboard, not paged.
LiquidationProtocolFeeChanged (>30%)ProtocolParameterChangeWARNINGThe new fee exceeds 30% — well outside the historical 0–20% band. Taking too large a share of the liquidation bonus erodes the liquidator's margin, which can slow or stall liquidations and lead to bad debt, so the change is surfaced for review. The risk is gradual and the parameter is bounded, so it does not page.
ATokenUpgradedContractUpgradeERRORUpgrades the implementation of an asset's aToken — the contract that custodies user deposits for that reserve. A fund-bearing code swap (a malicious implementation could drain the reserve), so it pages, same as a core Pool upgrade. Routine via governance — protocol-wide migrations upgrade every reserve in a single transaction — so each migration should map to a known proposal.
VariableDebtTokenUpgradedContractUpgradeERRORUpgrades the implementation of an asset's variable-debt token — the contract that accounts for that reserve's borrows. Same risk class as the aToken upgrade: a code swap on core reserve accounting, so it pages and each upgrade should map to a known governance proposal.
ReserveInterestRateStrategyChangedProtocolParameterChangeINFOSwaps the interest-rate-strategy contract a reserve uses (the contract that computes borrow and supply rates from utilization). It affects only rates, not custody — a bad strategy could grief with extreme rates but cannot move funds, and it is fully recoverable. A routine, historically high-volume risk-steward action (largely superseded from V3.2 by interest-rate data changes), so it is tracked on the dashboard, not paged.
ReserveInterestRateDataChangedProtocolParameterChangeINFOThe V3.2+ routine way to retune a reserve's interest-rate curve — a risk steward writes new rate data (optimal usage ratio, base rate, and the two utilization slopes) onto a shared strategy contract, rather than deploying a new strategy. Purely economic: it moves borrow and supply rates, never touches custody or solvency, and is fully recoverable. The highest-volume reserve event, so it is tracked on the dashboard, not paged.
ReservePaused (rated asset, paused)EmergencyActionCRITICALEmergency halt of a monitored reserve — pausing blocks every interaction with the asset including withdrawals and liquidations, so the product goes fully dark and user funds are locked in place. Strictly more severe than a freeze (which still lets users exit). No monitored asset has ever been paused on Aave's Ethereum market (the few pauses to date were on non-monitored assets), so a pause on a monitored product is exceptional and paged immediately, whether it is protective incident response or hostile. Non-monitored assets are tracked on the dashboard at INFO.
ReservePaused (rated asset, unpaused)EmergencyActionWARNINGA monitored reserve is taken out of pause and restored to normal operation — the recovery / all-clear signal. Tracked on the dashboard rather than paged.
ReserveFrozen (rated asset, frozen)EmergencyActionERRORA monitored reserve is frozen — new supply and borrow are blocked, but users can still repay, withdraw, and be liquidated, so funds are not locked. This is Aave's graceful asset-offboarding tool, one tier below a pause; freezing a monitored product is material enough to page but, because exits stay open, is not treated as critical. Non-monitored assets are tracked on the dashboard at INFO.
ReserveFrozen (rated asset, unfrozen)EmergencyActionWARNINGA monitored reserve is unfrozen and re-enabled for new supply and borrow — the recovery signal. Tracked on the dashboard rather than paged.
CollateralConfigurationChanged (rated asset, LTV→0 or liquidation-threshold cut ≥5%)ProtocolParameterChangeERRORThe solvency-critical collateral parameters of a monitored reserve — loan-to-value (LTV), liquidation threshold (LT), and liquidation bonus. Two cases page: (1) a drop in the liquidation threshold, which makes existing positions immediately liquidatable and can trigger a wave of forced liquidations and bad debt — the genuinely dangerous direction; (2) LTV set to 0, which disables the asset as new collateral (a protective de-risking / wind-down signal). Evaluated against the previous on-chain value, so only a real transition pages.
CollateralConfigurationChanged (rated asset, other change)ProtocolParameterChangeWARNINGRoutine collateral re-parameterisation of a monitored reserve — raising LTV/threshold, small ±1% adjustments, or liquidation-bonus tweaks. Material enough to record but not dangerous to existing positions, so it is tracked on the dashboard rather than paged. Changes on non-monitored reserves are INFO.
BorrowCapChanged (rated asset, disabled)ProtocolParameterChangeWARNINGThe borrow cap of a monitored reserve is cut to the "disabled" sentinel (a cap of 1 token), which effectively stops new borrowing of the asset — a wind-down / de-risking signal. Surfaced on the dashboard for prominence (it correlates with freezes and collateral de-risking), but not paged: the borrow cap only limits new borrowing and never affects existing positions or funds.
BorrowCapChanged (other)ProtocolParameterChangeINFORoutine adjustment of how much of an asset can be borrowed (raising/lowering the cap as the market grows or de-risks). It cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
SupplyCapChanged (rated asset, disabled)ProtocolParameterChangeWARNINGThe supply cap of a monitored reserve is cut to the "disabled" sentinel (a cap of 1 token), effectively stopping new deposits of the asset — a wind-down signal. Surfaced on the dashboard for prominence, but not paged: the supply cap only limits new deposits and never affects existing positions or funds.
SupplyCapChanged (other)ProtocolParameterChangeINFORoutine adjustment of how much of an asset can be supplied (raising/lowering the cap as the pool grows or de-risks). It cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
DebtCeilingChanged (rated asset, isolation-mode transition)ProtocolParameterChangeWARNINGA monitored asset enters or exits isolation mode — Aave's sandbox for riskier collateral, where the asset can only be used alone (not combined with other collateral), can only borrow stablecoins, and has a capped total debt (the debt ceiling, in USD). Entering isolation is a restricted/de-risk listing; exiting (ceiling set to 0) promotes it to normal collateral. This is a genuine risk-posture change, so it is surfaced on the dashboard — but not paged, since the ceiling only limits exposure and never affects existing positions.
DebtCeilingChanged (other)ProtocolParameterChangeINFORoutine adjustment of an isolated asset's debt ceiling (raising/lowering the capped total debt while it stays in isolation mode), or a listing-time no-op. It cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
SiloedBorrowingChanged (rated asset, toggled)ProtocolParameterChangeWARNINGA monitored asset is switched into or out of siloed borrowing — a siloed asset can only be borrowed on its own (you can't borrow anything else against it in the same account), a containment control for assets with manipulable or thin-liquidity prices. Turning it on signals a price-manipulation concern; turning it off relaxes that. A risk-posture change surfaced on the dashboard, but not paged: it constrains borrowing behaviour only and never affects existing positions.
SiloedBorrowingChanged (other)ProtocolParameterChangeINFOA listing-time no-op (siloed status set to its default at reserve init) or a change on a non-monitored asset. Tracked on the dashboard, not paged.
LiquidationGracePeriodChanged (rated asset)ProtocolParameterChangeWARNINGWhen a paused reserve is reopened, a grace period can keep liquidations blocked for a short window so borrowers can react before liquidations resume. This sets that window for a monitored asset. Surfaced on the dashboard as context for the reserve pause/unpause that triggered it (the pause itself is the page); not paged on its own. Non-monitored assets are INFO.
LiquidationGracePeriodDisabled (rated asset)ProtocolParameterChangeWARNINGCancels an active liquidation grace period on a monitored asset, re-enabling liquidations immediately. Dashboard context for the pause/unpause lifecycle; not paged on its own. Non-monitored assets are INFO.
PendingLtvChangedProtocolParameterChangeINFOBookkeeping for the freeze mechanism: when a reserve is frozen its current LTV is cached here (and effective LTV set to 0), then restored on unfreeze. It always accompanies a reserve freeze and the related collateral-config change, both of which already carry the alert, so this is tracked on the dashboard at INFO to avoid double-counting the same incident.
EModeCategoryAddedProtocolParameterChangeERROR (rated-holding category, LT drop ≥500bps) / INFODefines/updates an efficiency-mode category's LTV & liquidation threshold; for a position in the category the category LT is the binding constraint. Aave v3.2 e-mode is high-churn (~40 categories, many ephemeral PT-token expiry categories, LTs tuned upward almost daily), so only a genuine ≥500bps LT drop on a category holding a rated asset pages — everything else is dashboard INFO. Stateful. 353 on-chain; 0 ≥500bps drops on rated categories → clean trip-wire (a flat WARNING tier would have been 95 rows of noise).
AssetCollateralInEModeChangedProtocolParameterChangeINFOEnables/disables an asset as collateral in an e-mode category. High-churn in v3.2 (assets move between categories — collateral=false is routine restructuring, not a removal), so dashboard-only; used to maintain which categories hold a rated asset for the LT-drop rule above. Only rated-asset changes are recorded. (A naive "disabled → ERROR" rule would have mis-paged 20× on restructuring.)
AssetLtvzeroInEModeChangedProtocolParameterChangeERROR (rated asset, ltvzero=true) / INFOForces (or restores) a rated asset's e-mode LTV to 0 — disabling it as e-mode borrowing power, a real de-risk/disable signal → ERROR; restoring → INFO. 1 on-chain on a rated asset (WETH cat 1 forced to 0, later restored).
Upgraded (Pool)ContractUpgradeERRORThe main Pool contract's implementation is upgraded — this replaces the core money-market logic for the entire market (every monitored product and reserve), so it is always paged. It is kept at ERROR rather than the top severity because Pool upgrades are a routine, recurring governance migration (a few per year); the page exists so the upgrade can be confirmed against a known Aave governance proposal.

BlackRock (blackrock)

  • Chain(s): Ethereum
  • Products: buidl
  • Contracts monitored:
    • BUIDL — 0x7712c34205737192402172409a8f7ccef8aa2aec
    • BUIDL-I — 0x6a9da2d710bb9b700acde7cb81f10f1ff8c89041
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
ProxyTargetSetContractUpgradeERRORBUIDL proxy target changed to new implementation
ProxyOwnerChangedAdminChangeERRORBUIDL proxy owner changed
OwnershipTransferredAdminChangeERRORDSToken ownership transferred
DSServiceSetRoleChangeWARNINGSecuritize infrastructure service address changed
WalletAddedRoleChangeINFOWallet added to BUIDL whitelist
WalletRemovedRoleChangeINFOWallet removed from BUIDL whitelist
SeizeEmergencyActionCRITICALToken seizure (regulatory) executed
OmnibusSeizeEmergencyActionCRITICALOmnibus account seizure executed
PauseEmergencyActionCRITICALProtocol paused
UnpauseEmergencyActionCRITICALProtocol unpaused
Upgraded (BUIDL-I)ContractUpgradeERRORBUIDL-I proxy upgraded to new implementation

Coinbase (coinbase)

  • Chain(s): Ethereum
  • Products: cbeth
  • Contracts monitored:
    • cbETH — 0xbe9895146f7af43049ca1c1ae358b0541ea49704
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
UpgradedContractUpgradeERRORcbETH proxy upgraded to new implementation
AdminChangedAdminChangeERRORcbETH proxy admin changed
OwnershipTransferredAdminChangeERROROwnership transferred
MasterMinterChangedRoleChangeWARNINGMasterMinter (controls who can mint) changed
MinterConfiguredRoleChangeWARNINGMinter added/updated with allowance
MinterRemovedRoleChangeWARNINGMinter removed
PauserChangedRoleChangeWARNINGPauser role changed
BlacklisterChangedRoleChangeWARNINGBlacklister role changed
RescuerChangedRoleChangeWARNINGRescuer role changed
OracleUpdatedRoleChangeWARNINGOracle (exchange-rate updater) address updated
PauseEmergencyActionCRITICALProtocol paused
UnpauseEmergencyActionCRITICALProtocol unpaused

Compound (compound)

  • Chain(s): Ethereum
  • Products: usdt (Comet market events); protocol-wide for governance/admin/multisig
  • Contracts monitored:
    • cUSDTv3 (Comet) — 0x3afdc9bca9213a35503b077a6072f3d0d5ab0840
    • CometProxyAdmin — 0x1ec63b5883c3481134fd50d5daebc83ecd2e8779
    • Timelock — 0x6d903f6003cca6255d85cca4d3b5e5146dc33925
    • GovernorBravo — 0xc0da02939e1441f497fd74f78ce7decb17b66529
    • Community MultiSig (Pause Guardian) — 0xbbf3f1421d886e9b2c5d716b5192ac998af2012c
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
PauseActionEmergencyActionERRORMarket operations paused/unpaused
WithdrawReservesProtocolParameterChangeWARNINGProtocol reserves withdrawn to treasury
OwnershipTransferred (ProxyAdmin)AdminChangeERRORCometProxyAdmin ownership transferred
NewDelayTimelockChangeERRORTimelock delay changed
QueueTransactionTimelockChangeINFOGovernance action queued
ExecuteTransactionTimelockChangeINFOGovernance action executed
CancelTransactionTimelockChangeINFOGovernance action cancelled
NewAdmin (Timelock)AdminChangeERRORTimelock admin changed
NewPendingAdmin (Timelock)AdminChangeWARNINGTimelock pending admin set
NewImplementation (Governor)ContractUpgradeERRORGovernor implementation upgraded
VotingDelaySetProtocolParameterChangeWARNINGVoting delay changed
VotingPeriodSetProtocolParameterChangeWARNINGVoting period changed
ProposalThresholdSetProtocolParameterChangeWARNINGProposal threshold changed
NewAdmin (Governor)AdminChangeERRORGovernor admin changed
NewPendingAdmin (Governor)AdminChangeWARNINGGovernor pending admin set
AddedOwnerMultisigChangeWARNINGSigner added to Pause Guardian multisig
RemovedOwnerMultisigChangeWARNINGSigner removed from Pause Guardian multisig
ChangedThresholdMultisigChangeWARNINGPause Guardian multisig threshold changed
EnabledModuleMultisigChangeWARNINGModule enabled on multisig
DisabledModuleMultisigChangeWARNINGModule disabled on multisig
ChangedGuardMultisigChangeWARNINGGuard contract changed on multisig
ChangedFallbackHandlerMultisigChangeWARNINGFallback handler changed on multisig

Ethena (ethena)

  • Chain(s): Ethereum
  • Products: susde
  • Contracts monitored:
    • StakedUSDeV2 (sUSDe) — 0x9D39A5DE30e57443BfF2A8307A4256c8797A3497
    • USDe Token — 0x4c9EDD5852cd905f086C759E8383e09bff1E68B3
    • EthenaMinting — 0xe3490297a08d6fC8Da46Edb7B6142E4F461b62D3
    • StakingRewardsDistributor — 0xf2fa332bd83149c66b09b45670bce64746c6b439
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
CooldownDurationUpdated (decreased)ProtocolParameterChangeERRORsUSDe unstaking cooldown shortened — smaller defensive window before redemptions
CooldownDurationUpdated (increased)ProtocolParameterChangeWARNINGsUSDe unstaking cooldown lengthened
AdminTransferRequested (sUSDe)AdminChangeWARNINGsUSDe admin transfer requested (two-step step 1; pages on completion)
AdminTransferred (sUSDe)AdminChangeCRITICALsUSDe root admin transferred — root-of-trust takeover of the staked vault
RoleGranted (sUSDe, BLACKLIST_MANAGER_ROLE)RoleChangeERRORFreeze-power role granted (can restrict/blacklist stakers)
RoleGranted (sUSDe, REWARDER_ROLE)RoleChangeWARNINGRewarder role granted
RoleGranted (sUSDe, other/unlabeled role)RoleChangeERRORUnknown or unexpected role granted (fail-loud). DEFAULT_ADMIN_ROLE and restricted-staker roles are suppressed as echo/compliance noise
RoleRevoked (sUSDe, BLACKLIST_MANAGER_ROLE)RoleChangeERRORFreeze-power role revoked
RoleRevoked (sUSDe, other role)RoleChangeWARNINGNon-freeze role revoked (risk-reducing)
RoleAdminChanged (sUSDe)RoleChangeCRITICALsUSDe role-admin rewired — meta-authority over the permission system
LockedAmountRedistributedEmergencyActionCRITICALsUSDe locked stake seized/redistributed from restricted stakers
MaxMintPerBlockChanged (set to 0)EmergencyActionERRORUSDe minting halted — per-block mint limit dropped to 0
MaxMintPerBlockChanged (re-enabled from 0)EmergencyActionWARNINGUSDe minting re-enabled — mint limit raised off 0
MaxMintPerBlockChanged (other change)ProtocolParameterChangeWARNINGMax mint per block changed
MaxRedeemPerBlockChanged (set to 0)EmergencyActionERRORUSDe redemption halted — per-block redeem limit dropped to 0
MaxRedeemPerBlockChanged (re-enabled from 0)EmergencyActionWARNINGUSDe redemption re-enabled — redeem limit raised off 0
MaxRedeemPerBlockChanged (other change)ProtocolParameterChangeWARNINGMax redeem per block changed
AssetAddedProtocolParameterChangeERRORNew collateral asset added to USDe backing — needs eyeball ("is this asset legit?")
AssetRemovedProtocolParameterChangeWARNINGCollateral asset removed (de-risking)
TokenTypeSetProtocolParameterChangeERRORCollateral token classification changed (e.g. stable-bucket treatment)
CustodianAddressAddedAdminChangeERRORNew custodian destination authorized — collateral can be sent off-chain to it
CustodianAddressRemovedAdminChangeWARNINGCustodian destination removed (de-risking)
USDeSetContractUpgradeERROREthenaMinting USDe address changed
DelegatedSignerAddedRoleChangeWARNINGBenefactor delegated its own signing authority (counterparty-level)
DelegatedSignerRemovedRoleChangeWARNINGBenefactor removed a delegated signer
AdminTransferRequested (EthenaMinting)AdminChangeWARNINGEthenaMinting admin transfer requested (two-step step 1; pages on completion)
AdminTransferred (EthenaMinting)AdminChangeCRITICALEthenaMinting root admin transferred — controls mint, redeem and collateral custody
RoleGranted (EthenaMinting, MINTER/REDEEMER/COLLATERAL_MANAGER_ROLE)RoleChangeERRORFund- or supply-affecting role granted (mint USDe, release collateral, move backing to custody)
RoleGranted (EthenaMinting, GATEKEEPER_ROLE)RoleChangeWARNINGDefensive circuit-breaker role granted (can halt, not steal)
RoleGranted (EthenaMinting, other/unlabeled role)RoleChangeERRORUnknown or unexpected role granted (fail-loud). DEFAULT_ADMIN_ROLE suppressed (echo of AdminTransferred)
RoleRevoked (EthenaMinting)RoleChangeWARNINGAny EthenaMinting role revoked (de-risking); DEFAULT_ADMIN_ROLE suppressed
RoleAdminChanged (EthenaMinting)RoleChangeCRITICALEthenaMinting role-admin rewired — meta-authority over the permission system
MinterUpdated (USDe)RoleChangeCRITICALUSDe minter changed — sole authority to mint the synthetic dollar
OwnershipTransferred (USDe)AdminChangeERRORUSDe ownership transferred
OwnershipTransferStarted (USDe)AdminChangeWARNINGUSDe ownership transfer started (two-step step 1; pages on completion)
OperatorUpdated (StakingRewardsDistributor)RoleChangeWARNINGStakingRewardsDistributor operator updated
MintingContractUpdatedContractUpgradeERRORStakingRewardsDistributor minting contract updated
OwnershipTransferred (StakingRewardsDistributor)AdminChangeERRORStakingRewardsDistributor ownership transferred
OwnershipTransferStarted (StakingRewardsDistributor)AdminChangeWARNINGStakingRewardsDistributor ownership transfer started (two-step step 1; pages on completion)
TokensRescued (StakingRewardsDistributor)EmergencyActionCRITICALArbitrary ERC-20 swept out of the rewards distributor via rescueTokens — always warrants review

EtherFi (etherfi)

  • Chain(s): Ethereum
  • Products: eeth, weeth, liquid-eth. eETH is the rebasing liquid staking token and weETH its wrapped, non-rebasing form — they share the same underlying stack, so core-protocol events apply to both. Liquid ETH is a separate BoringVault product running automated DeFi strategies, with its own exchange-rate authority and access control. RoleRegistry, timelock, treasury and governance-Safe events are protocol-wide
  • Contracts monitored: 32. The core protocol no longer uses Ownable — eETH, weETH, LiquidityPool, WithdrawRequestNFT and EtherFiAdmin all resolve permissions through a single RoleRegistry as of the March 2025 migration, so that registry rather than any per-contract owner is the root of trust
    • Products — eETH 0x35fa164735182de50811e8e2e824cfb9b6118ac2, weETH 0xcd5fe23c85820f7b72d0926fc9b05b43e359b7ee, BoringVault (Liquid ETH) 0xf0bb20865277abd641a307ece5ee04e79073416c
    • Core protocol — LiquidityPool 0x308861a430be4cce5502d0a12724771fc6daf216, WithdrawRequestNFT 0x7d5706f6ef3f89b3951e23e557cdfbc3239d4e2c, EtherFiAdmin 0x0ef8fa4760db8f5cd4d993f3e3416f30f942d705, MembershipManager 0x3d320286e014c3e1ce99af6d6b00f0c1d63e3000, StakingManager 0x25e821b7197b146f7713c3b89b6a4d83516b912d, EtherFiNodesManager 0x8b71140ad2e5d1e7018d2a7f8a288bd3cd38916f, Liquifier 0x9ffdf407cde9a93c47611799da23924af3ef764f
    • Exit paths — EtherFiRedemptionManager 0xdadef1ffbfeaab4f68a9fd181395f68b4e4e7ae0 (instant redemption), PriorityWithdrawalQueue 0x35e7d6fef6f72add3c3e39dec6d9ccc29e3345fa (whitelisted). Together with the WithdrawRequestNFT queue these are three independent ways out, which is why several distinct pause events are reported separately
    • Root of trust, oracle and freeze power — RoleRegistry 0x62247d29b4b9becf4bb73e0c722cf6445cfc7ce9, EtherFiOracle 0x57aaf0004c716388b21795431cd7d5f9d3bb6a41, Blacklister 0x5585996e7cfe95f2d99e61168b8b35c66ff99b18
    • Governance — EtherFiTimelock (Upgrade) 0x9f26d4c958fd811a1f59b01b86be7dffc9d20761, EtherFiTimelock (Operating) 0xcd425f44758a08baab3c4908f3e3de5776e45d7a, Treasury 0x6329004e903b7f420245e7af3f355186f2432466. Both timelocks are monitored — the operating timelock carries more governance traffic than the upgrade one
    • Liquid ETH stack — Teller (LayerZero) 0x9aa79c84b79816ab920bbce20f8f74557b514734, Accountant 0x0d05d94a5f1e76c18fbeb7a13d17c8a314088198, RolesAuthority 0x485bde66bb668a51f2372e34e45b1c6226798122, Manager (merkle-verified) 0xf9f7969c357ce6dfd7973098ea0d57173592bcca, Withdraw Queue 0x0d2df071207e18ca8638b4f04e98c53155ec2ce0, Pauser 0x8e1f328a8500b643514bae8d8857b7b9b3729641, Solver 0x23aff90ed3b3effcf78fb41ab001c525a6c32a01. The vault's owner() is the zero address, so the RolesAuthority is its only control path — and that same authority also governs EtherFi's Liquid Bera ETH vault, so changes to it reach beyond this product
    • Seven Safes — Governance 0xcdd57d11476c22d265722f68390b036f3da48c21, Emergency Admin 0x2aca71020de61bb532008049e1bd41e451ae8adc, Fee Recipient 0x0c83eae1fe72c390a02e426572854931eeff93ba, Liquid ETH Treasury 1–4 0x7d4bbe471369a066186c18baf33622796a08d5cd, 0x7a6a41f353b3002751d94118aa7f4935da39bb53, 0x5f0e7a424d306e9e310be4f5bb347216e473ae55, 0xd022d6bb8b6c1c357ec77d930dc6a0ad40ffc90b
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (any of the bound proxies)ContractUpgradeERRORThe implementation behind a proxy is replaced while funds and storage stay in the unchanged proxy. Every upgrade pages so it can be matched to a known release. Coordinated releases touch several proxies in one window — the July 2026 release replaced the LiquidityPool, both tokens and the WithdrawRequestNFT together.
InitializedContractUpgradeERRORAn initializer ran. Expected exactly once per implementation, at deployment or immediately after an upgrade that adds storage. An occurrence that does not accompany an upgrade indicates a re-initialization rather than a normal deployment step.
AdminChanged (any proxy)AdminChangeCRITICALThe EIP-1967 proxy admin of a contract is replaced. The proxy admin can swap the implementation outright, so it sits above that contract's own roles and ownership in the trust chain.
RoleSet (RoleRegistry — guardian or timelock role, or an undecodable role id)RoleChangeERRORPrivilege is granted or revoked on the access-control root for eETH and weETH. Roles are uint256(keccak256(NAME)) and only the nine names the registry publishes as constants decode; every other id is a per-contract role whose name appears in no verified source. Those are deliberately treated as privileged rather than assumed benign, so most role events land here.
RoleSet (RoleRegistry — recognised operational role)RoleChangeWARNINGA named, bounded role changes hands — oracle, executor, eigenpod, housekeeping or multisig operations. Routine governance activity, recorded without paging.
OwnershipTransferred (RoleRegistry)AdminChangeCRITICALOwnership of the access-control root moves. The owner can rewrite every role assignment across the core protocol, including the guardian roles that can pause the tokens.
OwnershipTransferStarted (RoleRegistry)AdminChangeWARNINGFirst step of the two-step handover of the access-control root. Nothing has changed yet — the pending owner must still accept — so this is the advance warning, and the point at which an unexpected transfer can still be cancelled.
Paused / PausedUntil (eETH or weETH)EmergencyActionCRITICALThe rated token itself is frozen. All transfers stop, so the asset cannot move anywhere — DEX exits, lending-market collateral operations and wrapping all fail — while balances are untouched. weETH is the form most widely integrated elsewhere, so a pause there propagates into external protocols holding it. Both tokens only became pausable in the July 2026 upgrade.
Unpaused / UnpausedUntil (eETH or weETH)EmergencyActionWARNINGToken transfers resume. Risk-reducing, so it is held one tier below the pause rather than mirrored.
Paused / PausedUntil (LiquidityPool)EmergencyActionCRITICALDeposits and the initiation of withdrawals both stop. Holders can neither enter nor begin exiting; existing balances and secondary-market transfers still work while the tokens themselves are unpaused. This is the closest thing the protocol has to a full stop.
Unpaused / UnpausedUntil (LiquidityPool)EmergencyActionWARNINGDeposits and withdrawal initiation resume. Risk-reducing.
Paused / PausedUntil (WithdrawRequestNFT)EmergencyActionCRITICALQueued withdrawals cannot be claimed even once ready. Funds are not lost but are not retrievable through the standard path either; combined with a LiquidityPool pause it closes both ends of the exit.
Paused / PausedUntil (PriorityWithdrawalQueue)EmergencyActionCRITICALThe whitelisted priority exit path is blocked for the addresses that depend on it.
Unpaused / UnpausedUntil (either withdrawal contract)EmergencyActionWARNINGAn exit path reopens. Risk-reducing.
Paused / PausedUntil (RedemptionManager, Liquifier, NodesManager, MembershipManager, Oracle)EmergencyActionERRORA supporting contract halts. Each removes one route or function without trapping holders: instant redemption stops but the standard queue remains, non-ETH deposit conversion stops but plain ETH deposits continue, validator operations stop but exits keep working, membership unwraps stop, or rebase reporting stops so eETH accrual goes stale. Rated below the exit-blocking pauses for that reason. On 2024-12-11 the Oracle, MembershipManager and NodesManager were all paused on the same day — co-firing pauses across these contracts indicate a protocol-wide response rather than an isolated action.
Unpaused / UnpausedUntil (those contracts)EmergencyActionWARNINGThe supporting contract resumes. Risk-reducing.
PauseUntilDurationSetProtocolParameterChangeWARNINGThe maximum length of a timed pause is changed. Nothing stops now; it changes how long a future pause may last without anyone re-authorising it.
WithdrawRequestSeizedEmergencyActionCRITICALA pending withdrawal is represented as an NFT, and seizing one takes a named holder's already-queued exit away from them. Not a configuration change — a specific user loses a claim. It has occurred once historically, so more than one in a window distinguishes a targeted compliance action from a policy change.
WithdrawRequestInvalidatedEmergencyActionERRORA queued withdrawal is voided so it can no longer be claimed. Rare. The holder's underlying position is not necessarily lost but their queued exit is.
WithdrawRequestValidatedEmergencyActionINFOA previously invalidated request is reinstated. Risk-reducing and the expected closing half of an invalidation.
MaxWithdrawAmountSet / MinWithdrawAmountSetProtocolParameterChangeWARNINGPer-request withdrawal limits, both added in the July 2026 upgrade. Lowering the maximum throttles the exit path — large holders must split into more requests, extending time-to-exit. Raising the minimum is the sharper risk: holders whose entire balance falls below the new floor cannot use the standard exit at all.
MaxNegativeRebaseBpsUpdatedProtocolParameterChangeERRORThe circuit breaker on a downward rebase — how much loss a single oracle report may pass through to eETH holders. Raising it permits a deeper one-step drop in balances before the protocol refuses the report, so it directly bounds worst-case per-rebase holder loss.
UserBlacklisted / UserBlacklistedUntilEmergencyActionCRITICALAn individual holder is frozen and can no longer move the rated asset. This is the exercise of freeze power against a named address, not a configuration change, and the capability has never been used — so a first occurrence is significant regardless of target. Several in quick succession is a different event class from one.
UserUnblacklistedEmergencyActionWARNINGA freeze on an individual holder is lifted. Risk-reducing.
CommitteeMemberAdded / Removed / Updated (Oracle)RoleChangeERRORMembership of the committee that reports the consensus data driving the eETH rebase — in other words, the set of parties who can move the exchange rate. Churn is normal in rotations; the cases to watch are an addition without a matching removal while quorum is unchanged, or removals that take the live member count close to quorum.
QuorumUpdated (Oracle)ProtocolParameterChangeERRORHow many committee members must agree before a report is accepted — the collusion threshold protecting the exchange rate. A reduction makes a false report cheaper to push; an increase is defensive but raises the chance of a stalled rebase. Changed roughly once in the contract's life.
OracleReportPeriodUpdated / ConsensusVersionUpdatedProtocolParameterChangeWARNINGRebase cadence, or the expected report format. A longer period means stale accrual between reports rather than a solvency problem; a version mismatch stalls reporting.
ReportUnpublished (Oracle)EmergencyActionERRORA previously published oracle report is retracted — accepted data judged wrong after the fact. Historically unused.
MinDelayChange (either timelock, delay decreased)TimelockChangeERRORThe window in which a queued governance action can be seen and reacted to before it executes is shortened. The defensive value of a timelock is exactly its length.
MinDelayChange (either timelock, delay increased)TimelockChangeWARNINGThe reaction window is lengthened. Defensive.
CallScheduled (either timelock)TimelockChangeWARNINGA governance action is queued and becomes executable after the delay. Routine and high-volume, so the signal is in the target and calldata rather than the scheduling itself — but this is the point at which an upgrade or parameter change is still previewable and cancellable.
CallExecuted / Cancelled (either timelock)TimelockChangeINFOA queued action executed, or was withdrawn before executing. By execution time the delay has already elapsed and there is no remaining window to intervene; the matching CallScheduled carries the reviewable detail.
RoleGranted / RoleRevoked (timelock — proposer, canceller or admin, or an unrecognised hash)RoleChangeERRORControl over who may queue or block governance actions. A proposer can queue anything and a canceller can block legitimate actions, so both are escalated; an unrecognised role hash fails loud rather than being assumed benign.
RoleGranted / RoleRevoked (timelock — executor)RoleChangeWARNINGExecution permission changes hands. Lower risk because the delay has already run by the time an executor acts, and this role is sometimes granted broadly on purpose.
RoleAdminChanged (timelock)RoleChangeERRORWhich role administers another role is rewired — meta-authority over the permission system rather than a single grant.
ERC20Recovered / ERC721Recovered / ETHRecoveredEmergencyActionERRORA sweep function moves assets out of a token contract. Intended for funds sent there by mistake, so the routine case is a stray token being rescued; the cases to watch are a swept asset the protocol actually accounts for, or a non-treasury recipient.
ValidatorSpawnerRegistered / UnregisteredRoleChangeWARNINGAn address gains or loses the ability to spawn validators from pooled ETH. A permissioned operational role on the staking path, not a claim on user funds.
UserAllowedForwardedExternalCallsUpdated / UserAllowedForwardedEigenpodCallsUpdatedRoleChangeERRORAn address is allowed to forward arbitrary calls, for a given function selector and target, through a validator node or its EigenPod. The node holds staked-ETH withdrawal credentials and the pod holds the restaking position, so what the allowlisted caller can reach matters more than the grant itself.
ExchangeRateUpdated (Liquid ETH — increase or unchanged)ProtocolParameterChangeINFOThe Liquid ETH share price is updated. This is the vault's NAV per share and what deposits and withdrawals price against. Updates are routine and roughly daily, and the rate is near-monotonically increasing as yield accrues.
ExchangeRateUpdated (Liquid ETH — decrease up to 0.15%)ProtocolParameterChangeWARNINGThe share price fell by an amount consistent with fee accrual or a minor NAV correction. Decreases are uncommon and every one in the contract's history has been smaller than 0.13%, so this tier covers the observed envelope.
ExchangeRateUpdated (Liquid ETH — decrease above 0.15%)ProtocolParameterChangeERRORA drop larger than anything observed historically, though still permitted by the contract's own bound.
ExchangeRateUpdated (Liquid ETH — decrease at or near 0.50%)ProtocolParameterChangeCRITICALThe Accountant rejects any single update beyond ±0.50%, so this is the maximum loss one report can inflict on holders. A drop at that floor is at the mechanical limit of what a single update can do. Note the per-update bound does not limit a sustained slide across several updates.
Paused (Accountant)EmergencyActionCRITICALThe Liquid ETH exchange rate is frozen, which halts both deposits and withdrawals because neither can be priced. It disables the rate rather than the funds — assets remain in the vault — but it is the single most disabling switch on the product.
Unpaused (Accountant)EmergencyActionWARNINGRate updates resume so deposits and withdrawals can be priced again. Risk-reducing; expect the first update after a gap to reflect accrual across it.
LowerBoundUpdated (Liquid ETH — floor widened)ProtocolParameterChangeERRORHow far the share price may fall in one update. This is the leading indicator for a large rate drop: a decrease beyond the existing floor is mechanically impossible until this bound is widened first, so it is the precursor rather than the consequence. Historically unused.
UpperBoundUpdated (Liquid ETH — bound raised)ProtocolParameterChangeERRORHow far the share price may rise in one update. Raising it permits larger single-step jumps, weakening the guard against a mispriced or manipulated report. Historically unused.
Upper/LowerBoundUpdated (tightened)ProtocolParameterChangeINFOA rate bound is narrowed. Defensive.
ManagementFeeUpdated (Liquid ETH)ProtocolParameterChangeWARNINGThe fee accruing against Liquid ETH NAV is raised, diluting holder returns over time rather than causing a step loss. A reduction is reported at INFO.
DelayInSecondsUpdated (Liquid ETH)ProtocolParameterChangeWARNINGThe minimum interval the Accountant enforces between rate updates is shortened, allowing more frequent repricing. A rate limiter, not a bound on any single update.
RateProviderUpdated (Liquid ETH)ProtocolParameterChangeERRORThe oracle or price source the Accountant uses for an asset is swapped, or the asset is marked pegged. The rate provider sits upstream of the share price, so this changes what the vault believes its assets are worth.
PayoutAddressUpdated (Liquid ETH)ProtocolParameterChangeWARNINGThe destination for accrued management fees changes. Redirects protocol revenue; holder assets and the share price are untouched.
PublicCapabilityUpdated (Liquid ETH — made public)RoleChangeERRORA function on the Liquid ETH stack becomes callable by anyone, removing role-based access control from it. This has been used repeatedly in normal operation to open genuinely public entry points, so the signal is entirely in which target and selector were opened — a deposit path is expected, the vault, Manager or Accountant is not.
PublicCapabilityUpdated (made non-public)RoleChangeINFOA previously public function requires a role again. Risk-reducing.
UserRoleUpdated (Liquid ETH — manager or pauser role)RoleChangeERRORControl over strategy execution or the pause switch changes hands. Roles here are numeric with no on-chain names.
UserRoleUpdated (Liquid ETH — other role) / RoleCapabilityUpdatedRoleChangeWARNINGA bounded role is granted or revoked, or the permission table is rewired to define which function a role may call. Routine during strategist rotation and deployment.
OwnershipTransferred / AuthorityUpdated (Liquid ETH vault, Accountant, RolesAuthority, Teller, Manager, Queue, Pauser)AdminChangeCRITICALControl of a Liquid ETH stack contract moves, or it is repointed at a different permission set. Because the vault's owner() is the zero address, the authority pointer is the only control path over it — repointing hands over the vault in a single call. Historically these are genesis-only events.
OwnershipTransferred / AuthorityUpdated (Solver)AdminChangeERRORControl of the queue solver moves. It executes against the queue rather than custodying assets, so it ranks below the other stack contracts.
ManageRootUpdated (Liquid ETH)ProtocolParameterChangeERRORThe merkle root enumerating every call a strategist may make with vault assets is replaced — in other words the vault's entire strategy allowlist, including which protocols and calldata shapes are reachable. The event exposes only root hashes, so the permitted call set is not visible on-chain; judge it by the caller and whether it accompanied an announced strategy change.
Paused / Unpaused (Manager)EmergencyActionERROR / WARNINGStrategist operations on Liquid ETH assets stop or resume. Deposits, withdrawals and the exchange rate are unaffected — the vault simply stops being actively managed — which is why this sits below the user-facing pauses.
Paused (Liquid ETH withdraw queue)EmergencyActionCRITICALHolders are blocked from requesting or completing Liquid ETH exits. A direct liquidity restriction on the rated product.
Unpaused (Liquid ETH withdraw queue)EmergencyActionWARNINGLiquid ETH withdrawals resume. Risk-reducing.
WithdrawAssetStopped (Liquid ETH)ProtocolParameterChangeERRORAn asset holders could withdraw into is removed, narrowing the exit routes out of the vault. Holders are not trapped while another remains, so the question is how many are left.
WithdrawAssetUpdated (Liquid ETH)ProtocolParameterChangeWARNINGThe discount range, maturity and deadline for withdrawing into a given asset change. The discount range is what a holder pays to exit, so widening it raises the worst-case exit cost even though the route stays open.
WithdrawAssetSetup (Liquid ETH)ProtocolParameterChangeINFOA new asset can be withdrawn into — an additional exit route, so directionally risk-reducing.
PausablePaused (Liquid ETH Pauser)EmergencyActionCRITICALA dedicated Pauser contract halts a registered Liquid ETH contract. The blast radius depends on which contract was hit — a Teller or queue pause blocks users, a Manager pause only stops strategists. Several paused through this route in one transaction indicates a coordinated shutdown.
PausableUnpausedEmergencyActionWARNINGA registered contract is unpaused via the Pauser. Risk-reducing.
PausableRemovedProtocolParameterChangeERRORA contract is removed from the Pauser's coverage and can no longer be paused through that route, reducing emergency-response capability for it.
PausableAdded / SenderToPausableUpdatedProtocolParameterChange / RoleChangeWARNINGA contract is brought under the Pauser's umbrella, or the mapping of which sender may pause which contract changes. Expands or redelegates pause authority.
Paused / Unpaused (Teller)EmergencyActionCRITICAL / WARNINGThe Liquid ETH deposit and withdrawal entry point stops or resumes. Assets and the exchange rate are untouched, but holders can neither enter nor exit. Alongside the Accountant and the queue this is one of three switches that can close the product to users.
AssetDataUpdated (Teller)ProtocolParameterChangeWARNINGWhich assets can be deposited or withdrawn, and the share premium applied. Two things travel in one event: toggling deposits or withdrawals off for an asset closes a route, while a premium change alters what a depositor pays relative to NAV.
DenyFrom / DenyTo / DenyOperator (Teller)EmergencyActionERRORA specific address is blocked from depositing, from receiving Liquid ETH shares, or from acting as operator. An address-level restriction rather than a protocol-wide one; existing holdings are unaffected, though a denied recipient can strand a counterparty mid-flow.
AllowFrom / AllowTo / AllowOperator (Teller)ProtocolParameterChangeWARNINGA previously denied address regains access. Risk-reducing.
PeerSet (Teller)ProtocolParameterChangeERRORThe trusted LayerZero counterpart contract on another chain is repointed — the cross-chain trust anchor for Liquid ETH.
ChainAdded / ChainRemoved (Teller)ProtocolParameterChangeERRORA cross-chain route is opened or closed. Adding expands the bridge surface; removing closes the sanctioned route back, so the practical question is whether value is stranded on the far side.
ChainStopMessagesFrom / ChainStopMessagesTo (Teller)EmergencyActionERRORInbound or outbound bridge messages for a chain are halted. Often a defensive response to a problem on the far side — it protects this chain while potentially stranding holders on the other.
ChainAllowMessagesFrom / ChainAllowMessagesTo, Inbound/OutboundRateLimitsChangedProtocolParameterChangeWARNINGBridge messaging is re-enabled for a chain, or the cap on how much value may cross in a window changes. The rate limits bound the damage a compromised remote route can do; loosening raises that ceiling, tightening can slow legitimate cross-chain exits.
ChainSetGasLimit (Teller)ProtocolParameterChangeINFOThe gas budget for bridge messages to a chain. Operational tuning — an under-provisioned limit causes messages to fail rather than misdeliver.
EnabledModule (any Safe)MultisigChangeCRITICALA Gnosis Safe module executes transactions without collecting signatures, so enabling one bypasses the signer threshold entirely for whatever that module permits. The Safe's security becomes only as strong as the module's.
ChangedThreshold (any Safe)MultisigChangeCRITICALThe number of signatures a Safe requires changes. A reduction weakens every future approval — a 3-of-5 becoming 1-of-5 means one compromised key suffices. Governance and emergency-admin Safes control protocol behaviour; treasury Safes hold funds.
ChangedGuard / ChangedFallbackHandler (any Safe)MultisigChangeERRORA Safe guard can inspect and veto every transaction the Safe makes, and the fallback handler decides how it responds to unrecognised calldata. Removing or replacing either changes what the Safe is permitted to do, and a malicious guard can block legitimate action.
AddedOwner / RemovedOwner / DisabledModule (any Safe)MultisigChangeWARNINGSigner set or module changes. Routine in rotations; the risks are dilution when owners are added without raising the threshold, and fragility when removals leave the owner count at or near it.
SafeSetupMultisigChangeINFOInitial configuration of a Safe. A genesis event by nature.
OwnershipTransferred (Treasury, MembershipManager)AdminChangeERRORThese two still use Ownable rather than the RoleRegistry, so their owners are independent control paths. The Treasury holds accumulated protocol revenue rather than holder principal, which is why it sits below the root-of-trust transfers.
FundsMigrated (MembershipManager)EmergencyActionERRORA membership position's underlying funds are moved. The bulk of these happened during a one-time 2023 migration, so an occurrence now sits outside that context.
DustSwept (RedemptionManager)EmergencyActionWARNINGResidual balances are swept out of the redemption contract. Housekeeping by design; the cases to watch are a swept token that is part of protocol accounting, or a non-treasury recipient.
WhitelistUpdated (PriorityWithdrawalQueue)RoleChangeERRORWho may use the priority withdrawal queue — that is, who gets preferential exit treatment relative to the standard queue. Priority access is an ordering advantage over other holders during a stressed exit.
WithdrawRequestInvalidated / Cancelled (PriorityWithdrawalQueue)EmergencyActionERROR / INFOA priority-queue request is voided by an admin, or cancelled and returned to the holder. Cancellation is normally user-initiated, which is why it is informational.

HyperLend (hyperlend)

  • Chain(s): HyperEVM
  • Products: rated as a single product — the HYPE Core Market (product hype, the WHYPE reserve 0x5555…5555). Most incidents are protocol-wide (product: ""); only events on the rated HYPE reserve escalate above INFO and carry product: hype. The exchange-rate series (getReserveNormalizedIncome, the HYPE supply liquidity index) is polled for hype.
  • Contracts monitored:
    • Pool — 0x00A89d7a5A02160f20150EbEA7a2b5E4879A1A8b
    • PoolConfigurator — 0x8CB4310dD38F6fD59388C9DE225f328092bdC379
    • PoolAddressesProvider — 0x72c98246a98bFe64022a3190e7710E157497170C
    • ACLManager — 0x10914Ee2C2dd3F3dEF9EFFB75906CA067700a04A
    • ProxyAdmin — 0xdb3Bf3e22380780F75D7F57C772e71fCa7EBA027
    • TimelockA — 0xaAaaaAAAa810beD1EDA93A18FEC940857ED17879
    • TimelockB — 0xbbBBbbBB81e9B92918AA51e0CDfB3B53f7D72432
    • TimelockC — 0xCCcCCcCCC4B6CD09594E7c5bF108695F79313115
    • GovernanceMultisig — 0x2110E7B8e925C387A88259CEac9bd82c47868E9C
    • TreasuryMultisig — 0xCBF400610DBF462fE316D8A7db6Ba78d57E43d7b
    • EmergencyAdminMultisig — 0xC2A0F2c78dd7E37C82aA3A8e37fc712a3ddb7cAc
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (ACLManager — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key that can administer every other role — effectively whole-protocol control. The highest-trust change the protocol can make, so it pages at top urgency.
RoleGranted (ACLManager — POOL_ADMIN / EMERGENCY_ADMIN / ASSET_LISTING_ADMIN)RoleChangeERRORA new address gains a powerful privileged role: pool administration (including upgrading the tokens that hold user funds), the ability to pause the protocol, or control over which price oracles are used. Each can materially affect funds or availability, so granting it pages.
RoleGranted (ACLManager — RISK_ADMIN / BRIDGE)RoleChangeWARNINGA new address gains a bounded operational role — tuning risk parameters within limits, or bridge minting capped by configuration. Expected governance activity, recorded for visibility but does not page.
RoleGranted (ACLManager — FLASH_BORROWER)RoleChangeINFOA new address is exempted from flash-loan premiums. Carries no governance power and cannot affect other users, logged for completeness only.
RoleGranted (ACLManager — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name is granted. An unmapped or custom role could be powerful, so it is treated as potentially dangerous and paged ("fail loud").
RoleRevoked (ACLManager — DEFAULT_ADMIN / EMERGENCY_ADMIN / POOL_ADMIN)RoleChangeERRORA role whose loss is dangerous is removed — the root key (removal can lock out governance), the emergency-pause ability (losing it removes the protocol's exploit brake), or pool administration. Worth paging even though revocations usually reduce risk, because these can also signal a hostile takeover or an operational mistake.
RoleRevoked (ACLManager — other roles)RoleChangeWARNINGA lower-impact role (e.g. risk admin, asset-listing admin) is removed. Reducing privilege is generally safe, so it is recorded but does not page.
RoleAdminChanged (ACLManager)RoleChangeCRITICALThe rule for who may grant or revoke a role is rewired — a structural change to the access-control graph itself, not just who holds a role. This is meta-authority over the entire permission system: changing the admin of a powerful role (e.g. POOL_ADMIN or the root DEFAULT_ADMIN) is a direct privilege-escalation / takeover vector. It is not part of normal operations, so any occurrence is maximally anomalous — paged at the highest severity, same tier as a root-authority or oracle swap.
MinDelayChange (Timelock, decrease)TimelockChangeERRORTimelock delay decreased
MinDelayChange (Timelock, increase)TimelockChangeWARNINGTimelock delay increased
RoleGranted (Timelock — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the timelock's own admin role — it can grant itself proposer and executor and bypass the delay entirely, i.e. full control of the governance queue. Pages at top urgency.
RoleGranted (Timelock — PROPOSER / CANCELLER)RoleChangeERRORA new address gains the ability to schedule arbitrary privileged operations into the timelock queue (proposer), or to cancel a pending operation before it executes (canceller — can block an emergency governance action). Each is a governance-integrity change worth paging.
RoleGranted (Timelock — EXECUTOR)RoleChangeWARNINGA new address may execute operations that are already scheduled and past their delay — it cannot introduce new actions, so it is recorded but does not page.
RoleGranted (Timelock — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name is granted; treated as potentially powerful and paged ("fail loud").
RoleRevoked (Timelock — DEFAULT_ADMIN / CANCELLER)RoleChangeERRORA capability whose loss is dangerous is removed — the timelock admin (removal can lock out / brick governance) or the canceller (removes the brake that can stop a malicious pending operation). Worth paging.
RoleRevoked (Timelock — PROPOSER / EXECUTOR)RoleChangeWARNINGA lower-impact timelock role is removed. Reducing privilege is generally safe and recoverable, so it is recorded but does not page.
ACLAdminUpdatedAdminChangeERRORChanges which address is registered as the ACL admin — the account tied to the ACLManager's root DEFAULT_ADMIN role that ultimately grants and revokes every other role. A root-of-trust change, so it always pages. Unlike ACLManagerUpdated, this updates a stored pointer rather than swapping the live authority contract, so it is ERROR rather than CRITICAL.
ACLManagerUpdatedContractUpgradeCRITICALRepoints the protocol at a different ACLManager contract. Because permission checks resolve the manager at runtime, a swap immediately changes the authority behind every privileged action — a malicious manager could make anyone a pool admin and drain funds. Outside initial setup this is not a normal operation, so any occurrence is a top-urgency, funds-at-risk event.
PoolUpdatedContractUpgradeERRORUpgrades the implementation behind the core Pool proxy — replacing the code of the main lending contract while funds and storage stay in the unchanged proxy. Governance-gated and routine, but because it ships new code for the contract at the heart of the protocol, every upgrade pages so it can be matched to a known governance proposal. (Co-fires with the Pool-proxy Upgraded event.)
PoolConfiguratorUpdatedContractUpgradeERRORUpgrades the implementation behind the PoolConfigurator proxy — the privileged contract that sets every reserve's risk parameters (caps, collateral config, freeze/pause). A malicious configurator could mis-set parameters market-wide, but it does not custody funds; each upgrade pages so the new code can be matched to a known governance proposal.
PriceOracleUpdatedContractUpgradeCRITICALSwaps the protocol's entire price-oracle contract. Pricing is resolved at runtime, so a swap instantly repoints all collateral valuation and liquidations — a malicious or buggy oracle is one of the fastest ways to drain a lending pool. Outside initial setup this is not a normal operation; any occurrence is a top-urgency, funds-at-risk event. (Routine per-asset feed changes use a different event.)
OwnershipTransferred (AddressesProvider)AdminChangeCRITICALOwnership of the PoolAddressesProvider — the market's master registry — moves to a new address. Its owner is the single key that can swap the Pool, the PoolConfigurator, the ACLManager, and the price oracle, i.e. it can trigger every one of the funds-at-risk events above. Transferring it is the protocol's top root-of-trust change. Ownership moves only as part of a governance migration (the legitimate owner is the governance pipeline), so any other occurrence is a top-urgency, funds-at-risk event.
ProxyCreatedContractUpgradeINFOThe AddressesProvider deploys a brand-new proxy for a registry slot. Fires only the first time a proxied component is registered, and co-fires with the meaningful event for that component (PoolUpdated / AddressSetAsProxy) which carries the real severity. On its own it grants no privileges and moves no funds, so it is recorded for completeness only.
AddressSetAsProxyContractUpgradeERRORUpgrades the implementation behind a registered proxy via the generic registry path — the same mechanism as PoolUpdated, but for a registry slot without its own dedicated setter. It swaps the executing code of a governance-controlled proxy, so it carries the same risk class as a Pool/Configurator upgrade and pages, to be matched against a known governance proposal.
ReserveFactorChanged (≤50%)ProtocolParameterChangeINFOThe reserve factor — the share of borrow interest diverted to the treasury rather than to suppliers — is changed for an asset. A routine economic knob with no fund-custody, collateral, or solvency reach. Normal values sit in a ~5–50% band, so changes within it are dashboard-only.
ReserveFactorChanged (>50%)ProtocolParameterChangeWARNINGThe new reserve factor exceeds 50%, outside the normal operating band — typically an asset being offboarded or a special-asset setting. Surfaced for confirmation that it is intended; it does not page.
FlashloanPremiumTotalUpdated (≤1%)ProtocolParameterChangeINFOThe total flash-loan premium (the fee on a flash loan) is changed. The lowest-stakes fee — it cannot reach funds or solvency (a high premium just makes flash loans expensive, a zero premium just makes them free; the loan must still be repaid in the same transaction). Normal values are a few bps, so changes within range are dashboard-only.
FlashloanPremiumTotalUpdated (>1%)ProtocolParameterChangeWARNINGThe new flash-loan premium exceeds 1% — roughly a tenfold jump over the 5–9 bps norm. There is no legitimate reason for such a value, so it is surfaced as a likely misconfiguration or tampering signal. It does not page.
FlashloanPremiumToProtocolUpdatedProtocolParameterChangeINFOChanges how the flash-loan premium is split between the treasury and suppliers (0–100%). The borrower's total fee is unchanged — only who receives it — so there is no fund or solvency reach. Recorded for completeness.
BridgeProtocolFeeUpdatedProtocolParameterChangeWARNINGThe bridge protocol fee is changed. The fee itself is a harmless bounded split, but it belongs to the dormant Portal / unbacked-mint subsystem, which has never been used on HyperLend. Any change is a canary that someone is configuring Portal, so it is surfaced — dashboard-only, never pages.
LiquidationProtocolFeeChanged (≤30%)ProtocolParameterChangeINFOThe protocol's cut of the liquidation bonus for an asset is changed, within the normal band. Routine; recorded dashboard-only.
LiquidationProtocolFeeChanged (>30%)ProtocolParameterChangeWARNINGThe new cut exceeds 30% — high enough to erode the liquidator's margin, which can stall liquidations and create bad-debt / solvency risk. Surfaced for review; the risk is gradual (not instant loss) and the parameter is bounded, so it is dashboard-only and does not page.
ATokenUpgradedContractUpgradeERRORUpgrades the aToken implementation for a reserve — the contract that custodies suppliers' deposits. A fund-bearing code swap, so it pages to be matched against a known governance proposal. Not CRITICAL (routine per-asset migration). The HYPE reserve tags product hype; other reserves are protocol-wide.
VariableDebtTokenUpgradedContractUpgradeERRORUpgrades the variable-debt-token implementation for a reserve — the contract that tracks borrowers' debt. Same fund-bearing risk class as the aToken upgrade; pages to be matched against a known governance proposal.
ReserveInterestRateStrategyChangedProtocolParameterChangeINFOPoints a reserve at a different interest-rate-strategy contract (the contract that computes borrow/supply rates from utilization). Affects only rates, not custody — a bad curve could grief with extreme rates but cannot move funds and is fully recoverable. On HyperLend (Aave v3.0.2) this is the sole rate-model-change signal; there is no V3.2 interest-rate-data event. Tracked on the dashboard, not paged.
ReservePaused (HYPE, paused)EmergencyActionCRITICALEmergency halt of the HYPE reserve — pausing blocks every interaction with the asset including withdrawals and liquidations, so the rated product goes fully dark and user funds are locked in place. Strictly more severe than a freeze (which still lets users exit). Paged immediately whether it is protective incident response or hostile. Never fired on HyperLend to date.
ReservePaused (HYPE, unpaused)EmergencyActionWARNINGThe HYPE reserve is taken out of pause and restored to normal operation — the recovery / all-clear signal. Dashboard, not paged.
ReservePaused (other reserves)EmergencyActionINFOA non-rated reserve in the market is paused/unpaused. Tracked on the dashboard only.
ReserveFrozen (HYPE, frozen)EmergencyActionERRORThe HYPE reserve is frozen — new supply and borrow are blocked, but users can still repay, withdraw, and be liquidated, so funds are not locked. The graceful asset-offboarding tool, one tier below a pause; material enough to page, but not critical because exits stay open.
ReserveFrozen (HYPE, unfrozen)EmergencyActionWARNINGThe HYPE reserve is unfrozen and re-enabled for new supply and borrow — the recovery signal. Dashboard, not paged.
ReserveFrozen (other reserves)EmergencyActionINFOA non-rated reserve is frozen/unfrozen. Tracked on the dashboard only (the freezes to date were all on non-rated reserves).
CollateralConfigurationChanged (HYPE, LTV→0 or liquidation-threshold cut ≥5%)ProtocolParameterChangeERRORThe solvency-critical collateral parameters of the HYPE reserve — loan-to-value (LTV), liquidation threshold (LT), and liquidation bonus. Two cases page: (1) a drop in the liquidation threshold, which makes existing positions immediately liquidatable and can trigger a wave of forced liquidations and bad debt — the genuinely dangerous direction; (2) LTV set to 0, which disables HYPE as new collateral (a protective de-risking signal). Evaluated against the previous on-chain value, so only a real transition pages.
CollateralConfigurationChanged (HYPE, other change)ProtocolParameterChangeWARNINGRoutine re-parameterisation of HYPE collateral — raising LTV/threshold, small adjustments, or liquidation-bonus tweaks. Material enough to record but not dangerous to existing positions, so it is tracked on the dashboard rather than paged.
CollateralConfigurationChanged (other reserves)ProtocolParameterChangeINFOCollateral config change on a non-rated reserve. Dashboard only.
BorrowCapChanged (HYPE, disabled)ProtocolParameterChangeWARNINGThe HYPE borrow cap is cut to the "disabled" sentinel (a cap of 1 token), effectively stopping new borrowing of the asset — a wind-down / de-risking signal. Surfaced on the dashboard for prominence (it correlates with freezes and collateral de-risking), but not paged: the cap only limits new borrowing and never affects existing positions or funds.
BorrowCapChanged (other)ProtocolParameterChangeINFORoutine borrow-cap adjustment, or any change on a non-rated reserve. Cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
SupplyCapChanged (HYPE, disabled)ProtocolParameterChangeWARNINGThe HYPE supply cap is cut to the "disabled" sentinel (a cap of 1 token), effectively stopping new deposits — a wind-down signal. Surfaced on the dashboard for prominence, but not paged: the cap only limits new deposits and never affects existing positions or funds.
SupplyCapChanged (other)ProtocolParameterChangeINFORoutine supply-cap adjustment, or any change on a non-rated reserve. Cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
OwnershipTransferred (ProxyAdmin)AdminChangeCRITICALOwnership of the ProxyAdmin — the contract that owns the transparent proxies and can upgrade their implementations — moves to a new address. Whoever owns it can swap the fund-bearing proxy code, i.e. upgrade the protocol; it is HyperLend's root upgrade key (the structural equivalent of Aave's governance executor). The legitimate owner is the governance pipeline; ownership moves only during a governance migration, so any other occurrence is a top-urgency, funds-at-risk event.
Upgraded (Pool)ContractUpgradeERRORThe implementation behind the main Pool proxy is swapped. The Pool holds all core lending logic (supply, borrow, liquidate, interest accrual), so a logic swap can change every accounting rule in the market — the single most powerful upgrade in the protocol. Twins with PoolUpdated from the PoolAddressesProvider (the registry-side announcement of the same swap). Pages at ERROR; CRITICAL is reserved for unstoppable-takeover changes (Safe threshold/module). Seen 4 times — all legitimate Aave-fork version upgrades.
AddedOwner (Safe)MultisigChangeERRORA new signer is added to one of HyperLend's admin Safes (Governance / Treasury / EmergencyAdmin), which sit atop the governance pipeline. Changing who can authorize the multisig's actions alters the protocol's trust set, so it pages to be confirmed against a known governance decision. Not CRITICAL: adding a signer without also lowering the threshold does not grant unilateral control.
RemovedOwner (Safe)MultisigChangeERRORA signer is removed from one of HyperLend's admin Safes (Governance / Treasury / EmergencyAdmin). The mirror of AddedOwner — it alters who controls the multisig (rotating out a compromised key, or a hostile actor pruning honest signers). Pages to be confirmed against a known governance decision; not CRITICAL on its own unless paired with a threshold drop (which pages CRITICAL separately).
ChangedThreshold (Safe)MultisigChangeCRITICALChanges how many signer approvals (M of N) the Safe requires. The threshold is the multisig's security — lowering it, especially to 1, collapses the Safe to effectively single-signer control, so one key (compromised, malicious, or coerced) can unilaterally execute anything it controls (here, the whole governance pipeline). An instant takeover-class change, so it pages at the top tier on any threshold change.
EnabledModule (Safe)MultisigChangeCRITICALA Safe module is enabled. Modules can execute transactions through the Safe bypassing the M-of-N signature check entirely — so a malicious or buggy module can move funds and drive the governance pipeline with zero signer approvals, regardless of the threshold. The most dangerous Safe change there is; never used on HyperLend, so a first-ever occurrence is highly anomalous and paged at the top tier.
DisabledModule (Safe)MultisigChangeERRORA previously-enabled Safe module is removed. Generally risk-reducing (it removes a signature-bypass path), so a tier below enabling one — but still an execution-surface change worth a look, since it could be benign cleanup or the hostile removal of a legitimate safety/recovery module. Never used on HyperLend.
ChangedGuard (Safe)MultisigChangeERRORA transaction guard is set, replaced, or removed on a HyperLend Safe. A guard hooks every Safe transaction (pre/post execution) and can revert any of them, so a malicious guard can freeze the multisig (DoS) and removing one strips a protective check — an execution-control change paged at ERROR. Never used on HyperLend.
ChangedFallbackHandler (Safe)MultisigChangeERRORThe fallback handler on a HyperLend Safe is set or replaced. The handler runs in the Safe's context for calls that match none of its own functions and can expand the Safe's callable surface — e.g. forging EIP-1271 "valid signature" responses so other contracts accept the Safe's approval without a real multisig vote. Quieter than a guard/module change and can't move funds itself, but still a callable-surface change paged at ERROR. Never used on HyperLend.

Kelp (kelp)

  • Chain(s): Ethereum
  • Products: rseth, plus protocol-wide for Timelock/Safe governance contracts
  • Contracts monitored:
    • rsETH Token — 0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7
    • LRTDepositPool — 0x036676389e48133B63a802f8635AD39E752D375D
    • LRTOracle — 0x349A73444b1a310BAe67ef67973022020d70020d
    • TimelockController — 0x49bD9989E31aD35B0A62c20BE86335196A3135B1
    • External Admin Safe (6/8) — 0xb3696a817D01C8623E66D156B6798291fa10a46d
    • ProxyAdmin — 0xb61e0E39b6d4030C36A176f576aaBE44BF59Dc78
    • LRTWithdrawalManager — 0x62De59c08eB5dAE4b7E6F7a8cAd3006d6965ec16
    • LRTUnstakingVault — 0xc66830e2667bc740c0bed9a71f18b14b8c8184ba
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Paused (rsETH)EmergencyActionCRITICALrsETH token paused
Unpaused (rsETH)EmergencyActionCRITICALrsETH token unpaused
CustodyAddressUpdated (rsETH)AdminChangeERRORrsETH custody address updated
UpdatedLRTConfig (rsETH)AdminChangeERRORrsETH LRT config updated
FrozenFundsRecovered (rsETH)EmergencyActionCRITICALFrozen funds recovered from/to addresses
UserTransfersBlocked (rsETH)EmergencyActionERRORUser transfers blocked until timestamp
MaxMintAmountPerDayUpdated (rsETH)ProtocolParameterChangeWARNINGrsETH max mint amount per day updated
Paused (LRTDepositPool)EmergencyActionCRITICALLRTDepositPool paused
Unpaused (LRTDepositPool)EmergencyActionCRITICALLRTDepositPool unpaused
MinAmountToDepositUpdatedProtocolParameterChangeINFOMin amount to deposit updated
MaxNodeDelegatorLimitUpdatedProtocolParameterChangeWARNINGMax node delegator limit updated
NodeDelegatorAddedinQueueAdminChangeWARNINGNode delegator added to queue
NodeDelegatorRemovedFromQueueAdminChangeWARNINGNode delegator removed from queue
UpdatedLRTConfig (LRTDepositPool)AdminChangeERRORLRTDepositPool LRT config updated
RsETHPriceDecrease (LRTOracle)EmergencyActionERRORrsETH price decreased
RsETHPriceBelowPeak (LRTOracle)EmergencyActionWARNINGrsETH price below peak
AssetPriceOracleUpdate (LRTOracle)ProtocolParameterChangeWARNINGAsset price oracle updated
PricePercentageLimitUpdate (LRTOracle)ProtocolParameterChangeWARNINGPrice percentage limit updated
MaxFeeMintAmountPerDayUpdated (LRTOracle)ProtocolParameterChangeWARNINGMax fee mint amount per day updated
Paused (LRTOracle)EmergencyActionCRITICALLRTOracle paused
Unpaused (LRTOracle)EmergencyActionCRITICALLRTOracle unpaused
UpdatedLRTConfig (LRTOracle)AdminChangeERRORLRTOracle LRT config updated
Paused (LRTWithdrawalManager)EmergencyActionCRITICALLRTWithdrawalManager paused
Unpaused (LRTWithdrawalManager)EmergencyActionCRITICALLRTWithdrawalManager unpaused
EmergencyWithdrawFromAaveEmergencyActionCRITICALEmergency withdrawal from Aave
InstantWithdrawalFeeUpdatedProtocolParameterChangeWARNINGInstant withdrawal fee updated
InstantWithdrawalFeeRecipientUpdatedProtocolParameterChangeWARNINGInstant withdrawal fee recipient updated
InstantWithdrawalEnabledUpdatedProtocolParameterChangeWARNINGInstant withdrawal enabled/disabled for asset
WithdrawalDelayBlocksUpdatedProtocolParameterChangeWARNINGWithdrawal delay blocks updated
MinAmountToWithdrawUpdatedProtocolParameterChangeINFOMin amount to withdraw updated
AaveIntegrationConfiguredProtocolParameterChangeWARNINGAave integration configured
AaveIntegrationEnabledProtocolParameterChangeWARNINGAave integration enabled/disabled
UpdatedLRTConfig (LRTWithdrawalManager)AdminChangeERRORLRTWithdrawalManager LRT config updated
Paused (LRTUnstakingVault)EmergencyActionERRORLRTUnstakingVault paused
Unpaused (LRTUnstakingVault)EmergencyActionERRORLRTUnstakingVault unpaused
MaxUncompletedWithdrawalCountSetProtocolParameterChangeWARNINGMax uncompleted withdrawal count set
QueuedWithdrawalsBufferUpdatedProtocolParameterChangeINFOQueued withdrawals buffer updated
UpdatedLRTConfig (LRTUnstakingVault)AdminChangeERRORLRTUnstakingVault LRT config updated
MinDelayChange (Timelock, decreased)TimelockChangeERRORTimelock min delay decreased (higher risk)
MinDelayChange (Timelock, increased)TimelockChangeWARNINGTimelock min delay increased/unchanged
RoleGranted (Timelock)RoleChangeWARNINGTimelock role granted
RoleRevoked (Timelock)RoleChangeWARNINGTimelock role revoked
RoleAdminChanged (Timelock)RoleChangeERRORTimelock role admin changed
CallScheduled (Timelock)TimelockChangeINFOTimelock call scheduled
CallExecuted (Timelock)TimelockChangeINFOTimelock call executed
Cancelled (Timelock)TimelockChangeINFOTimelock call cancelled
AddedOwner (Safe)MultisigChangeWARNINGOwner added to External Admin Safe
RemovedOwner (Safe)MultisigChangeWARNINGOwner removed from External Admin Safe
ChangedThreshold (Safe)MultisigChangeWARNINGExternal Admin Safe threshold changed
EnabledModule (Safe)MultisigChangeWARNINGModule enabled on External Admin Safe
DisabledModule (Safe)MultisigChangeWARNINGModule disabled on External Admin Safe
ChangedGuard (Safe)MultisigChangeWARNINGGuard changed on External Admin Safe
ChangedFallbackHandler (Safe)MultisigChangeWARNINGFallback handler changed on External Admin Safe

Lido — earnETH (lido-finance)

  • Chain(s): Ethereum
  • Products: earneth. The Mellow-global Factories and the seven governing Safes are shared with earnUSD, so their events are emitted protocol-wide (product: "") and appear in both Lido Earn sections
  • Contracts monitored:
    • Vault — 0x6a37725ca7f4CE81c004c955f7280d5C704a249e
    • ShareManager (earnETH share token) — 0xBBFC8683C8fE8cF73777feDE7ab9574935fea0A4
    • Oracle — 0xAda1f4c24603aB2fe5aBd35BCD12370e98A20358
    • OracleSubmitter — 0xFbD83f7C531D35D99392a5A20bb5F1e75E97076e
    • FeeManager — 0xed4Fac879eE86F3aB0101993A3713e7cAA0488E1
    • RiskManager — 0xa2a4C4ecE27229aF51c546844AB752824Ccb557e
    • TimelockController — 0x363Ba8843d06BA5968f55C26aB055162eDd62189
    • Verifiers (the curator's permission set):
      • Verifier 0 — 0xBc46B79d79fCac1F4232D4Da1BA31aCED0AABFE0
      • Verifier 1 — 0xc0FC0B74923A80Af21B1E49633cAA309f432140F
    • Redemption queues:
      • RedeemQueue (wstETH) — 0x095bFAca9f1c6F2B063Cd67C6d6bfcd0c3aaB7b4
      • SyncRedeemQueue (wstETH) — 0xB5984D87d21C4375d18972fd546b688BD4Fc1f0A
    • Instant-deposit queues:
      • SyncDepositQueue (ETH) — 0xb99394f8b95d426Cb2F013B857C74aCC924b20D5
      • SyncDepositQueue (WETH) — 0xCe6C2505fEF74d2dE10FCF1d534cB73eCc837976
      • SyncDepositQueue (wstETH) — 0xECD2Bfe725fa14f5Ed86e9bDcc0eA4b34A4ed522
      • SyncDepositQueue (GG) — 0x2792004b709E3E88b8FCCb06c3C5e1A6dff0EC2B
      • SyncDepositQueue (strETH) — 0xA4F23f56442C01a478af20fe06b9F5f8f05aDD96
      • SyncDepositQueue (DVstETH) — 0xA80f247b92C79740b0610b754403D5cb0bf216b5
    • Subvaults and async deposit queues (monitored for proxy upgrades and upgrade-authority changes only):
      • Subvault 0 — 0xC5901C2481ca9C26398A9Da258b13717894bfebF
      • Subvault 1 — 0x7F515C80fA4C1FCFF34F0329141A9C3b20468FE5
      • DepositQueue (ETH) — 0x1db7094Ef0D994B0b62f6Cd67dB801ad194999A8
      • DepositQueue (WETH) — 0x3Fc48660d02e59fBedD0a5Cc18a5580D1f8dD6A4
      • DepositQueue (wstETH) — 0xe39EED9A454C4918F8d0682062777cB251cd513F
      • DepositQueue (GG) — 0x411172F1E5310d03b38128F2a294F2e33c691B30
      • DepositQueue (strETH) — 0x268ea1cc674cdaE200c4609E7b09d03Dc618E663
      • DepositQueue (DVstETH) — 0x4bDd2Ea1E20acb13f2758190c92a84175107A86f
    • Shared Earn governance (also covers earnUSD) — Mellow-global Factories:
      • DepositQueue Factory — 0xBB92A7B9695750e1234BaB18F83b73686dd09854
      • RedeemQueue Factory — 0xfe76b5fd238553D65Ce6dd0A572C0fda629F8421
      • Subvault Factory — 0x75FE0d73d3C64cdC1C6449D9F977Be6857c4d011
      • Verifier Factory — 0x04B30b1e98950e6A13550d84e991bE0d734C2c61
    • Shared Earn governance (also covers earnUSD) — Safes:
      • Mellow Upgrade Authority (Safe) — 0x81698f87C6482bF1ce9bFcfC0F103C4A0Adf0Af0
      • LazyVaultAdmin (Safe) — 0x0Dd73341d6158a72b4D224541f1094188f57076E
      • Curator (Safe) — 0xe5abcc40196174Ae0d12153dE286F0D8E401769d
      • OracleUpdater (Safe) — 0x93a797643d74fC81e7A51F3f84a9D78F930435D1
      • Lido Pauser (Safe) — 0xA916fD5252160A7E56A6405741De76dc0Da5A0Cd
      • Mellow Pauser (Safe) — 0x6E887aF318c6b29CEE42Ea28953Bd0BAdb3cE638
      • ActiveVaultAdmin (Safe) — 0x982aB69785f5329BB59c36B19CBd4865353fEf10
    • Every proxy listed above also has its own dedicated OpenZeppelin v5 ProxyAdmin contract, each monitored for ownership transfer — 43 across both Earn products and the four Factories, all currently owned by the Mellow Upgrade Authority Safe
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (Vault — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key of the Vault. The Vault is the single access-control registry for the whole earnETH stack — the share token, oracle, risk manager, verifiers and every queue all check permissions against it — so this key can hand out every other privilege in the product.
RoleGranted (Vault — pause / oracle / queue-composition roles)RoleChangeERRORA new address gains one of the roles that can freeze the share token, blacklist accounts, pause a queue, replace a verifier's permission root, set a hook, create a queue or subvault, write oracle prices, or loosen the oracle's price checks.
RoleGranted (Vault — other roles)RoleChangeWARNINGA new address gains a bounded operational role — deposit/subvault caps, balance accounting, or moving assets between the vault and its subvaults.
RoleRevoked (Vault — DEFAULT_ADMIN)RoleChangeCRITICALA root admin is removed from the Vault registry. If none remains, no role can ever be granted or revoked again, including to remove a compromised holder.
RoleRevoked (Vault — pause / oracle / queue-composition roles)RoleChangeERRORA holder loses one of the emergency or oracle roles. If it was the last holder, the pre-staged freeze, queue pause or curator-revocation operations become unexecutable and nobody can halt the product.
RoleRevoked (Vault — other roles)RoleChangeWARNINGA bounded operational role is removed — generally risk-reducing.
RoleAdded (Vault)RoleChangeERRORA role in the Vault registry goes from having no holders to having one. Seventeen role classes normally have no holder at all — including account blacklisting, hook setting, and queue and subvault creation — so this is the signal that a whole class of otherwise-impossible privileged action just became possible.
RoleRemoved (Vault — pause / oracle / queue-composition roles)RoleChangeERRORAn emergency or oracle role loses its last holder, retiring that capability entirely; the resulting state looks identical to a healthy protocol but incident response is gone.
RoleRemoved (Vault — other roles)RoleChangeWARNINGA bounded operational role loses its last holder — the expected tail of a temporary grant-use-revoke maintenance sequence.
RoleAdminChanged (Vault)RoleChangeERRORRe-points which role administers another role. No code path in the deployed Vault implementation can do this, so a firing implies the implementation changed underneath the monitor.
SetQueueStatus (redeem queue paused)EmergencyActionCRITICALOne of the redemption queues is paused, closing a user exit path. Also pre-staged inside the TimelockController as a permanently-executable operation, so it can co-fire with CallExecuted in the same transaction.
SetQueueStatus (deposit queue paused)EmergencyActionERROROne deposit queue is paused, blocking new money into that asset while existing holders can still exit. Six earnETH instant-deposit queues were held paused for four weeks in 2026.
SetQueueStatus (queue unpaused)EmergencyActionWARNINGA previously paused queue is reopened — the recovery signal.
QueueCreated (Vault)ContractUpgradeWARNINGA new deposit or redeem queue is registered on the vault — a new mint or redeem path for user funds, constrained to a queue implementation the corresponding Mellow Factory has already accepted.
QueueRemoved (Vault)ContractUpgradeWARNINGA queue is de-registered. It cannot strand funds: removal reverts unless the queue reports no outstanding user claims.
QueueLimitSet (Vault)ProtocolParameterChangeINFOChanges the cap on the number of queues the vault may hold. A count, not a value, so there is no fund exposure.
SubvaultCreated (Vault)ContractUpgradeWARNINGA new subvault is registered — a new destination the curator can push user assets into, arriving with its own verifier.
SubvaultDisconnected (Vault)EmergencyActionERRORA subvault is removed from the vault's set, after which assets held there stop being reachable by the pull path used to fund redemptions.
SubvaultReconnected (Vault)ContractUpgradeWARNINGA previously disconnected subvault is restored after its verifier is re-validated — the all-clear pairing.
CustomHookSet (Vault — hook set)ContractUpgradeCRITICALInstalls a hook for one specific queue. Hooks are invoked with delegatecall, so the hook's code runs in the Vault's own storage context and can rewrite the access-control registry and share accounting — the same class of change as an implementation upgrade, not a parameter tweak.
CustomHookSet (Vault — hook cleared)ContractUpgradeERRORThe queue's custom hook is removed and it falls back to the vault-wide default hook.
DefaultHookSet (Vault — hook set)ContractUpgradeCRITICALInstalls the vault-wide default deposit or redeem hook, applying to every queue without a custom hook. Same delegatecall mechanism as above, so it runs in the Vault's storage context.
DefaultHookSet (Vault — hook cleared)ContractUpgradeERRORThe vault-wide default hook is removed.
SetFlags (ShareManager — exits blocked)EmergencyActionCRITICALBurn or transfer is paused, or globalLockup is set to a future time. globalLockup is an absolute timestamp, not a duration, and is enforced on every path that moves shares away from a holder — so it blocks redemptions as well as transfers. The operation staged in the timelock sets it to uint32.max (year 2106). It is reversible, but asymmetrically: freezing executes an already-armed operation with one signature, while unfreezing needs a fresh proposal from a 5-of-8 Safe and no unfreeze operation is staged.
SetFlags (ShareManager — entry gated)EmergencyActionERRORMinting is paused or a whitelist is switched on, so new deposits are gated while existing holders can still transfer and redeem.
SetFlags (ShareManager — all flags clear)EmergencyActionWARNINGThe share-token flag bitmask is rewritten to fully open — the all-clear state.
SetAccountInfo (ShareManager — blacklisted)EmergencyActionERROROne account is blacklisted on the share token, after which it can neither transfer nor burn — meaning it cannot redeem.
SetAccountInfo (ShareManager — other)EmergencyActionWARNINGOne account's deposit or transfer permission is changed without blacklisting it.
SetWhitelistMerkleRoot (ShareManager — root set)ProtocolParameterChangeWARNINGSets the deposit-whitelist root on the share token. It gates the mint path only and cannot block an exit, and it is inert unless the whitelist flag is also on. The root's contents are off-chain, so who is on the list is not observable.
SetWhitelistMerkleRoot (ShareManager — root cleared)ProtocolParameterChangeINFOThe deposit whitelist root is cleared, removing the deposit gate.
ReportAccepted (Oracle)EmergencyActionERRORA NAV price report that failed the oracle's own suspicion check is manually force-accepted and applied to every queue. Note it also fires benignly when a new asset is onboarded — the first report for any asset is always flagged suspicious, so an accept is a required step in listing an asset — meaning this can fire on routine asset additions as well as on a genuine price override.
SecurityParamsSet (Oracle — guard rails loosened)ProtocolParameterChangeERRORThe oracle's price-validation guard rails are widened: a larger permitted deviation, a shorter report timeout, or a longer redeem interval. These checks are the only on-chain protection between a compromised rate submitter and every holder's share value. Compared against the previous on-chain values. On earnETH the bounds have twice been opened to 100% and 200% with a one-second timeout, then restored.
SecurityParamsSet (Oracle — tightened or unchanged)ProtocolParameterChangeWARNINGThe guard rails are narrowed or left effectively unchanged — the conservative direction.
SupportedAssetsAdded (Oracle)ProtocolParameterChangeWARNINGThe oracle starts pricing additional assets into NAV. A bad price on any supported asset moves the whole share price, so the set of priced assets is a real risk surface.
SupportedAssetsRemoved (Oracle)ProtocolParameterChangeWARNINGThe oracle stops pricing assets. Guarded — it reverts if the asset still has queues or a non-zero vault balance — so it cannot orphan user funds.
RoleGranted (OracleSubmitter — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root key of the OracleSubmitter's own registry, the second permission layer that decides who may move the published exchange rate.
RoleGranted (OracleSubmitter — SUBMIT_REPORTS / ACCEPT_REPORT)RoleChangeERRORA new address gains the ability to push NAV prices into the oracle, or to force-accept a report the oracle flagged as suspicious. Either is a write path to the value of every holder's shares.
RoleGranted (OracleSubmitter — other roles)RoleChangeWARNINGA role with no specific mapping on this contract is granted.
RoleRevoked (OracleSubmitter — root admin or last rate submitter)RoleChangeERRORThe registry's root admin is removed, or the last remaining rate submitter is. Losing the last submitter silently stops NAV updates: the published rate goes stale and, past the oracle timeout, the instant deposit and redeem paths stop accepting it.
RoleRevoked (OracleSubmitter — other roles)RoleChangeWARNINGA submitter or report-acceptor is rotated out while others remain.
RoleAdminChanged (OracleSubmitter)RoleChangeERRORRe-points which role administers another on the submitter. The contract is not upgradeable and has no code path that does this, so a firing is structurally anomalous.
SetFees (FeeManager — outside the demonstrated range)ProtocolParameterChangeERRORAny deposit or redeem fee is switched on, or the performance fee exceeds 10% or the protocol fee 1%. The contract permits a total fee of 100%, and fees have not always been zero here: a 10% performance plus 1% protocol fee ran on both Earn products for three weeks in July 2026.
SetFees (FeeManager — all four rates zero)ProtocolParameterChangeINFOAll four fee rates are set to zero — fees are off.
SetFees (FeeManager — within the demonstrated range)ProtocolParameterChangeWARNINGA non-zero performance or protocol fee is set inside the range already used in production, with no deposit or redeem fee.
SetFeeRecipient (FeeManager)AdminChangeERRORRe-points the address that receives freshly minted fee shares on every NAV report, and which is exempt from the redeem fee.
OwnershipTransferred (FeeManager — real transfer)AdminChangeCRITICALOwnership of the FeeManager moves to a new address. The owner can set a 100% fee and re-point the recipient, so this is direct authority over value diverted from holders.
OwnershipTransferred (FeeManager — initial assignment)AdminChangeINFOThe deploy-time log where ownership is first assigned from the zero address.
SetVaultLimit (RiskManager — at or below the live balance)ProtocolParameterChangeERRORThe vault-wide deposit cap is set to a value at or below the current balance, which halts all deposits immediately. The live balance is read in-handler to distinguish this from a routine cap change.
SetVaultLimit (RiskManager — above the live balance)ProtocolParameterChangeWARNINGThe vault-wide deposit cap is changed while leaving headroom for new deposits.
SetSubvaultLimit (RiskManager)ProtocolParameterChangeWARNINGCaps how much a single subvault may hold, bounded by the vault-level limit.
AllowSubvaultAssets (RiskManager)ProtocolParameterChangeWARNINGWidens the set of assets a subvault may hold. Doubly constrained: the asset must already be oracle-priced and the curator still needs a verifier proof to move it.
DisallowSubvaultAssets (RiskManager)ProtocolParameterChangeWARNINGNarrows a subvault's allowed asset set — the risk-reducing pairing.
CallScheduled (TimelockController)TimelockChangeERRORAn operation is staged in the product's timelock. The timelock's minimum delay is zero, so a scheduled operation is immediately executable — "timelock" here is propose/execute role separation across two different Safes, not a waiting period. Scheduling therefore means armed, and the message decodes the target and function.
CallExecuted (TimelockController — freeze, curator revocation or queue pause)EmergencyActionCRITICALA staged operation that freezes the share token, clears a verifier's permission root, or pauses a queue has actually been fired. Each timelock permanently holds such operations in state Ready — sixteen on earnETH, none ever executed — including a full mint, burn and transfer freeze, and the executor role includes a 1-of-8 Safe.
CallExecuted (TimelockController — other payload)EmergencyActionERRORA staged timelock operation with some other payload has been executed; the message decodes the target and function.
Cancelled (TimelockController)TimelockChangeERRORA pending timelock operation is cancelled. Because the pending operations are the emergency plan itself, cancelling one silently disarms a pre-staged freeze, curator revocation or queue pause.
MinDelayChange (TimelockController — decrease)TimelockChangeERRORThe timelock's minimum delay is reduced. The current value is already zero, so a decrease is not possible from here without an implementation change.
MinDelayChange (TimelockController — increase)TimelockChangeWARNINGThe minimum delay is raised, introducing a real waiting period where there is currently none.
RoleGranted (TimelockController — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the timelock's root admin, which can hand out the proposer, canceller and executor roles — full control over both the staging and the firing of the pre-staged emergency operations.
RoleGranted (TimelockController — EXECUTOR / PROPOSER)RoleChangeERRORA new address gains the ability to fire any ready operation, or to stage arbitrary new privileged calls. With the minimum delay at zero, anything staged is immediately fireable.
RoleGranted (TimelockController — other roles)RoleChangeWARNINGAnother timelock role, such as canceller, is granted.
RoleRevoked (TimelockController — root admin or last executor)RoleChangeERRORThe timelock's root admin is removed, or the last known executor is. Without an executor the pre-staged emergency operations stay permanently ready but unfireable — the kill switch is present and dead.
RoleRevoked (TimelockController — other roles)RoleChangeWARNINGA proposer, canceller or one of several executors is removed.
RoleAdminChanged (TimelockController)RoleChangeERRORRe-points which role administers another on the timelock. No code path in OpenZeppelin's TimelockController does this, so a firing is structurally anomalous.
SetMerkleRoot (Verifier — root cleared)EmergencyActionERRORA verifier's permission root is cleared to zero, revoking every call the curator was allowed to make against subvault assets. This is the pre-staged emergency revocation of curator powers.
SetMerkleRoot (Verifier — root replaced)ProtocolParameterChangeERRORA verifier's permission root is replaced with a different one, changing the set of calls the curator may execute. Only the 32-byte root is on-chain and the tree's contents are off-chain, so there is no way to tell from the event whether the curator's powers widened or narrowed.
AllowCall (Verifier)RoleChangeERRORWrites an explicit caller-target-selector allowance on a verifier that bypasses the merkle tree entirely. The one historical use of this granted a raw wstETH transfer permission.
DisallowCall (Verifier)RoleChangeWARNINGRemoves an explicit verifier allowance — the risk-reducing pairing.
SyncDepositParamsSet (SyncDepositQueue — materially costly)ProtocolParameterChangeERRORAn instant-deposit queue's penalty reaches 0.5% or its maximum accepted oracle-price age exceeds 48 hours. The penalty is a direct haircut on the shares an instant depositor receives and the contract permits up to 50%; the max-age setting governs how stale a price the instant path will accept, against an oracle reporting roughly every 20 hours.
SyncDepositParamsSet (SyncDepositQueue — other change)ProtocolParameterChangeWARNINGAn instant-deposit queue's penalty or oracle max-age is changed to a level that is not materially costly to depositors. This includes values above anything used in production so far — the alert records that separately, but a penalty of a few hundredths of a percent is not treated as urgent.
SyncRedeemParamsSet (SyncRedeemQueue — materially costly)ProtocolParameterChangeERRORThe instant-exit path gains a penalty of 0.25% or more (a direct haircut on instant exits, permitted up to 50%), or is set to accept an oracle price older than 48 hours. The role needed to call this has never been granted on either Earn vault.
SyncRedeemParamsSet (SyncRedeemQueue — other change)ProtocolParameterChangeWARNINGThe instant-exit parameters are changed to a level that is not materially costly, including a reduction in daily exit capacity. The instant path is capped at a small fraction of supply per day and the standard redemption queue carries no penalty, so small changes here are recorded rather than treated as urgent.
Upgraded (any earnETH proxy)ContractUpgradeCRITICALThe implementation behind one of the product's proxies is replaced. A Vault or ShareManager upgrade can rewrite the access-control registry, the share accounting and the pause logic in a single transaction, and the upgrade authority is a 5-of-8 Safe acting with no delay. Monitored on all 43 Earn proxies; the proxies' own AdminChanged is not monitored because the OpenZeppelin v5 proxy admin is immutable and can only fire at construction, which is why the ProxyAdmin ownership event below is the substitute signal.
OwnershipTransferred (ProxyAdmin — real transfer)AdminChangeCRITICALUpgrade authority over one specific contract moves to a new owner. Each proxy has its own dedicated ProxyAdmin, and that ProxyAdmin is the only way to change the proxy's implementation, so this is the sole on-chain signal that the power to upgrade a given contract changed hands.
OwnershipTransferred (ProxyAdmin — initial assignment)AdminChangeINFOThe deploy-time log where a ProxyAdmin's ownership is first assigned from the zero address.
AcceptProposedImplementation (Factory — shared Earn governance)ContractUpgradeERRORThe Factory owner admits a new implementation into the set that may be instantiated for queues, subvaults or verifiers. It does not upgrade anything already deployed, but it is a reliable precursor: the implementation accepted on 2026-07-21 is the one both new instant-redeem queues were deployed from two days later.
ProposeImplementation (Factory — shared Earn governance)ContractUpgradeINFOAn implementation address is proposed to a Factory. The function is permissionless — it has no access control at all, so anyone can propose any address — and a proposal grants nothing until the owner accepts it via the event above. Recorded so a stranger cannot generate noise.
SetBlacklistStatus (Factory — shared Earn governance)ProtocolParameterChangeWARNINGA Factory implementation version is marked as blacklisted, or unmarked. It affects future deployments only; instances already deployed are untouched.
OwnershipTransferred (Factory — real transfer, shared Earn governance)AdminChangeCRITICALOwnership of one of the four Mellow-global Factories moves. The owner gates which implementations either Earn product can ever deploy.
OwnershipTransferred (Factory — initial assignment, shared Earn governance)AdminChangeINFOThe deploy-time log where a Factory's ownership is first assigned from the zero address.
AddedOwner (Safe — Upgrade Authority, LazyVaultAdmin, Curator, OracleUpdater, Lido Pauser, Mellow Pauser)MultisigChangeERRORA new signer joins one of the Safes that hold upgrade authority, vault root admin, curator keys, the rate-submitter role, or the timelock executor role. On the Mellow Pauser Safe, which is 1-of-8, each new owner is one more party able to fire the pre-staged freeze on both products alone.
AddedOwner (Safe — ActiveVaultAdmin)MultisigChangeWARNINGA new signer joins the Safe that holds only the deposit-cap and balance-accounting roles.
RemovedOwner (Safe — Upgrade Authority, LazyVaultAdmin, Curator, OracleUpdater, Lido Pauser, Mellow Pauser)MultisigChangeERRORA signer leaves one of the high-authority Safes, concentrating control among fewer parties at an unchanged threshold.
RemovedOwner (Safe — ActiveVaultAdmin)MultisigChangeWARNINGA signer leaves the limits-only Safe.
ChangedThreshold (Safe — Upgrade Authority or LazyVaultAdmin, lowered)MultisigChangeCRITICALThe signature requirement is lowered on one of the two root-of-trust Safes — the one owning all 43 ProxyAdmins and all four Factories, or the one holding root admin on both vaults and both oracle submitters. Fewer signatures for total control. Compared against the previous on-chain value.
ChangedThreshold (Safe — root-of-trust raised, or any other Safe lowered)MultisigChangeERRORA root-of-trust Safe raises its requirement, or one of the asset, oracle, pauser or limits Safes lowers its own.
ChangedThreshold (Safe — any other Safe raised)MultisigChangeWARNINGA non-root Safe raises its signature requirement — the conservative direction.
EnabledModule (Safe)MultisigChangeCRITICALA module is enabled on a governing Safe. A module can execute transactions from that Safe with no signatures at all, bypassing the signing threshold entirely. No module has ever been enabled on any of the seven Safes.
DisabledModule (Safe)MultisigChangeWARNINGA module is disabled, removing a signature-bypass path.
ChangedGuard (Safe)MultisigChangeERRORA transaction guard is installed on or removed from a governing Safe. A guard's pre-execution hook can revert unconditionally, which would brick the pauser Safes and with them the ability to fire the emergency operations.
ChangedFallbackHandler (Safe)MultisigChangeWARNINGA governing Safe's fallback handler is changed. The handler is invoked with call rather than delegatecall, so it cannot write Safe storage; the exposure is signature-validation spoofing.

Lido — earnUSD (lido-finance)

  • Chain(s): Ethereum
  • Products: earnusd. The Mellow-global Factories and the seven governing Safes are shared with earnETH, so their events are emitted protocol-wide (product: "") and appear in both Lido Earn sections
  • Contracts monitored:
    • Vault — 0x014e6DA8F283C4aF65B2AA0f201438680A004452
    • ShareManager (earnUSD share token) — 0x4Ce1ac8F43E0E5BD7A346A98aF777bF8fbeA1981
    • Oracle — 0x827044735c9708a2cf850e7Ea37EBa43bc786028
    • OracleSubmitter — 0xB105DaEeFEb1390ce49172c99E3e12C607367156
    • FeeManager — 0x72fa23f40e08eB9E45953233b2Dd9665E347e8Dc
    • RiskManager — 0x7b1e06C46d4510277FC37a37bBeF65F3794fdDE4
    • TimelockController — 0xdA6Da82DFF8cD29D828e4775Cc003f504A968845
    • Verifiers (the curator's permission set):
      • Verifier 0 — 0xB65A8E0937c77a76C3f4F86A1110f81A299CB481
      • Verifier 1 — 0xBEa44cd2f58f3CC6f37aaeC82A2dee57911d0b36
    • Redemption queues:
      • RedeemQueue (USDC) — 0x9e36A74FE278906a76e7615263e46a83fC40c47F
      • SyncRedeemQueue (USDC) — 0xE0eee7e956A94BD00546d9CA07e5012F11A5059d
    • Instant-deposit queues:
      • SyncDepositQueue (USDC) — 0xf6AFAf6afcAe116dD37A779D50fE6c5fa6f8C8f5
      • SyncDepositQueue (USDT) — 0x534d0bEb82C47cf703BFb9E959297658b65Ec8E9
    • Subvaults and async deposit queues (monitored for proxy upgrades and upgrade-authority changes only):
      • Subvault 0 — 0x77B9441d5Cb89fca435190A9B6D108ad4B00ccFd
      • Subvault 1 — 0xe3e0111e31FA3AEB7A528128F2DbAe1C15397242
      • DepositQueue (USDC) — 0xC75E7E73B25fEa8bB23EB55CC48BA55067b5be76
      • DepositQueue (USDT) — 0xEeC5041c47Cba1e31321AC6941Bf09Ad60645B73
      • DepositQueue (USDe) — 0xeEc37568b01e0C4d5028501A49E024B475E2D7cA
    • Shared Earn governance (also covers earnETH) — Mellow-global Factories:
      • DepositQueue Factory — 0xBB92A7B9695750e1234BaB18F83b73686dd09854
      • RedeemQueue Factory — 0xfe76b5fd238553D65Ce6dd0A572C0fda629F8421
      • Subvault Factory — 0x75FE0d73d3C64cdC1C6449D9F977Be6857c4d011
      • Verifier Factory — 0x04B30b1e98950e6A13550d84e991bE0d734C2c61
    • Shared Earn governance (also covers earnETH) — Safes:
      • Mellow Upgrade Authority (Safe) — 0x81698f87C6482bF1ce9bFcfC0F103C4A0Adf0Af0
      • LazyVaultAdmin (Safe) — 0x0Dd73341d6158a72b4D224541f1094188f57076E
      • Curator (Safe) — 0xe5abcc40196174Ae0d12153dE286F0D8E401769d
      • OracleUpdater (Safe) — 0x93a797643d74fC81e7A51F3f84a9D78F930435D1
      • Lido Pauser (Safe) — 0xA916fD5252160A7E56A6405741De76dc0Da5A0Cd
      • Mellow Pauser (Safe) — 0x6E887aF318c6b29CEE42Ea28953Bd0BAdb3cE638
      • ActiveVaultAdmin (Safe) — 0x982aB69785f5329BB59c36B19CBd4865353fEf10
    • Every proxy listed above also has its own dedicated OpenZeppelin v5 ProxyAdmin contract, each monitored for ownership transfer — 43 across both Earn products and the four Factories, all currently owned by the Mellow Upgrade Authority Safe
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (Vault — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key of the Vault. The Vault is the single access-control registry for the whole earnUSD stack — the share token, oracle, risk manager, verifiers and every queue all check permissions against it — so this key can hand out every other privilege in the product.
RoleGranted (Vault — pause / oracle / queue-composition roles)RoleChangeERRORA new address gains one of the roles that can freeze the share token, blacklist accounts, pause a queue, replace a verifier's permission root, set a hook, create a queue or subvault, write oracle prices, or loosen the oracle's price checks.
RoleGranted (Vault — other roles)RoleChangeWARNINGA new address gains a bounded operational role — deposit/subvault caps, balance accounting, or moving assets between the vault and its subvaults.
RoleRevoked (Vault — DEFAULT_ADMIN)RoleChangeCRITICALA root admin is removed from the Vault registry. If none remains, no role can ever be granted or revoked again, including to remove a compromised holder.
RoleRevoked (Vault — pause / oracle / queue-composition roles)RoleChangeERRORA holder loses one of the emergency or oracle roles. If it was the last holder, the pre-staged freeze, queue pause or curator-revocation operations become unexecutable and nobody can halt the product.
RoleRevoked (Vault — other roles)RoleChangeWARNINGA bounded operational role is removed — generally risk-reducing.
RoleAdded (Vault)RoleChangeERRORA role in the Vault registry goes from having no holders to having one. Seventeen role classes normally have no holder at all — including account blacklisting, hook setting, and queue and subvault creation — so this is the signal that a whole class of otherwise-impossible privileged action just became possible.
RoleRemoved (Vault — pause / oracle / queue-composition roles)RoleChangeERRORAn emergency or oracle role loses its last holder, retiring that capability entirely; the resulting state looks identical to a healthy protocol but incident response is gone.
RoleRemoved (Vault — other roles)RoleChangeWARNINGA bounded operational role loses its last holder — the expected tail of a temporary grant-use-revoke maintenance sequence.
RoleAdminChanged (Vault)RoleChangeERRORRe-points which role administers another role. No code path in the deployed Vault implementation can do this, so a firing implies the implementation changed underneath the monitor.
SetQueueStatus (redeem queue paused)EmergencyActionCRITICALOne of the redemption queues is paused, closing a user exit path. Also pre-staged inside the TimelockController as a permanently-executable operation, so it can co-fire with CallExecuted in the same transaction.
SetQueueStatus (deposit queue paused)EmergencyActionERROROne deposit queue is paused, blocking new money into that asset while existing holders can still exit.
SetQueueStatus (queue unpaused)EmergencyActionWARNINGA previously paused queue is reopened — the recovery signal.
QueueCreated (Vault)ContractUpgradeWARNINGA new deposit or redeem queue is registered on the vault — a new mint or redeem path for user funds, constrained to a queue implementation the corresponding Mellow Factory has already accepted.
QueueRemoved (Vault)ContractUpgradeWARNINGA queue is de-registered. It cannot strand funds: removal reverts unless the queue reports no outstanding user claims.
QueueLimitSet (Vault)ProtocolParameterChangeINFOChanges the cap on the number of queues the vault may hold. A count, not a value, so there is no fund exposure.
SubvaultCreated (Vault)ContractUpgradeWARNINGA new subvault is registered — a new destination the curator can push user assets into, arriving with its own verifier.
SubvaultDisconnected (Vault)EmergencyActionERRORA subvault is removed from the vault's set, after which assets held there stop being reachable by the pull path used to fund redemptions.
SubvaultReconnected (Vault)ContractUpgradeWARNINGA previously disconnected subvault is restored after its verifier is re-validated — the all-clear pairing.
CustomHookSet (Vault — hook set)ContractUpgradeCRITICALInstalls a hook for one specific queue. Hooks are invoked with delegatecall, so the hook's code runs in the Vault's own storage context and can rewrite the access-control registry and share accounting — the same class of change as an implementation upgrade, not a parameter tweak.
CustomHookSet (Vault — hook cleared)ContractUpgradeERRORThe queue's custom hook is removed and it falls back to the vault-wide default hook.
DefaultHookSet (Vault — hook set)ContractUpgradeCRITICALInstalls the vault-wide default deposit or redeem hook, applying to every queue without a custom hook. Same delegatecall mechanism as above, so it runs in the Vault's storage context.
DefaultHookSet (Vault — hook cleared)ContractUpgradeERRORThe vault-wide default hook is removed.
SetFlags (ShareManager — exits blocked)EmergencyActionCRITICALBurn or transfer is paused, or globalLockup is set to a future time. globalLockup is an absolute timestamp, not a duration, and is enforced on every path that moves shares away from a holder — so it blocks redemptions as well as transfers. The operation staged in the timelock sets it to uint32.max (year 2106). It is reversible, but asymmetrically: freezing executes an already-armed operation with one signature, while unfreezing needs a fresh proposal from a 5-of-8 Safe and no unfreeze operation is staged.
SetFlags (ShareManager — entry gated)EmergencyActionERRORMinting is paused or a whitelist is switched on, so new deposits are gated while existing holders can still transfer and redeem.
SetFlags (ShareManager — all flags clear)EmergencyActionWARNINGThe share-token flag bitmask is rewritten to fully open — the all-clear state.
SetAccountInfo (ShareManager — blacklisted)EmergencyActionERROROne account is blacklisted on the share token, after which it can neither transfer nor burn — meaning it cannot redeem.
SetAccountInfo (ShareManager — other)EmergencyActionWARNINGOne account's deposit or transfer permission is changed without blacklisting it.
SetWhitelistMerkleRoot (ShareManager — root set)ProtocolParameterChangeWARNINGSets the deposit-whitelist root on the share token. It gates the mint path only and cannot block an exit, and it is inert unless the whitelist flag is also on. The root's contents are off-chain, so who is on the list is not observable.
SetWhitelistMerkleRoot (ShareManager — root cleared)ProtocolParameterChangeINFOThe deposit whitelist root is cleared, removing the deposit gate.
ReportAccepted (Oracle)EmergencyActionERRORA NAV price report that failed the oracle's own suspicion check is manually force-accepted and applied to every queue. Note it also fires benignly when a new asset is onboarded — the first report for any asset is always flagged suspicious, so an accept is a required step in listing an asset — meaning this can fire on routine asset additions as well as on a genuine price override.
SecurityParamsSet (Oracle — guard rails loosened)ProtocolParameterChangeERRORThe oracle's price-validation guard rails are widened: a larger permitted deviation, a shorter report timeout, or a longer redeem interval. These checks are the only on-chain protection between a compromised rate submitter and every holder's share value. Compared against the previous on-chain values.
SecurityParamsSet (Oracle — tightened or unchanged)ProtocolParameterChangeWARNINGThe guard rails are narrowed or left effectively unchanged — the conservative direction.
SupportedAssetsAdded (Oracle)ProtocolParameterChangeWARNINGThe oracle starts pricing additional assets into NAV. A bad price on any supported asset moves the whole share price, so the set of priced assets is a real risk surface.
SupportedAssetsRemoved (Oracle)ProtocolParameterChangeWARNINGThe oracle stops pricing assets. Guarded — it reverts if the asset still has queues or a non-zero vault balance — so it cannot orphan user funds.
RoleGranted (OracleSubmitter — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root key of the OracleSubmitter's own registry, the second permission layer that decides who may move the published exchange rate.
RoleGranted (OracleSubmitter — SUBMIT_REPORTS / ACCEPT_REPORT)RoleChangeERRORA new address gains the ability to push NAV prices into the oracle, or to force-accept a report the oracle flagged as suspicious. Either is a write path to the value of every holder's shares.
RoleGranted (OracleSubmitter — other roles)RoleChangeWARNINGA role with no specific mapping on this contract is granted.
RoleRevoked (OracleSubmitter — root admin or last rate submitter)RoleChangeERRORThe registry's root admin is removed, or the last remaining rate submitter is. Losing the last submitter silently stops NAV updates: the published rate goes stale and, past the oracle timeout, the instant deposit and redeem paths stop accepting it.
RoleRevoked (OracleSubmitter — other roles)RoleChangeWARNINGA submitter or report-acceptor is rotated out while others remain.
RoleAdminChanged (OracleSubmitter)RoleChangeERRORRe-points which role administers another on the submitter. The contract is not upgradeable and has no code path that does this, so a firing is structurally anomalous.
SetFees (FeeManager — outside the demonstrated range)ProtocolParameterChangeERRORAny deposit or redeem fee is switched on, or the performance fee exceeds 10% or the protocol fee 1%. The contract permits a total fee of 100%, and fees have not always been zero here: a 10% performance plus 1% protocol fee ran on both Earn products for three weeks in July 2026.
SetFees (FeeManager — all four rates zero)ProtocolParameterChangeINFOAll four fee rates are set to zero — fees are off.
SetFees (FeeManager — within the demonstrated range)ProtocolParameterChangeWARNINGA non-zero performance or protocol fee is set inside the range already used in production, with no deposit or redeem fee.
SetFeeRecipient (FeeManager)AdminChangeERRORRe-points the address that receives freshly minted fee shares on every NAV report, and which is exempt from the redeem fee.
OwnershipTransferred (FeeManager — real transfer)AdminChangeCRITICALOwnership of the FeeManager moves to a new address. The owner can set a 100% fee and re-point the recipient, so this is direct authority over value diverted from holders.
OwnershipTransferred (FeeManager — initial assignment)AdminChangeINFOThe deploy-time log where ownership is first assigned from the zero address.
SetVaultLimit (RiskManager — at or below the live balance)ProtocolParameterChangeERRORThe vault-wide deposit cap is set to a value at or below the current balance, which halts all deposits immediately. The live balance is read in-handler to distinguish this from a routine cap change.
SetVaultLimit (RiskManager — above the live balance)ProtocolParameterChangeWARNINGThe vault-wide deposit cap is changed while leaving headroom for new deposits.
SetSubvaultLimit (RiskManager)ProtocolParameterChangeWARNINGCaps how much a single subvault may hold, bounded by the vault-level limit.
AllowSubvaultAssets (RiskManager)ProtocolParameterChangeWARNINGWidens the set of assets a subvault may hold. Doubly constrained: the asset must already be oracle-priced and the curator still needs a verifier proof to move it.
DisallowSubvaultAssets (RiskManager)ProtocolParameterChangeWARNINGNarrows a subvault's allowed asset set — the risk-reducing pairing.
CallScheduled (TimelockController)TimelockChangeERRORAn operation is staged in the product's timelock. The timelock's minimum delay is zero, so a scheduled operation is immediately executable — "timelock" here is propose/execute role separation across two different Safes, not a waiting period. Scheduling therefore means armed, and the message decodes the target and function.
CallExecuted (TimelockController — freeze, curator revocation or queue pause)EmergencyActionCRITICALA staged operation that freezes the share token, clears a verifier's permission root, or pauses a queue has actually been fired. Each timelock permanently holds such operations in state Ready — seven on earnUSD, none ever executed — including a full mint, burn and transfer freeze, and the executor role includes a 1-of-8 Safe.
CallExecuted (TimelockController — other payload)EmergencyActionERRORA staged timelock operation with some other payload has been executed; the message decodes the target and function.
Cancelled (TimelockController)TimelockChangeERRORA pending timelock operation is cancelled. Because the pending operations are the emergency plan itself, cancelling one silently disarms a pre-staged freeze, curator revocation or queue pause.
MinDelayChange (TimelockController — decrease)TimelockChangeERRORThe timelock's minimum delay is reduced. The current value is already zero, so a decrease is not possible from here without an implementation change.
MinDelayChange (TimelockController — increase)TimelockChangeWARNINGThe minimum delay is raised, introducing a real waiting period where there is currently none.
RoleGranted (TimelockController — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the timelock's root admin, which can hand out the proposer, canceller and executor roles — full control over both the staging and the firing of the pre-staged emergency operations.
RoleGranted (TimelockController — EXECUTOR / PROPOSER)RoleChangeERRORA new address gains the ability to fire any ready operation, or to stage arbitrary new privileged calls. With the minimum delay at zero, anything staged is immediately fireable.
RoleGranted (TimelockController — other roles)RoleChangeWARNINGAnother timelock role, such as canceller, is granted.
RoleRevoked (TimelockController — root admin or last executor)RoleChangeERRORThe timelock's root admin is removed, or the last known executor is. Without an executor the pre-staged emergency operations stay permanently ready but unfireable — the kill switch is present and dead.
RoleRevoked (TimelockController — other roles)RoleChangeWARNINGA proposer, canceller or one of several executors is removed.
RoleAdminChanged (TimelockController)RoleChangeERRORRe-points which role administers another on the timelock. No code path in OpenZeppelin's TimelockController does this, so a firing is structurally anomalous.
SetMerkleRoot (Verifier — root cleared)EmergencyActionERRORA verifier's permission root is cleared to zero, revoking every call the curator was allowed to make against subvault assets. This is the pre-staged emergency revocation of curator powers.
SetMerkleRoot (Verifier — root replaced)ProtocolParameterChangeERRORA verifier's permission root is replaced with a different one, changing the set of calls the curator may execute. Only the 32-byte root is on-chain and the tree's contents are off-chain, so there is no way to tell from the event whether the curator's powers widened or narrowed.
AllowCall (Verifier)RoleChangeERRORWrites an explicit caller-target-selector allowance on a verifier that bypasses the merkle tree entirely.
DisallowCall (Verifier)RoleChangeWARNINGRemoves an explicit verifier allowance — the risk-reducing pairing.
SyncDepositParamsSet (SyncDepositQueue — materially costly)ProtocolParameterChangeERRORAn instant-deposit queue's penalty reaches 0.5% or its maximum accepted oracle-price age exceeds 48 hours. The penalty is a direct haircut on the shares an instant depositor receives and the contract permits up to 50%; the max-age setting governs how stale a price the instant path will accept, against an oracle reporting roughly every 20 hours.
SyncDepositParamsSet (SyncDepositQueue — other change)ProtocolParameterChangeWARNINGAn instant-deposit queue's penalty or oracle max-age is changed to a level that is not materially costly to depositors. This includes values above anything used in production so far — the alert records that separately, but a penalty of a few hundredths of a percent is not treated as urgent.
SyncRedeemParamsSet (SyncRedeemQueue — materially costly)ProtocolParameterChangeERRORThe instant-exit path gains a penalty of 0.25% or more (a direct haircut on instant exits, permitted up to 50%), or is set to accept an oracle price older than 48 hours. The role needed to call this has never been granted on either Earn vault.
SyncRedeemParamsSet (SyncRedeemQueue — other change)ProtocolParameterChangeWARNINGThe instant-exit parameters are changed to a level that is not materially costly, including a reduction in daily exit capacity. The instant path is capped at a small fraction of supply per day and the standard redemption queue carries no penalty, so small changes here are recorded rather than treated as urgent.
Upgraded (any earnUSD proxy)ContractUpgradeCRITICALThe implementation behind one of the product's proxies is replaced. A Vault or ShareManager upgrade can rewrite the access-control registry, the share accounting and the pause logic in a single transaction, and the upgrade authority is a 5-of-8 Safe acting with no delay. Monitored on all 43 Earn proxies; the proxies' own AdminChanged is not monitored because the OpenZeppelin v5 proxy admin is immutable and can only fire at construction, which is why the ProxyAdmin ownership event below is the substitute signal.
OwnershipTransferred (ProxyAdmin — real transfer)AdminChangeCRITICALUpgrade authority over one specific contract moves to a new owner. Each proxy has its own dedicated ProxyAdmin, and that ProxyAdmin is the only way to change the proxy's implementation, so this is the sole on-chain signal that the power to upgrade a given contract changed hands.
OwnershipTransferred (ProxyAdmin — initial assignment)AdminChangeINFOThe deploy-time log where a ProxyAdmin's ownership is first assigned from the zero address.
AcceptProposedImplementation (Factory — shared Earn governance)ContractUpgradeERRORThe Factory owner admits a new implementation into the set that may be instantiated for queues, subvaults or verifiers. It does not upgrade anything already deployed, but it is a reliable precursor: the implementation accepted on 2026-07-21 is the one both new instant-redeem queues were deployed from two days later.
ProposeImplementation (Factory — shared Earn governance)ContractUpgradeINFOAn implementation address is proposed to a Factory. The function is permissionless — it has no access control at all, so anyone can propose any address — and a proposal grants nothing until the owner accepts it via the event above. Recorded so a stranger cannot generate noise.
SetBlacklistStatus (Factory — shared Earn governance)ProtocolParameterChangeWARNINGA Factory implementation version is marked as blacklisted, or unmarked. It affects future deployments only; instances already deployed are untouched.
OwnershipTransferred (Factory — real transfer, shared Earn governance)AdminChangeCRITICALOwnership of one of the four Mellow-global Factories moves. The owner gates which implementations either Earn product can ever deploy.
OwnershipTransferred (Factory — initial assignment, shared Earn governance)AdminChangeINFOThe deploy-time log where a Factory's ownership is first assigned from the zero address.
AddedOwner (Safe — Upgrade Authority, LazyVaultAdmin, Curator, OracleUpdater, Lido Pauser, Mellow Pauser)MultisigChangeERRORA new signer joins one of the Safes that hold upgrade authority, vault root admin, curator keys, the rate-submitter role, or the timelock executor role. On the Mellow Pauser Safe, which is 1-of-8, each new owner is one more party able to fire the pre-staged freeze on both products alone.
AddedOwner (Safe — ActiveVaultAdmin)MultisigChangeWARNINGA new signer joins the Safe that holds only the deposit-cap and balance-accounting roles.
RemovedOwner (Safe — Upgrade Authority, LazyVaultAdmin, Curator, OracleUpdater, Lido Pauser, Mellow Pauser)MultisigChangeERRORA signer leaves one of the high-authority Safes, concentrating control among fewer parties at an unchanged threshold.
RemovedOwner (Safe — ActiveVaultAdmin)MultisigChangeWARNINGA signer leaves the limits-only Safe.
ChangedThreshold (Safe — Upgrade Authority or LazyVaultAdmin, lowered)MultisigChangeCRITICALThe signature requirement is lowered on one of the two root-of-trust Safes — the one owning all 43 ProxyAdmins and all four Factories, or the one holding root admin on both vaults and both oracle submitters. Fewer signatures for total control. Compared against the previous on-chain value.
ChangedThreshold (Safe — root-of-trust raised, or any other Safe lowered)MultisigChangeERRORA root-of-trust Safe raises its requirement, or one of the asset, oracle, pauser or limits Safes lowers its own.
ChangedThreshold (Safe — any other Safe raised)MultisigChangeWARNINGA non-root Safe raises its signature requirement — the conservative direction.
EnabledModule (Safe)MultisigChangeCRITICALA module is enabled on a governing Safe. A module can execute transactions from that Safe with no signatures at all, bypassing the signing threshold entirely. No module has ever been enabled on any of the seven Safes.
DisabledModule (Safe)MultisigChangeWARNINGA module is disabled, removing a signature-bypass path.
ChangedGuard (Safe)MultisigChangeERRORA transaction guard is installed on or removed from a governing Safe. A guard's pre-execution hook can revert unconditionally, which would brick the pauser Safes and with them the ability to fire the emergency operations.
ChangedFallbackHandler (Safe)MultisigChangeWARNINGA governing Safe's fallback handler is changed. The handler is invoked with call rather than delegatecall, so it cannot write Safe storage; the exposure is signature-validation spoofing.

Lido — stETH (lido)

  • Chain(s): Ethereum
  • Products: steth
  • Contracts monitored:
    • Lido stETH — 0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84
    • WithdrawalQueue — 0x889edC2eDab5f40e902b864aD4d7AdE8E412F9B1
    • Aragon Voting — 0x2e59A20f205bB85a89C53f1936454680651E618e
    • NodeOperatorsRegistry — 0x55032650b14df07b85bF18A3a3eC8E0Af2e028d5
    • InsuranceFund — 0x8B3f33234ABD88493c0Cd28De33D583B70beDe35
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
ContractVersionSet (stETH)ContractUpgradeERRORThe stETH proxy's implementation is upgraded — new code for the core token contract while user balances and storage stay in the unchanged proxy. Governance-gated (Aragon DAO) and rare (twice in the protocol's life), so every upgrade pages to be matched against a known governance vote.
LidoLocatorSetContractUpgradeCRITICALRe-points stETH at a different LidoLocator — the central registry that resolves ~15 core system components (the oracle, withdrawal queue, treasury, staking router, reward vaults). Because the protocol resolves these dependencies at runtime, swapping the locator instantly redirects the whole system's trust to a new set of contracts — the same top-tier root-of-trust change as swapping an access-control manager or price oracle. Outside initial setup this is not a normal operation; any occurrence is top-urgency.
StakingPausedEmergencyActionERRORNew deposits (submit()) are halted while transfers and withdrawals stay live — user funds are not frozen, so this sits one tier below a full protocol stop. A deliberate, privileged emergency action worth paging.
StakingResumedEmergencyActionWARNINGThe deposit path is re-opened after a staking pause — the recovery / all-clear signal. The paired StakingPaused already paged, so this is recorded for visibility rather than paged.
StoppedEmergencyActionCRITICALThe Aragon-era top-level halt of the entire stETH contract — freezes the core mutating paths. Has never fired in production and can only be triggered by the privileged pauser; if it ever does, the whole protocol is halted, so it pages at top urgency.
ResumedEmergencyActionWARNINGThe top-level protocol halt is lifted and normal operation resumes — the recovery / all-clear signal. The paired Stopped already paged (CRITICAL), so the resume is recorded rather than paged.
StakingLimitSetProtocolParameterChangeWARNINGConfigures the staking rate-limiter (max stake limit + per-block refill) that smooths large ETH inflows. It never touches withdrawals, transfers, fees, or trust — worst case it briefly throttles new deposits — so it is recorded for visibility, not paged.
StakingLimitRemovedProtocolParameterChangeWARNINGRemoves the deposit rate-limiter entirely (deposits become unthrottled). Still only affects new-deposit smoothing, with no bearing on withdrawals, custody, or solvency, so it is recorded rather than paged.
MaxExternalRatioBPSet (increase)ProtocolParameterChangeERRORCaps the fraction of stETH backing that may come from V3 stVaults (external shares) rather than the core staking pool — the ceiling on how much of the rated token can be exposed to the newer vault mechanism and its socialised-bad-debt risk. Raising the cap expands that risk surface, so it pages. Evaluated against the previous on-chain value; an unset prior counts as 0, so first establishing a cap pages.
MaxExternalRatioBPSet (decrease)ProtocolParameterChangeWARNINGThe stVault backing cap is lowered, shrinking the share of stETH exposed to the external-vault mechanism. A de-risking change, so it is recorded rather than paged. Evaluated against the previous on-chain value.
RoleGranted (WithdrawalQueue — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key of the WithdrawalQueue, which can grant or revoke every other role on the contract that processes user redemptions. The highest-trust change on this contract, so it pages at top urgency.
RoleGranted (WithdrawalQueue — FINALIZE / ORACLE / PAUSE)RoleChangeERRORA new address gains a powerful operational role: finalizing withdrawal batches (controls payouts), feeding the finalization oracle data, or the GateSeal ability to freeze all withdrawals. Each can materially affect redemptions, so granting it pages. (PAUSE is periodically rotated to a fresh GateSeal — expected but still page-worthy to confirm the new holder.)
RoleGranted (WithdrawalQueue — RESUME)RoleChangeWARNINGA new address gains the ability to lift a withdrawal pause — a recovery-side capability. Recorded for visibility; does not page.
RoleGranted (WithdrawalQueue — MANAGE_TOKEN_URI)RoleChangeINFOA new address gains control of the withdrawal-NFT metadata URI — cosmetic, with no power over funds or protocol state. Logged for completeness only.
RoleGranted (WithdrawalQueue — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name is granted. Because an unmapped or custom role could be powerful, it is paged ("fail loud") rather than silently ignored.
RoleRevoked (WithdrawalQueue — DEFAULT_ADMIN / FINALIZE / ORACLE)RoleChangeERRORA role whose loss is dangerous is removed — the root key (removal can lock out governance), the finalize capability, or the oracle feed (losing either can stall withdrawal finalization). Worth paging even though revocations usually reduce risk, since these can also signal a hostile takeover or an operational mistake.
RoleRevoked (WithdrawalQueue — other roles)RoleChangeWARNINGA lower-impact role (PAUSE, RESUME, token-URI) is removed. PAUSE revocation is the other half of a routine GateSeal rotation, so it is recorded rather than paged (the matching grant already carries the signal).
RoleAdminChanged (WithdrawalQueue)RoleChangeERRORThe rule for who may grant or revoke a WithdrawalQueue role is rewired — a structural change to the permission graph rather than to who holds a role. Rare and deeply privileged, so it pages.
Paused (WithdrawalQueue)EmergencyActionCRITICALThe entire WithdrawalQueue is paused — halting requests, finalization, and claims, so users cannot redeem in-flight withdrawals. Fires for any holder of PAUSE_ROLE: the GateSeal break-glass is the expected caller, but governance can pause directly and did so at the V2 launch. The pause is either time-boxed (a GateSeal seal runs for a fixed window) or indefinite with no expiry, which the alert reports explicitly. Distinct from bunker mode (this is a manual guardian action, typically taken when an active threat is suspected), so it pages at top urgency.
Resumed (WithdrawalQueue)EmergencyActionWARNINGThe pause on withdrawals is lifted and redemptions resume — the recovery / all-clear signal. The paired Paused already paged, so this is recorded rather than paged.
BunkerModeEnabledEmergencyActionCRITICALThe oracle detected abnormal beacon-chain losses (mass slashing or a large validator-balance drop) and activated bunker mode, which pauses withdrawal finalization so the loss is socialised fairly instead of letting early withdrawers escape it. One of the strongest distress signals the protocol can emit, so it pages at top urgency.
BunkerModeDisabledEmergencyActionWARNINGBunker mode is lifted and normal finalization resumes — losses have been resolved. The recovery / all-clear signal, recorded rather than paged.
ContractVersionSet (WithdrawalQueue)ContractUpgradeERRORThe WithdrawalQueue proxy's implementation is upgraded — new code for the contract that processes user redemptions, while funds and storage stay in the proxy. Governance-gated; pages so it can be matched to a known governance vote.
ChangeSupportRequiredProtocolParameterChangeERRORChanges the % of yes-votes a governance proposal needs to pass — one of the two thresholds that define Lido's governance-capture resistance. Lowering it makes it cheaper for a coalition to pass proposals (which control upgrades, roles, and the locator), so any change is a rating-relevant governance-security event and pages. Has never been changed on-chain.
ChangeMinQuorumProtocolParameterChangeERRORChanges the minimum turnout a vote needs to be valid — the second governance-security threshold. Lowering it weakens capture resistance, so any change pages. Has never been changed on-chain.
ChangeVoteTime (shortened)ProtocolParameterChangeERRORChanges how long a governance vote stays open — a governance safety-time window. Shortening it reduces the time to react to a malicious proposal, so it pages. Evaluated against the previous on-chain value.
ChangeVoteTime (lengthened)ProtocolParameterChangeWARNINGThe vote-open window is lengthened, giving more time to react to a proposal. A conservative change, so it is recorded rather than paged. A first, baseline-establishing value (no previous on-chain value to compare) is also recorded rather than paged.
ChangeObjectionPhaseTime (shortened)ProtocolParameterChangeERRORChanges the length of Lido's final objection window, during which token holders can veto a passed vote. Shortening it cuts the veto reaction time, so it pages. Same directional, previous-value comparison as the vote-time window.
ChangeObjectionPhaseTime (lengthened)ProtocolParameterChangeWARNINGThe objection/veto window is lengthened, giving holders more time to veto a passed vote. A conservative change, so it is recorded rather than paged. A first, baseline-establishing value is also recorded rather than paged.
StartVoteTimelockChangeINFOA new governance proposal is created. Fires well before the proposal can execute (a multi-day vote plus objection window), and its metadata is an opaque IPFS reference, so it is recorded as governance-lifecycle context for review rather than paged.
ExecuteVoteTimelockChangeWARNINGA passed governance vote is enacted. The specific privileged changes it makes fire their own events (upgrades, role grants, parameter changes), so this is recorded as the governance-level "a proposal executed" marker to correlate those changes against — surfaced for visibility, not paged.
ExitDeadlineThresholdChangedProtocolParameterChangeWARNINGSets how long after a requested validator exit an operator is considered delinquent (plus the reporting window) — operator exit-discipline tuning. Operational rather than a fund/security lever, so it is recorded rather than paged.
ContractVersionSet (NodeOperatorsRegistry)ContractUpgradeERRORThe NodeOperatorsRegistry proxy's implementation is upgraded — new code for the operator/validator registry, funds and storage unchanged. Governance-gated; pages to be matched to a known governance vote.
LocatorContractSet (NodeOperatorsRegistry)ContractUpgradeERRORRe-points the NodeOperatorsRegistry at a different LidoLocator (used to resolve the StakingRouter and Burner). A root-of-trust redirect for operator/reward plumbing — a malicious locator could let an attacker impersonate the StakingRouter and manipulate validator accounting or reward distribution. Its damage ceiling is the operator/reward layer (not user custody or withdrawals), so it pages at ERROR, one tier below the stETH-hub locator change.
OwnershipTransferred (InsuranceFund)AdminChangeCRITICALOwnership of the InsuranceFund — the protocol's cover reserve (thousands of stETH, tens of millions of dollars) — moves to a new address. The owner can transfer every asset out of the fund, so a handover is control of the entire reserve and pages at top urgency, giving the earliest possible warning before any drain.
ERC20Transferred (InsuranceFund)EmergencyActionCRITICALAn ERC-20 asset (the fund holds stETH) is transferred out of the InsuranceFund. A material outflow of the cover reserve is either a covered-loss event (the reserve being used because a loss occurred) or theft — both are top-urgency signals, so it pages at CRITICAL.
EtherTransferred (InsuranceFund)EmergencyActionCRITICALRaw ETH is transferred out of the InsuranceFund — the same reserve-drain signal as the ERC-20 path (covered loss or theft), paged at top urgency.
ERC1155Transferred (InsuranceFund)EmergencyActionERRORAn ERC-1155 asset is transferred out of the InsuranceFund via the same owner-only drain path. NFTs are not a designed reserve asset here (the fund holds stETH), so the drain vector is monitored but at ERROR rather than the CRITICAL of the fungible-value paths.
ERC721Transferred (InsuranceFund)EmergencyActionERRORAn ERC-721 asset is transferred out of the InsuranceFund via the owner-only drain path. Monitored for completeness at ERROR, since NFTs are not a designed/valued reserve asset here.

Lido — strETH (lido)

  • Chain(s): Ethereum
  • Products: streth
  • Contracts monitored:
    • OracleSubmitter — 0x00000000df0088bd598df1e4ae57943dc481907a
    • Vault — 0x277c6a642564a91ff78b008022d65683cee5ccc5
    • Oracle — 0x8a78e6b7e15c4ae3aeaee3bf0de4f2de4078c1cd
    • LazyAdmin (Safe) — 0xabe20d266ae54b9ae30492dea6b6407bf18feeb5
    • VaultProxyAdmin — 0x94abdf2b59c6495071f32eb8fb4a0f4d2465a2f2
    • OracleProxyAdmin — 0x6ce7c72d54e9bdfb97101bd5c4988b61eb4fa156
    • wstETH RedeemQueue — 0x1ae8c006b5c97707aa074aaed42becad2cf80da2
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (OracleSubmitter)RoleChangeWARNINGRole granted on Oracle Submitter
RoleRevoked (OracleSubmitter)RoleChangeWARNINGRole revoked on Oracle Submitter
RoleAdminChanged (OracleSubmitter)RoleChangeERRORRole admin changed on Oracle Submitter
Upgraded (Vault proxy)ContractUpgradeERRORVault contract upgraded
AdminChanged (Vault proxy)AdminChangeERRORVault proxy admin changed
RoleGranted (Vault impl)RoleChangeWARNINGVault role granted
RoleRevoked (Vault impl)RoleChangeWARNINGVault role revoked
RoleAdminChanged (Vault impl)RoleChangeERRORVault role admin changed
SetQueueStatusEmergencyActionCRITICALVault queue paused/unpaused
QueueLimitSetProtocolParameterChangeINFOVault queue limit set
Upgraded (Oracle proxy)ContractUpgradeERROROracle contract upgraded
AdminChanged (Oracle proxy)AdminChangeERROROracle proxy admin changed
AddedOwner (Safe)MultisigChangeWARNINGSigner added to LazyAdmin Safe
RemovedOwner (Safe)MultisigChangeWARNINGSigner removed from LazyAdmin Safe
ChangedThreshold (Safe)MultisigChangeWARNINGLazyAdmin Safe threshold changed
EnabledModule (Safe)MultisigChangeWARNINGModule enabled on LazyAdmin Safe
DisabledModule (Safe)MultisigChangeWARNINGModule disabled on LazyAdmin Safe
ChangedGuard (Safe)MultisigChangeWARNINGGuard changed on LazyAdmin Safe
ChangedFallbackHandler (Safe)MultisigChangeWARNINGFallback handler changed on LazyAdmin Safe
OwnershipTransferred (VaultProxyAdmin)AdminChangeERRORVault ProxyAdmin ownership transferred
OwnershipTransferred (OracleProxyAdmin)AdminChangeERROROracle ProxyAdmin ownership transferred

Lombard (lombard)

  • Chain(s): Ethereum
  • Products: lbtc (timelock and consortium incidents are protocol-wide)
  • Contracts monitored:
    • LBTC Token — 0x8236a87084f8B84306f72007F36F2618A5634494
    • Timelock — 0x055E84e7FE8955E2781010B866f10Ef6E1E77e59
    • Consortium — 0xdAD58DfA5c1a7a34419AFdBE1f0d610efeea95E4
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
UpgradedContractUpgradeERRORLBTC proxy upgraded to new implementation
AdminChangedAdminChangeERRORLBTC proxy admin changed
DefaultAdminTransferScheduledAdminChangeWARNINGA handover of the LBTC admin role is scheduled; it takes effect only when the new admin accepts after the delay
DefaultAdminTransferCanceledAdminChangeINFOA pending LBTC admin handover was withdrawn
DefaultAdminDelayChangeScheduledTimelockChangeWARNINGA change to the waiting period for LBTC admin handovers is scheduled
DefaultAdminDelayChangeCanceledTimelockChangeINFOA pending change to the admin-handover delay was withdrawn
RoleGranted (LBTC — DEFAULT_ADMIN_ROLE / MINTER_ROLE)RoleChangeCRITICALA new address gains the LBTC root key or the minter role. The admin grants every other role; a minter can mint LBTC with no consortium proof and burn it from any holder, so either grant can break the 1:1 BTC backing
RoleRevoked (LBTC — DEFAULT_ADMIN_ROLE / MINTER_ROLE)RoleChangeERRORThe LBTC admin or a minter is removed — the second half of an admin handover, or a minter being retired
RoleGranted / RoleRevoked (LBTC — CLAIMER / PAUSER / MINT_BURN_PAUSER_ROLE)RoleChangeWARNINGAn operational role changes hands: the relayer for proof-backed mints, or an address that can pause the token or its mints and burns
RoleGranted / RoleRevoked (LBTC — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name changes hands. A new implementation may have added it, so it pages ("fail loud") rather than being assumed harmless
RoleAdminChanged (LBTC)RoleChangeERRORThe role that controls who can grant an LBTC role was rewired
ConsortiumChangedProtocolParameterChangeERRORLBTC consortium address changed (legacy event, not emitted by the current implementation)
BasculeChangedProtocolParameterChangeERRORLBTC bascule drawbridge address changed (legacy event, not emitted by the current implementation)
AssetRouterChangedProtocolParameterChangeWARNINGLBTC asset router changed
TreasuryAddressChangedProtocolParameterChangeWARNINGLBTC treasury address changed
FeeChangedProtocolParameterChangeWARNINGLBTC minting fee changed (legacy event: mint fees moved to the AssetRouter in November 2025)
RedeemFeeChangedProtocolParameterChangeWARNINGLBTC redeem fee changed (legacy event: redeem fees moved to the AssetRouter in November 2025)
BurnCommissionChangedProtocolParameterChangeWARNINGLBTC burn commission changed (legacy event)
DustFeeRateChangedProtocolParameterChangeWARNINGLBTC dust fee rate changed (legacy event)
RedeemsForBtcEnabledProtocolParameterChangeWARNINGLBTC redeems for BTC enabled/disabled (legacy event: the toggle moved to the AssetRouter in November 2025)
NameAndSymbolChangedProtocolParameterChangeINFOLBTC name and symbol changed
PausedEmergencyActionCRITICALLBTC token paused — all transfers, mints and burns halted
UnpausedEmergencyActionERRORLBTC token unpaused. A resume sits one tier below its pause
MintBurnPauseChanged (paused)EmergencyActionCRITICALLBTC minting and burning halted. Redemptions to BTC stop too, so holders cannot exit; transfers keep working
MintBurnPauseChanged (unpaused)EmergencyActionERRORLBTC minting, burning and redemptions resumed
MinDelayChange (decreased)TimelockChangeERRORTimelock min delay decreased
MinDelayChange (increased)TimelockChangeWARNINGTimelock min delay increased
CallScheduledTimelockChangeWARNINGTimelock call scheduled
CallExecutedTimelockChangeINFOTimelock call executed
CancelledTimelockChangeINFOTimelock call cancelled
RoleGranted (Timelock)RoleChangeWARNINGTimelock role granted
RoleRevoked (Timelock)RoleChangeWARNINGTimelock role revoked
RoleAdminChanged (Timelock)RoleChangeERRORTimelock role admin changed
OwnershipTransferred (Consortium)AdminChangeERRORConsortium ownership transferred
OwnershipTransferStarted (Consortium)AdminChangeWARNINGConsortium ownership transfer initiated
ValidatorSetUpdatedProtocolParameterChangeERRORConsortium validator set updated

Looping Collective — lcBTC (looping-collective)

  • Chain(s): Ethereum
  • Products: lcbtc
  • Contracts monitored:
    • Vault — 0xaa3cb36be406e6cf208d218fd214e0f1a71e957d
    • Oracle — 0xbae89dc56874ed0f790ce9bc698674b2da947ebf
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
UpgradeExecutedContractUpgradeERRORVault upgrade executed
UpgradeProposedContractUpgradeINFOVault upgrade proposed
UpgradeCancelledContractUpgradeINFOVault upgrade cancelled
UpgradedContractUpgradeERRORVault contract upgraded
RoleAdminChanged (Vault)RoleChangeWARNINGVault role admin changed
RoleGranted (Vault)RoleChangeWARNINGVault role granted
RoleRevoked (Vault)RoleChangeWARNINGVault role revoked
PausedEmergencyActionCRITICALVault paused
UnpausedEmergencyActionCRITICALVault unpaused
FeesUpdatedProtocolParameterChangeWARNINGVault fees updated
FeesRecipientUpdatedProtocolParameterChangeWARNINGVault fees recipient updated
OperatorSetRoleChangeWARNINGVault operator set
OracleProposedProtocolParameterChangeWARNINGOracle change proposed
OracleUpdatedProtocolParameterChangeWARNINGOracle updated
RateProviderProposedProtocolParameterChangeWARNINGRate provider change proposed
RateProviderUpdatedProtocolParameterChangeWARNINGRate provider updated
FundsHolderProposedProtocolParameterChangeWARNINGFunds holder change proposed
FundsHolderChangedProtocolParameterChangeWARNINGFunds holder changed
OwnershipTransferred (Oracle)AdminChangeERROROracle ownership transferred
OwnershipTransferStarted (Oracle)AdminChangeWARNINGOracle ownership transfer started

Maple (maple)

  • Chain(s): Ethereum
  • Products: syrupusdc, syrupusdt, plus protocol-wide for the shared GovernorTimelock
  • Contracts monitored:
    • Maple Pool (syrupUSDC) — 0x80ac24aa929eaf5013f6436cda2a7ba190f5cc0b
    • Maple PoolManager (syrupUSDC) — 0x7ad5ffa5fdf509e30186f4609c2f6269f4b6158f
    • Maple WithdrawalManagerQueue (syrupUSDC) — 0x1bc47a0dd0fdab96e9ef982fdf1f34dc6207cfe3
    • Maple Pool (syrupUSDT) — 0x356b8d89c1e1239cbbb9de4815c39a1474d5ba7d
    • Maple PoolManager (syrupUSDT) — 0x0cda32e08b48bfddbc7ee96b44b09cf286f9e21a
    • Maple WithdrawalManagerQueue (syrupUSDT) — 0x86ebdf902d800f2a82038290b6dbb2a5ee29eb8c
    • Maple GovernorTimelock — 0x2efff88747eb5a3ff00d4d8d0f0800e306c0426b
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
PendingOwnerSet (Pool)AdminChangeWARNINGPool two-step ownership transfer initiated
OwnershipAccepted (Pool)AdminChangeERRORPool ownership transfer completed
PendingDelegateSet (PoolManager)AdminChangeWARNINGPool delegate change initiated
PendingDelegateAccepted (PoolManager)AdminChangeERRORPool delegate changed
DelegateManagementFeeRateSetProtocolParameterChangeINFODelegate management fee rate set
LiquidityCapSetProtocolParameterChangeINFOPool liquidity cap changed
CollateralLiquidationTriggeredEmergencyActionCRITICALLoan default / collateral liquidation started
CollateralLiquidationFinishedEmergencyActionWARNINGCollateral liquidation completed
SetAsActive (active)EmergencyActionWARNINGPool activated
SetAsActive (inactive)EmergencyActionERRORPool deactivated
PoolPermissionManagerSetAdminChangeERRORPool access control manager changed
WithdrawalManagerSetContractUpgradeERRORWithdrawal manager contract changed
StrategyAddedProtocolParameterChangeWARNINGNew lending strategy added
IsStrategySetProtocolParameterChangeWARNINGStrategy enabled/disabled
Upgraded (PoolManager)ContractUpgradeERRORPoolManager implementation upgraded
Upgraded (WithdrawalManager)ContractUpgradeERRORWithdrawalManager implementation upgraded
DefaultTimelockSetTimelockChangeERRORDefault timelock delay/execution window changed
FunctionTimelockSetTimelockChangeWARNINGPer-function timelock override set
ProposalScheduledTimelockChangeWARNINGGovernance proposal scheduled
ProposalExecutedTimelockChangeWARNINGGovernance proposal executed
ProposalUnscheduledTimelockChangeWARNINGGovernance proposal unscheduled
RoleUpdatedRoleChangeWARNINGTimelock role granted/revoked
PendingTokenWithdrawerSetAdminChangeWARNINGPending token withdrawer set
TokenWithdrawerAcceptedAdminChangeWARNINGToken withdrawer accepted

Moonwell Flagship ETH (moonwell)

  • Chain(s): Base
  • Products: moonwell-flagship-eth (Morpho Blue base layer, governor, and multisig incidents are protocol-wide)
  • Contracts monitored:
    • Moonwell Flagship ETH Vault — 0xa0E430870c4604CcfC7B38Ca7845B1FF653D0ff1
    • Moonwell Temporal Governor — 0x8b621804a7637b781e2BbD58e256a591F2dF7d51
    • Moonwell Security Council (Guardian 3-of-5) — 0xB9d4acf113a423Bc4A64110B8738a52E51C2AB38
    • Block Analitica + B.Protocol (Curator 2-of-4) — 0x08eDEbFFaE68970DCf751baa826182b3a4aCFC05
    • MorphoBlue (Base) — 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
SetOwner (MorphoBlue)AdminChangeERRORMorphoBlue (Base) owner changed
SetFee (MorphoBlue)ProtocolParameterChangeWARNINGMorphoBlue (Base) market fee changed
SetFeeRecipient (MorphoBlue)ProtocolParameterChangeWARNINGMorphoBlue (Base) fee recipient changed
EnableIrm (MorphoBlue)ProtocolParameterChangeWARNINGMorphoBlue (Base) IRM enabled
EnableLltv (MorphoBlue)ProtocolParameterChangeWARNINGMorphoBlue (Base) LLTV tier enabled
OwnershipTransferred (Vault)AdminChangeERRORVault ownership transferred
OwnershipTransferStarted (Vault)AdminChangeWARNINGVault ownership transfer started
SetCuratorRoleChangeWARNINGVault curator changed
SetGuardianRoleChangeWARNINGVault guardian set
SubmitGuardianAdminChangeWARNINGVault guardian change submitted
RevokePendingGuardianAdminChangeINFOPending guardian change revoked
SetIsAllocatorRoleChangeWARNINGVault allocator added/removed
SetTimelockTimelockChangeWARNINGVault timelock set
SubmitTimelockTimelockChangeWARNINGVault timelock change submitted
RevokePendingTimelockTimelockChangeINFOPending timelock change revoked
SetFee (Vault)ProtocolParameterChangeWARNINGVault performance fee changed
SetFeeRecipient (Vault)ProtocolParameterChangeWARNINGVault fee recipient changed
SetSkimRecipientProtocolParameterChangeINFOVault skim recipient changed
RevokePendingCapProtocolParameterChangeINFOPending market cap change revoked
SubmitMarketRemovalProtocolParameterChangeWARNINGMarket removal submitted
RevokePendingMarketRemovalProtocolParameterChangeINFOPending market removal revoked
OwnershipTransferred (Governor)AdminChangeERRORTemporal Governor ownership transferred
GuardianChanged (Governor)RoleChangeWARNINGTemporal Governor guardian changed
GuardianPauseGrantedRoleChangeWARNINGTemporal Governor guardian pause window granted
GuardianRevokedRoleChangeWARNINGTemporal Governor guardian revoked
TrustedSenderUpdatedAdminChangeWARNINGTemporal Governor trusted (cross-chain) sender added/removed
Paused (Governor)EmergencyActionCRITICALTemporal Governor paused
Unpaused (Governor)EmergencyActionWARNINGTemporal Governor unpaused
PermissionlessUnpausedEmergencyActionWARNINGTemporal Governor permissionlessly unpaused
AddedOwner (Safe)MultisigChangeWARNINGMultisig owner added
RemovedOwner (Safe)MultisigChangeWARNINGMultisig owner removed
ChangedThreshold (Safe)MultisigChangeCRITICALMultisig threshold changed (takeover prelude)
EnabledModule (Safe)MultisigChangeCRITICALMultisig module enabled (arbitrary-tx backdoor)
DisabledModule (Safe)MultisigChangeWARNINGMultisig module disabled
ChangedGuard (Safe)MultisigChangeERRORMultisig guard changed
ChangedFallbackHandler (Safe)MultisigChangeERRORMultisig fallback handler changed

Morpho (morpho)

  • Chain(s): Ethereum
  • Products: the rated Morpho vaults, each a per-vault slug (the slugified vault label, e.g. steakhouse-usdc, gauntlet-usdc-prime-v2). MorphoBlue-core events apply protocol-wide — MorphoBlue is the shared lending singleton every vault is built on, so those events touch all of them; vault-scoped events attach only to the specific vault that emitted them
  • Contracts monitored:
    • MorphoBlue (core singleton) — 0xBBBBBBBBbb9cc5e90e3b3Af64bdAF62C37EEFFCb
    • MetaMorpho V1 vaults:
      • Steakhouse USDC — 0xBEEF01735c132Ada46AA9aA4c54623cAA92A64CB
      • Steakhouse USDT — 0xbEef047a543E45807105E51A8BBEFCc5950fcfBa
      • Steakhouse ETH — 0xBEEf050ecd6a16c4e7bfFbB52Ebba7846C4b8cD4
      • Smokehouse USDC — 0xBEeFFF209270748ddd194831b3fa287a5386f5bC
      • Gauntlet USDC Frontier — 0xc582F04d8a82795aa2Ff9c8bb4c1c889fe7b754e
      • Gauntlet USDC Prime — 0xdd0f28e19C1780eb6396170735D45153D261490d
      • Gauntlet USDC Core — 0x8eB67A509616cd6A7c1B3c8C21D48FF57df3d458
      • Gauntlet LRT Core — 0x4881Ef0BF6d2365D3dd6499ccd7532bcdBCE0658
      • Gauntlet EURC Core — 0x2ed10624315b74a78f11FAbedAa1A228c198aEfB
      • VaultBridge WBTC — 0x812B2C6Ab3f4471c0E43D4BB61098a9211017427
    • Morpho Vaults V2 (adapter-based):
      • Steakhouse Prime Instant V2 USDT — 0xbeef003C68896c7D2c3c60d363e8d71a49Ab2bf9
      • Steakhouse Prime Instant V2 USDC — 0xbeef088055857739C12CD3765F20b7679Def0f51
      • Steakhouse Prime Instant V2 EURCV — 0xbeef0C075Da5D01112AE5cF34d257074fB5DDB2f
      • Gauntlet USDC Prime V2 — 0x8c106EEDAd96553e64287A5A6839c3Cc78afA3D0
      • Gauntlet USDC Frontier V2 — 0x9a1D6bd5b8642C41F25e0958129B85f8E1176F3e
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
SetOwner (MorphoBlue)AdminChangeCRITICALTransfers ownership of MorphoBlue, the shared lending singleton that every monitored vault is built on. This is the protocol's ultimate root of trust — its owner can change core lending parameters for all vaults — so any change pages at the highest urgency.
SetFee (MorphoBlue)ProtocolParameterChangeWARNINGTurns on or changes MorphoBlue's protocol fee on a lending market — a revenue skim capped at 25% of borrow interest that never touches deposited principal. The fee has never been switched on anywhere, so a change is surfaced on the dashboard, not paged.
SetFeeRecipient (MorphoBlue)ProtocolParameterChangeWARNINGChanges where MorphoBlue's protocol fees are sent. Revenue routing only — it cannot affect deposits or solvency — so it is recorded for visibility, not paged.
EnableIrm (MorphoBlue)ProtocolParameterChangeWARNINGWhitelists a new interest-rate model that markets may opt into. It is additive (it removes nothing and cannot alter existing markets) and has only happened at protocol genesis, so it is tracked on the dashboard, not paged.
EnableLltv (MorphoBlue)ProtocolParameterChangeWARNINGWhitelists a new maximum loan-to-value tier that new markets may use. Additive and genesis-era only — it cannot change any existing market — so it is tracked on the dashboard, not paged.
OwnershipTransferred (V1 Vault)AdminChangeERROROwnership of a monitored vault passes to a new address. The vault owner controls its curator, guardian and timelock, so a completed handover is a root-of-trust change for that vault and pages.
OwnershipTransferStarted (V1 Vault)AdminChangeWARNINGThe first step of a two-step vault-ownership handover: a new owner is nominated but not yet in control, and the move can still be cancelled. Surfaced as an early signal; the page comes when it finalizes (the ERROR above).
SetCurator (V1 Vault)RoleChangeWARNINGChanges the vault's curator — the role that proposes market caps and risk policy. Its powers are timelocked and cap-bounded and the guardian can veto them, so a change is surfaced for review but does not page.
SetGuardian (V1 Vault)RoleChangeWARNINGSets or replaces the vault's guardian, the safety role that can veto risky pending changes. A safety-role change worth recording, but going through the normal process, so it is surfaced rather than paged.
SubmitGuardian (V1 Vault)AdminChangeWARNINGProposes a new guardian; the change enters the timelock queue and is not yet effective. Surfaced as an early signal of a safety-role change, not paged.
RevokePendingGuardian (V1 Vault)AdminChangeINFOCancels a pending guardian change before it takes effect, restoring the prior state. Logged for completeness only.
SetIsAllocator (V1 Vault)RoleChangeWARNINGGrants or removes an allocator — the role that can move vault funds between lending markets, but only within the caps the curator has set. Bounded authority, so it is surfaced for visibility rather than paged.
SetTimelock (V1 Vault)TimelockChangeWARNINGFinalizes a new timelock length for the vault's governance queue. The dangerous direction (shortening the safety window) is caught earlier and pages via SubmitTimelock below, so this finalization is surfaced but not paged.
SubmitTimelock (V1 Vault)TimelockChangeERRORProposes shortening the vault's timelock — the delay that gives holders and the guardian time to react to risky changes. The handler fires only on a decrease, i.e. a request to weaken that safety window, so it pages as the earliest warning.
RevokePendingTimelock (V1 Vault)TimelockChangeINFOCancels a pending timelock change before it takes effect, keeping the safer existing window. Logged for completeness only.
SetFee (V1 Vault)ProtocolParameterChangeWARNINGChanges the vault's performance fee, capped at 50% and charged only on yield — it never touches deposited principal. A routine economic knob, surfaced for visibility rather than paged.
SetFeeRecipient (V1 Vault)ProtocolParameterChangeWARNINGChanges where the vault's performance fee is sent. Revenue routing only, with no effect on deposits or solvency, so it is recorded but not paged.
SetSkimRecipient (V1 Vault)ProtocolParameterChangeINFOSets the address allowed to sweep stray tokens accidentally sent to the vault — dust only, with no effect on user funds. Logged for completeness.
SubmitCap (V1 Vault)ProtocolParameterChangeWARNINGProposes raising a market's supply cap — the main lever that increases the vault's exposure to a given lending market. The increase is timelocked and guardian-vetoable, so the proposal is surfaced for review but does not page.
SetCap (V1 Vault)ProtocolParameterChangeINFOFinalizes a supply cap or lowers one. A decrease reduces risk, and any increase was already surfaced when proposed (above), so this is logged for completeness.
RevokePendingCap (V1 Vault)ProtocolParameterChangeINFOCancels a pending supply-cap increase before it takes effect — a de-risking reversal, logged for completeness.
SubmitMarketRemoval (V1 Vault)ProtocolParameterChangeWARNINGProposes removing a lending market from the vault — a timelocked de-risking step, typically to wind down exposure to a market. Surfaced for review; not paged.
RevokePendingMarketRemoval (V1 Vault)ProtocolParameterChangeINFOCancels a pending market removal before it takes effect. A reversal, logged for completeness.
SetOwner (V2 Vault)AdminChangeERRORChanges the owner of a V2 vault, effective immediately (no two-step handover). The owner is that vault's root authority, so a change pages.
SetCurator (V2 Vault)RoleChangeWARNINGChanges a V2 vault's curator, the risk-policy role. Its actions are timelocked and a sentinel can veto them, so a change is surfaced for review but does not page.
SetIsSentinel (V2 Vault, revoke)RoleChangeERRORRemoves a sentinel — the V2 safety role that can veto risky pending changes. Losing a safety role weakens the vault's defenses, so a revocation pages.
SetIsSentinel (V2 Vault, grant)RoleChangeWARNINGAdds a sentinel (safety-veto) role. Strengthening safety is not dangerous, so it is surfaced for visibility, not paged.
SetIsAllocator (V2 Vault, grant)RoleChangeWARNINGGrants an allocator — the role that routes vault funds between adapters, within the vault's caps. Bounded authority, surfaced for visibility, not paged.
SetIsAllocator (V2 Vault, revoke)RoleChangeINFORemoves an allocator. Reducing privilege is safe, so it is logged for completeness.
Submit (V2 Vault, timelock decrease)TimelockChangeERRORThe V2 governance queue takes actions keyed by function selector; this submission requests shortening a timelock, weakening the window holders rely on to react to risky changes. It pages as the earliest signal.
Submit (V2 Vault, other actions)TimelockChangeWARNINGA timelocked action is queued in the V2 governance queue. Most queued actions are routine, so they are surfaced for review but do not page (the dangerous timelock-decrease case is the ERROR above).
Accept (V2 Vault)TimelockChangeWARNINGA previously queued V2 action clears its timelock and executes. High-volume routine governance flow; the risky specifics were already flagged when submitted, so acceptance is surfaced but not paged.
Revoke (V2 Vault)TimelockChangeINFOCancels a queued V2 action before it executes — a reversal, logged for completeness.
IncreaseTimelock (V2 Vault)TimelockChangeINFOLengthens the timelock on a V2 action selector — the safe direction, giving holders more time to react. Logged for visibility, not paged.
DecreaseTimelock (V2 Vault)TimelockChangeERRORShortens the timelock on a V2 action selector, weakening the safety window holders rely on. This is the dangerous direction — it has occurred, once dropping a selector's window to zero — so it pages.
Abdicate (V2 Vault)TimelockChangeERRORThe owner permanently gives up the ability to ever change a given action selector. It is irreversible, so even though it usually locks in a safer state, it pages so the renunciation can be confirmed as intended.
SetPerformanceFee (V2 Vault)ProtocolParameterChangeWARNINGChanges a V2 vault's performance fee, a bounded charge on yield that never touches deposited principal. A routine economic knob, surfaced for visibility, not paged.
SetManagementFee (V2 Vault)ProtocolParameterChangeWARNINGChanges a V2 vault's management fee, a bounded charge that never touches deposited principal. Surfaced for visibility, not paged.
SetPerformanceFeeRecipient (V2 Vault)ProtocolParameterChangeINFOChanges where a V2 vault's performance fee is sent — revenue routing only, with no effect on deposits or solvency. Logged for completeness.
SetManagementFeeRecipient (V2 Vault)ProtocolParameterChangeINFOChanges where a V2 vault's management fee is sent — revenue routing only. Logged for completeness.
AddAdapter (V2 Vault)ProtocolParameterChangeWARNINGAdds an adapter — a venue the vault can route funds into. New adapters are timelocked and constrained to a whitelisted registry, so an addition is surfaced for review but does not page.
RemoveAdapter (V2 Vault)ProtocolParameterChangeINFORemoves an adapter (only possible once its allocation is zero) — a de-risking step that takes a venue off the menu. Logged for completeness.
IncreaseAbsoluteCap (V2 Vault)ProtocolParameterChangeWARNINGRaises the absolute cap on how much the vault can allocate to an adapter — the main lever that increases exposure to a venue. Cap changes are timelocked, so the increase is surfaced for review but does not page.
DecreaseAbsoluteCap (V2 Vault)ProtocolParameterChangeINFOLowers an adapter's absolute allocation cap — a de-risking move that takes effect immediately. Logged for completeness.
IncreaseRelativeCap (V2 Vault)ProtocolParameterChangeWARNINGRaises the relative (percentage-of-vault) cap on an adapter, increasing how much of the vault may sit in that venue. Surfaced for review; not paged.
DecreaseRelativeCap (V2 Vault)ProtocolParameterChangeINFOLowers an adapter's relative cap — a de-risking move, logged for completeness.
SetReceiveSharesGate (V2 Vault)ProtocolParameterChangeWARNINGSets the gate controlling who may receive vault shares — a deposit-side restriction (e.g. an allowlist for new entrants). It cannot trap existing holders, so it is surfaced for visibility, not paged.
SetSendSharesGate (V2 Vault, gate set)ProtocolParameterChangeERRORSets a non-zero gate controlling who may send (transfer or redeem) vault shares — this can stop holders from exiting, so setting one pages.
SetSendSharesGate (V2 Vault, cleared)ProtocolParameterChangeINFOClears the send-shares gate back to open, removing the exit restriction. Logged for completeness.
SetReceiveAssetsGate (V2 Vault, gate set)ProtocolParameterChangeERRORSets a non-zero gate controlling who may receive assets when redeeming — this can block withdrawal payouts, so setting one pages.
SetReceiveAssetsGate (V2 Vault, cleared)ProtocolParameterChangeINFOClears the receive-assets gate, removing the payout restriction. Logged for completeness.
SetSendAssetsGate (V2 Vault)ProtocolParameterChangeWARNINGSets the gate controlling who may send assets into the vault — a deposit-side restriction that cannot trap existing holders. Surfaced for visibility, not paged.
SetMaxRate (V2 Vault)ProtocolParameterChangeWARNINGChanges the vault's maximum interest-accrual rate, a bounded accounting cap on how fast value can be booked. It cannot move funds, so it is surfaced for visibility, not paged.
SetForceDeallocatePenalty (V2 Vault)ProtocolParameterChangeWARNINGChanges the penalty (capped at 2%) that a user self-pays when forcing liquidity out of an adapter to exit. Bounded, and the fee accrues to the vault, so a change is surfaced for visibility, not paged.
SetAdapterRegistry (V2 Vault)ProtocolParameterChangeWARNINGSwaps the registry that whitelists which adapters the vault may use — a change to a core guardrail. It is double-timelocked, so it is surfaced for review but does not page.
SetLiquidityAdapterAndData (V2 Vault)ProtocolParameterChangeWARNINGSets which adapter serves as the vault's liquidity source, plus its routing data — high-volume allocator flow within existing caps. Surfaced for visibility, not paged.
ForceDeallocate (V2 Vault, ≥10% TVL)ProtocolParameterChangeWARNINGAnyone can call this to pull liquidity back into the vault's cash buffer and withdraw immediately, self-paying a capped (≤2%) fee that benefits other holders — normal behavior, not an attack. An unusually large pull (≥10% of the vault) raises a non-paging WARNING as a liquidity-stress signal.
ForceDeallocate (V2 Vault, <10% TVL)ProtocolParameterChangeINFOA routine permissionless force-deallocation: a user pulls liquidity into the buffer to withdraw, self-paying a capped (≤2%) fee that accrues to the vault. Logged for visibility; never pages.

Ondo (ondo)

  • Chain(s): Ethereum
  • Products: usdy, ousg (Blocklist and Safe multisig events are protocol-wide)
  • Contracts monitored:
    • USDY Token — 0x96f6ef951840721adbf46ac996b59e0235cb985c
    • USDY Manager — 0x25a103a1d6aec5967c1a4fe2039cdc514886b97e
    • USDY Oracle — 0xa0219aa5b31e65bc920b5b6dfb8edf0988121de0
    • OUSG Token — 0x1b19c19393e2d034d8ff31ff34c81252fcbbee92
    • OUSG InstantManager — 0x93358db73b6cd4b98d89c8f5f230e81a95c2643a
    • Blocklist — 0xd8c8174691d936e2c80114ec449037b13421b0a8
    • ProxyAdmin Owner Multisig — 0x1a694a09494e214a3be3652e4b343b7b81a73ad7
    • Management Multisig — 0xaed4caf2e535d964165b4392342f71bac77e8367
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (USDY)ContractUpgradeERRORUSDY proxy upgraded to new implementation
AdminChanged (USDY)AdminChangeERRORUSDY proxy admin changed
RoleGranted (USDY)RoleChangeWARNINGUSDY role granted
RoleRevoked (USDY)RoleChangeWARNINGUSDY role revoked
RoleAdminChanged (USDY)RoleChangeERRORUSDY role admin changed
AllowlistSet (USDY)ProtocolParameterChangeWARNINGUSDY allowlist contract changed
BlocklistSet (USDY)ProtocolParameterChangeWARNINGUSDY blocklist contract changed
SanctionsListSet (USDY)ProtocolParameterChangeWARNINGUSDY sanctions list contract changed
Paused (USDY)EmergencyActionCRITICALUSDY token paused
Unpaused (USDY)EmergencyActionCRITICALUSDY token unpaused
RoleGranted (USDY Manager)RoleChangeWARNINGUSDY Manager role granted
RoleRevoked (USDY Manager)RoleChangeWARNINGUSDY Manager role revoked
RoleAdminChanged (USDY Manager)RoleChangeERRORUSDY Manager role admin changed
MintFeeSetProtocolParameterChangeWARNINGUSDY mint fee changed
RedemptionFeeSetProtocolParameterChangeWARNINGUSDY redemption fee changed
MinimumDepositAmountSetProtocolParameterChangeINFOUSDY minimum deposit amount changed
MinimumRedemptionAmountSetProtocolParameterChangeINFOUSDY minimum redemption amount changed
OffChainRedemptionMinimumSetProtocolParameterChangeINFOUSDY off-chain redemption minimum changed
AssetSenderSetAdminChangeWARNINGUSDY Manager asset sender changed
FeeRecipientSetAdminChangeWARNINGUSDY Manager fee recipient changed
NewPricerSetAdminChangeWARNINGUSDY Manager pricer changed
BlocklistSet (USDY Manager)ProtocolParameterChangeWARNINGUSDY Manager blocklist contract changed
SanctionsListSet (USDY Manager)ProtocolParameterChangeWARNINGUSDY Manager sanctions list changed
SubscriptionPausedEmergencyActionWARNINGUSDY subscriptions (minting) paused
SubscriptionUnpausedEmergencyActionWARNINGUSDY subscriptions (minting) unpaused
RedemptionPausedEmergencyActionWARNINGUSDY redemptions paused
RedemptionUnpausedEmergencyActionWARNINGUSDY redemptions unpaused
OffChainRedemptionPausedEmergencyActionWARNINGUSDY off-chain redemptions paused
OffChainRedemptionUnpausedEmergencyActionWARNINGUSDY off-chain redemptions unpaused
RangeSet (USDY Oracle)ProtocolParameterChangeWARNINGUSDY oracle range set (new interest rate range)
RangeOverriden (USDY Oracle)ProtocolParameterChangeERRORUSDY oracle range overridden
RoleGranted (USDY Oracle)RoleChangeWARNINGUSDY Oracle role granted
RoleRevoked (USDY Oracle)RoleChangeWARNINGUSDY Oracle role revoked
RoleAdminChanged (USDY Oracle)RoleChangeERRORUSDY Oracle role admin changed
Paused (USDY Oracle)EmergencyActionWARNINGUSDY oracle paused
Unpaused (USDY Oracle)EmergencyActionWARNINGUSDY oracle unpaused
Upgraded (OUSG)ContractUpgradeERROROUSG proxy upgraded to new implementation
AdminChanged (OUSG)AdminChangeERROROUSG proxy admin changed
RoleGranted (OUSG)RoleChangeWARNINGOUSG role granted
RoleRevoked (OUSG)RoleChangeWARNINGOUSG role revoked
RoleAdminChanged (OUSG)RoleChangeERROROUSG role admin changed
KYCRegistrySetProtocolParameterChangeWARNINGOUSG KYC registry contract changed
KYCRequirementGroupSetProtocolParameterChangeWARNINGOUSG KYC requirement group changed
Paused (OUSG)EmergencyActionCRITICALOUSG token paused
Unpaused (OUSG)EmergencyActionCRITICALOUSG token unpaused
RoleGranted (OUSG InstantManager)RoleChangeWARNINGOUSG InstantManager role granted
RoleRevoked (OUSG InstantManager)RoleChangeWARNINGOUSG InstantManager role revoked
RoleAdminChanged (OUSG InstantManager)RoleChangeERROROUSG InstantManager role admin changed
MinimumDepositAmountSet (OUSG IM)ProtocolParameterChangeINFOOUSG InstantManager minimum deposit amount changed
MinimumRedemptionAmountSet (OUSG IM)ProtocolParameterChangeINFOOUSG InstantManager minimum redemption amount changed
MinimumRwaPriceSetProtocolParameterChangeWARNINGOUSG InstantManager minimum RWA price changed
OndoOracleSetContractUpgradeERROROUSG InstantManager oracle contract changed
OndoComplianceSetProtocolParameterChangeWARNINGOUSG InstantManager compliance contract changed
OndoIDRegistrySetProtocolParameterChangeWARNINGOUSG InstantManager ID registry changed
OndoRateLimiterSetProtocolParameterChangeWARNINGOUSG InstantManager rate limiter changed
OndoRedemptionFeesSetProtocolParameterChangeWARNINGOUSG InstantManager redemption fees contract changed
OndoSubscriptionFeesSetProtocolParameterChangeWARNINGOUSG InstantManager subscription fees contract changed
OndoTokenRouterSetContractUpgradeERROROUSG InstantManager token router changed
AcceptedRedemptionTokenSetProtocolParameterChangeWARNINGOUSG InstantManager redemption token added/removed
AcceptedSubscriptionTokenSetProtocolParameterChangeWARNINGOUSG InstantManager subscription token added/removed
AdminSubscriptionCheckerSetProtocolParameterChangeWARNINGOUSG InstantManager admin subscription checker changed
SubscribePausedEmergencyActionWARNINGOUSG instant subscriptions (minting) paused
SubscribeUnpausedEmergencyActionWARNINGOUSG instant subscriptions (minting) unpaused
RedeemPausedEmergencyActionWARNINGOUSG instant redemptions paused
RedeemUnpausedEmergencyActionWARNINGOUSG instant redemptions unpaused
OwnershipTransferred (Blocklist)AdminChangeERRORBlocklist ownership transferred
OwnershipTransferStarted (Blocklist)AdminChangeWARNINGBlocklist ownership transfer started
AddedOwner (Safe)MultisigChangeWARNINGOwner added to multisig
RemovedOwner (Safe)MultisigChangeWARNINGOwner removed from multisig
ChangedThreshold (Safe)MultisigChangeWARNINGMultisig threshold changed
EnabledModule (Safe)MultisigChangeWARNINGModule enabled on multisig
DisabledModule (Safe)MultisigChangeWARNINGModule disabled on multisig
ChangedGuard (Safe)MultisigChangeWARNINGGuard changed on multisig
ChangedFallbackHandler (Safe)MultisigChangeWARNINGFallback handler changed on multisig

Puffer (puffer)

  • Chain(s): Ethereum
  • Products: pufeth (governance/multisig/timelock incidents are protocol-wide)
  • Contracts monitored:
    • PufferVault (pufETH) — 0xD9A442856C234a39a81a089C06451EBAa4306a72
    • PufferWithdrawalManager — 0xDdA0483184E75a5579ef9635ED14BacCf9d50283
    • Timelock — 0x3C28B7c7Ba1A1f55c9Ce66b263B33B204f2126eA
    • AccessManager — 0x8c1686069474410E6243425f4a10177a94EBEE11
    • PufferOracle — 0x0BE2aE0edbeBb517541DF217EF0074FC9a9e994f
    • CommunityMultisig — 0x446d4d6b26815f9bA78B5D454E303315D586Cb2a
    • OperationsMultisig — 0xC0896ab1A8cae8c2C1d27d011eb955Cca955580d
    • PauserMultisig — 0x1ba8e3aA853F73ae8093E26B7B8F2520c3620Df4
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (Vault)ContractUpgradeERRORPufferVault (pufETH) proxy upgraded
AuthorityUpdated (Vault)AdminChangeCRITICALPufferVault authority (AccessManager) swapped — access-control takeover vector on the fund-bearing vault
ExitFeeBasisPointsSetProtocolParameterChangeWARNINGExit fee changed (basis points)
TreasuryExitFeeBasisPointsSetProtocolParameterChangeWARNINGTreasury exit fee changed (basis points)
UpdatedTotalRewardsAmountProtocolParameterChangeINFOTotal rewards updated (affects exchange rate)
DelayChanged (Timelock, decreased)TimelockChangeERRORTimelock delay decreased
DelayChanged (Timelock, increased)TimelockChangeWARNINGTimelock delay increased
TransactionQueuedTimelockChangeINFOTimelock transaction queued
TransactionExecutedTimelockChangeINFOTimelock transaction executed
TransactionCanceledTimelockChangeINFOTimelock transaction cancelled
PauserChanged (Timelock)AdminChangeERRORTimelock pauser changed
RoleGranted (AccessManager, ADMIN_ROLE)RoleChangeCRITICALRoot admin role granted — protocol root of trust
RoleGranted (AccessManager, powerful role)RoleChangeERRORPowerful protocol role granted (Puffer DAO, Puffer Protocol, Vault Withdrawer, pufETH Burner), or an unknown/unlabeled role (fail-loud)
RoleGranted (AccessManager, operational role)RoleChangeWARNINGOperational role granted (Operations Multisig/Paymaster, Withdrawal Finalizer, Revenue Depositor, VT_PRICER)
RoleRevoked (AccessManager, ADMIN_ROLE)RoleChangeERRORRoot admin role revoked
RoleRevoked (AccessManager, other role)RoleChangeWARNINGNon-root role revoked (risk-reducing)
RoleAdminChangedRoleChangeCRITICALAccessManager role-admin rewired — meta-authority over the permission system
RoleGuardianChangedRoleChangeWARNINGAccessManager role guardian changed
RoleLabelRoleChangeINFOAccessManager role labeled
RoleGrantDelayChangedTimelockChangeWARNINGAccessManager grant delay changed
TargetClosed (pufETH vault, closed)EmergencyActionCRITICALpufETH vault closed — live product pause, funds locked
TargetClosed (other target, closed)EmergencyActionERRORNon-core AccessManager target closed (paused)
TargetClosed (reopened)EmergencyActionWARNINGAccessManager target reopened (unpaused)
TargetAdminDelayUpdated (decreased)TimelockChangeERRORPer-target admin delay decreased — shrinks the observation window for admin ops
TargetAdminDelayUpdated (increased)TimelockChangeWARNINGPer-target admin delay increased (hardening)
TargetFunctionRoleUpdated (core target → PUBLIC_ROLE)RoleChangeERRORCore contract function opened to anyone (PUBLIC_ROLE)
TargetFunctionRoleUpdated (other)RoleChangeWARNINGAccessManager function-selector role updated
OperationScheduledTimelockChangeINFOAccessManager operation scheduled
OperationExecutedTimelockChangeINFOAccessManager operation executed
OperationCanceledTimelockChangeINFOAccessManager operation cancelled
AuthorityUpdated (Oracle)AdminChangeERRORPufferOracle authority updated
TotalNumberOfValidatorsUpdatedProtocolParameterChangeINFOTotal number of validators updated
ValidatorTicketMintPriceUpdated (dropped to zero)ProtocolParameterChangeERRORValidator ticket mint price dropped to zero — oracle-fault canary
ValidatorTicketMintPriceUpdated (non-zero move)ProtocolParameterChangeINFOValidator ticket mint price changed (off the pufETH-backing path — no peg/solvency signal)
AddedOwner (Safe)MultisigChangeERRORMultisig owner added
RemovedOwner (Safe)MultisigChangeERRORMultisig owner removed
ChangedThreshold (Safe)MultisigChangeCRITICALMultisig signing threshold changed
EnabledModule (Safe)MultisigChangeCRITICALMultisig module enabled — can bypass the owner-threshold check
DisabledModule (Safe)MultisigChangeERRORMultisig module disabled
ChangedGuard (Safe)MultisigChangeERRORMultisig guard changed
ChangedFallbackHandler (Safe)MultisigChangeERRORMultisig fallback handler changed
MaxWithdrawalAmountChangedProtocolParameterChangeWARNINGMax 2-step withdrawal amount changed
Upgraded (WithdrawalManager)ContractUpgradeERRORPufferWithdrawalManager proxy upgraded
AuthorityUpdated (WithdrawalManager)AdminChangeERRORPufferWithdrawalManager authority updated

Rocket Pool (rocketpool)

  • Chain(s): Ethereum
  • Products: reth
  • Contracts monitored:
    • rETH Token — 0xae78736cd615f374d3085123a210448e74fc6393
    • RocketStorage — 0x1d8f8f00cfa6758d7be78336684788fb0ee0fa46
    • RocketDAONodeTrustedUpgrade — 0x952999ec97248547d810fd6464fdb78855b022ab
    • RocketDAOProposal — 0x37714d3a9d3b3091220d68184e3afec4ec911368
    • RocketDAOProtocol — 0x0429cdd8ceace24d4dc2b97ce22a780a407df0e1
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
GuardianChangedAdminChangeERRORProtocol guardian (most privileged admin) changed
ContractUpgradedContractUpgradeERRORExisting protocol contract replaced
ContractAddedContractUpgradeWARNINGNew contract registered
ABIUpgradedContractUpgradeINFOABI upgraded
ABIAddedContractUpgradeINFONew ABI registered
ProposalExecutedProtocolParameterChangeWARNINGoDAO proposal executed (changes take effect)
ProposalAddedProtocolParameterChangeINFOoDAO proposal submitted
ProposalCancelledProtocolParameterChangeINFOoDAO proposal cancelled
BootstrapSettingUint (call)ProtocolParameterChangeWARNINGGuardian-only bootstrap uint setting changed
BootstrapSettingBool (call)ProtocolParameterChangeWARNINGGuardian-only bootstrap bool setting changed
BootstrapSettingAddress (call)ProtocolParameterChangeWARNINGGuardian-only bootstrap address setting changed
BootstrapDisable (call)AdminChangeERRORBootstrap mode disabled (governance transition)

Sky (sky)

  • Chain(s): Ethereum
  • Products: susds
  • Contracts monitored:
    • sUSDS Vault — 0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD
    • USDS Token — 0xdC035D45d973E3EC169d2276DDab16f1e407384F
    • GSM (MCD Pause) — 0xbE286431454714F511008713973d3B053A2d38f3
    • ESM (Emergency Shutdown Module) — 0x09e05fF6142F2f9de8B6B65855A1d56B6cfE4c58
    • End (Global Settlement) — 0x0e2e8f1D1326A4B9633D96222Ce399c708B19c28
    • Protego (Emergency Spells) — 0x5C9c3cb0490938c9234ABddeD37a191576ED8624
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
File (sUSDS Vault)ProtocolParameterChangeINFOsUSDS parameter changed (e.g. SSR)
Upgraded (sUSDS Vault)ContractUpgradeERRORsUSDS vault contract upgraded
Rely (sUSDS Vault)AdminChangeWARNINGsUSDS ward added
Deny (sUSDS Vault)AdminChangeWARNINGsUSDS ward removed
Rely (USDS Token)AdminChangeWARNINGUSDS ward added
Deny (USDS Token)AdminChangeWARNINGUSDS ward removed
Upgraded (USDS Token)ContractUpgradeERRORUSDS token contract upgraded
LogSetOwner (GSM)AdminChangeERRORGSM owner changed
LogSetAuthority (GSM)AdminChangeERRORGSM authority changed
setDelay call (GSM)TimelockChangeWARNINGGSM delay (timelock) changed
plot call (GSM)TimelockChangeWARNINGGovernance spell scheduled
exec call (GSM)TimelockChangeWARNINGGovernance spell executed
drop call (GSM)TimelockChangeWARNINGGovernance spell dropped
Fire (ESM)EmergencyActionCRITICALEmergency shutdown triggered
Join (ESM)EmergencyActionWARNINGMKR/SKY burned toward shutdown threshold
Rely (ESM)AdminChangeWARNINGESM ward added
Deny (ESM)AdminChangeWARNINGESM ward removed
Cage (End, no args)EmergencyActionCRITICALGlobal settlement initiated
Cage (End, collateral)EmergencyActionERRORCollateral type caged
Rely (End)AdminChangeWARNINGEnd ward added
Deny (End)AdminChangeWARNINGEnd ward removed
Thaw (End)EmergencyActionERRORGlobal settlement debt finalized
Deploy (Protego)EmergencyActionWARNINGEmergency drop spell deployed
Drop (Protego)EmergencyActionERRORGovernance plan dropped via Protego

Spark (spark)

  • Chain(s): Ethereum
  • Products: the 4 rated Spark products — spweth (SparkLend WETH market), wsteth (SparkLend wstETH market), spusdc and spusdt (ERC4626 savings vaults). Per-asset SparkLend events only escalate above INFO for the rated reserves (WETH, wstETH); changes on other reserves are tracked on the dashboard. Most governance/infra events are protocol-wide (product: "")
  • Contracts monitored:
    • Pool — 0xc13e21b648a5ee794902342038ff3adab66be987
    • PoolConfigurator — 0x542dba469bde58faee189ffb60c6b49ce60e0738
    • PoolAddressesProvider — 0x02c3ea4e34c0cbd694d2adfa2c690eecbc1793ee
    • ACLManager — 0xda135cd78a086025bcdc87b038a1c462032b510c
    • GovernanceExecutor — 0x3300f198988e4c9c63f75df86de36421f06af8c4
    • ALMFreezerMultisig — 0x90d8c80c028b4c09c0d8dcaab9bbb057f0513431
    • SparkFoundationMultisig — 0x92e4629a4510af5819d7d1601464c233599ff5ec
    • SparkLendFreezerMultisig — 0x44effc473e81632b12486866aa1678edbb7beec3
    • ALMProxy — 0x1601843c5e9bc251a3272907010afa41fa18347e
    • Oracle — 0x8105f69d9c41644c6a0803fda7d03aa70996cfd9
    • Treasury — 0xb137e7d16564c81ae2b0c8ee6b55de81dd46ece5
    • spUSDC Vault — 0x28b3a8fb53b741a8fd78c0fb9a6b2393d896a43d
    • spUSDT Vault — 0xe2e7a17dff93280dec073c995595155283e3c372
    • spWETH (aToken) — 0x59cd1c87501baa753d0b5b5ab5d8416a45cd71db
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (ACLManager — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key that administers every other ACL role — effectively whole-protocol control. Highest-trust change; pages at top urgency.
RoleGranted (ACLManager — POOL_ADMIN / EMERGENCY_ADMIN / ASSET_LISTING_ADMIN)RoleChangeERRORA new address gains a powerful privileged role: pool administration (including upgrading the aTokens that hold supplier funds), the ability to pause/freeze reserves, or authority to list new assets. Each can materially affect funds or availability, so it pages.
RoleGranted (ACLManager — RISK_ADMIN / BRIDGE)RoleChangeWARNINGA new address gains a bounded operational role — tuning risk parameters within limits, or bridge minting capped by configuration. Expected governance activity; recorded but not paged.
RoleGranted (ACLManager — FLASH_BORROWER)RoleChangeINFOA new address gains the flash-borrower role (fee-exempt flashloans). Low-power; dashboard-only.
RoleRevoked (ACLManager — DEFAULT_ADMIN / EMERGENCY_ADMIN / POOL_ADMIN)RoleChangeERRORA powerful role is removed from an address (e.g. de-authorizing an old admin during a governance migration). Pages to confirm against a known governance action.
RoleRevoked (ACLManager — other roles)RoleChangeWARNINGA bounded/operational role is removed. Privilege reduction is low-risk; recorded but not paged.
RoleAdminChanged (ACLManager)RoleChangeCRITICALChanges which role administers another ACL role — re-pointing this can hand control of an entire privilege branch (e.g. making a new role the admin of POOL_ADMIN). Restructures the permission hierarchy itself; pages at top urgency. Never fired on Spark.
Rely (GovernanceExecutor)AdminChangeERRORSky/Maker rely(usr) — authorizes a new address (wards[usr]=1) to call every auth-gated function on the governance executor that runs passed spells, i.e. grants governance-execution authority. Pages to confirm against governance. A tier below Aave's executor ownership transfer (CRITICAL) since it adds a ward rather than transferring sole ownership. 4 on-chain (deploy-time wiring of the Sky stack).
Deny (GovernanceExecutor)AdminChangeWARNINGSky/Maker deny(usr) — clears a ward (wards[usr]=0), removing that address's authority on the governance executor. The inverse of Rely; removing authority is risk-reducing, so recorded but not paged. 1 on-chain (deploy-time cleanup).
ACLAdminUpdated (PoolAddressesProvider)AdminChangeERRORChanges the registered ACL admin — the account treated as the access-control superuser (holds DEFAULT_ADMIN_ROLE on the ACLManager). Pages to confirm against governance. Matches Aave. 3 on-chain (early governance setup).
ACLManagerUpdated (PoolAddressesProvider)ContractUpgradeCRITICALPoints the protocol at a new ACLManager contract. Since the ACLManager is the registry of every role, this swaps the entire permission system at once (a malicious one could grant any role to anyone). Matches Aave. 1 on-chain (deploy).
PoolUpdated (PoolAddressesProvider)ContractUpgradeERRORRegistry-side announcement that the main Pool implementation was upgraded. The Pool holds all core lending logic (supply/borrow/withdraw/repay/liquidate, interest accrual), so it changes core behavior. Twins with the Pool proxy's own Upgraded. Matches Aave. 4 on-chain (SparkLend version upgrades).
PoolConfiguratorUpdated (PoolAddressesProvider)ContractUpgradeERRORUpgrades the implementation behind the PoolConfigurator proxy — the contract governance uses to set every per-reserve risk parameter (caps, collateral config, freeze/pause, fees, token upgrades). A tier below the ACLManager/Oracle swaps (it cannot itself move funds or forge prices). Matches Aave. 1 on-chain (deploy).
PriceOracleUpdated (PoolAddressesProvider)ContractUpgradeCRITICALPoints the protocol at a new price oracle contract. The oracle values all collateral and debt, so a malicious one can mark collateral to zero (liquidate everyone) or inflate it (drain the pool) — drives the market to insolvency. Matches Aave. Distinct from per-asset AssetSourceUpdated on the oracle. 1 on-chain (deploy).
PriceOracleSentinelUpdated (PoolAddressesProvider)ContractUpgradeERRORSets/replaces the PriceOracleSentinel, which gates borrows/liquidations during sequencer or oracle downtime (a grace-period so users aren't liquidated on stale prices). A bad one could allow liquidations on stale prices. A tier below the oracle itself (it gates timing, not prices). Matches Aave. 0 on-chain (trip-wire).
PoolDataProviderUpdated (PoolAddressesProvider)ContractUpgradeWARNINGSwaps the PoolDataProvider — a read-only aggregator UIs/integrators use to fetch reserve data. No fund-moving or risk logic, so recorded but not paged. Matches Aave. 1 on-chain (deploy).
OwnershipTransferred (AddressesProvider)AdminChangeCRITICALTransfers ownership of the PoolAddressesProvider — the root key that can swap the Pool, PoolConfigurator, ACLManager, and Oracle. This is SparkLend's root upgrade authority, so an ownership move is top-urgency. Matches Aave. 4 on-chain (early handoffs into the Sky governance pipeline).
ProxyCreated (PoolAddressesProvider)ContractUpgradeINFODeploys a new proxy for a registry id — first-time setup of a core contract (Pool, PoolConfigurator) at launch. Subsequent implementation changes are caught by the Updated events above. Matches Aave. 2 on-chain (deploy).
AddressSetAsProxy (PoolAddressesProvider)ContractUpgradeERRORSets/updates the implementation for a registry id via the provider's own managed proxy — a registry-driven upgrade of a core contract (same risk class as PoolUpdated/PoolConfiguratorUpdated). Matches Aave. 0 on-chain (trip-wire).
AddressSet (PoolAddressesProvider)ContractUpgradeERRORRegisters or changes a core address stored under a registry id (non-proxy variant — points an id directly at an address). A structural change to the protocol's wiring. Matches Aave. 0 on-chain (trip-wire).
ReserveFactorChangedProtocolParameterChangeINFO (WARNING if >50%)Sets a reserve's reserve factor — the % of borrow interest skimmed to the treasury vs. paid to suppliers. Purely an economic split; routine within the 5–50% band (INFO), only an abnormal >50% setting warns. Rated reserves carry their product key. Matches Aave. 32 on-chain (all routine).
FlashloanPremiumTotalUpdatedProtocolParameterChangeINFO (WARNING if >100bps)Sets the total flash-loan fee (bps). Historically 5–9 bps; only an anomalous >1% setting (misconfig/tampering) warns. Market-wide. Matches Aave. 3 on-chain (all routine).
FlashloanPremiumToProtocolUpdatedProtocolParameterChangeINFOSets the share of the flash-loan fee routed to the treasury (vs. suppliers) — a pure internal fee-split, no solvency/access impact. Matches Aave. 0 on-chain.
BridgeProtocolFeeUpdatedProtocolParameterChangeINFOSets the fee on bridged/'portal' unbacked liquidity (Aave cross-chain feature; unused on Spark). Matches Aave. 0 on-chain.
LiquidationProtocolFeeChangedProtocolParameterChangeINFO (WARNING if >30%)Sets the protocol's cut of the liquidation bonus for a reserve. Too high erodes liquidator incentive → stalled liquidations → bad-debt risk (gradual, so WARNING not ERROR above the band). Historical 0–20%. Rated reserves carry their product key. Matches Aave. 16 on-chain (all routine).
ATokenUpgradedContractUpgradeERRORUpgrades a reserve's aToken (deposit receipt that custodies supplier funds) implementation — fund-bearing code. Matches Aave. 0 on-chain.
StableDebtTokenUpgradedContractUpgradeERRORUpgrades a reserve's stable-debt-token (fixed-rate borrow positions) implementation. Spark v3.0.2 still ships stable-rate debt (no Aave-v3.2 analog). 0 on-chain.
VariableDebtTokenUpgradedContractUpgradeERRORUpgrades a reserve's variable-debt-token (variable-rate borrow positions) implementation. Matches Aave. 0 on-chain.
ReserveInterestRateStrategyChangedProtocolParameterChangeINFOPoints a reserve at a new interest-rate-strategy contract (the utilization→APR curve). Only changes rates going forward — cannot touch principal or collateral config — so dashboard-only. Rated reserves carry their product key. Matches Aave. 56 on-chain (frequent rate tuning).
ReservePaused (rated asset — paused)EmergencyActionCRITICALA rated reserve (WETH/wstETH) is paused — ALL actions blocked (supply/borrow/withdraw/repay/liquidate), so funds go dark. Top-urgency. Matches Aave. 0 on-chain.
ReservePaused (rated asset — unpaused)EmergencyActionWARNINGA rated reserve is unpaused (recovery). Matches Aave.
ReservePaused (non-rated asset)EmergencyActionINFOPause/unpause on a non-rated reserve — dashboard-only.
ReserveFrozen (rated asset — frozen)EmergencyActionERRORA rated reserve (WETH/wstETH) is frozen — blocks new supply/borrow but exit still allowed (one tier below pause). A de-risking signal worth confirming. Matches Aave. 0 on-chain (rated).
ReserveFrozen (rated asset — unfrozen)EmergencyActionWARNINGA rated reserve is unfrozen (recovery). Matches Aave.
ReserveFrozen (non-rated asset)EmergencyActionINFOFreeze/unfreeze on a non-rated reserve — routine risk-management, dashboard-only. 13 on-chain (all non-rated).
CollateralConfigurationChanged (rated asset — LT drop ≥500bps or LTV→0)ProtocolParameterChangeERRORA rated reserve's (WETH/wstETH) solvency config is tightened dangerously — liquidation threshold cut ≥5% or LTV set to 0. Lowering the threshold can make existing positions instantly liquidatable. Stateful (compares to prior on-chain config). Matches Aave/HyperLend. 0 on-chain (rated configs only ever loosened).
CollateralConfigurationChanged (rated asset — other)ProtocolParameterChangeWARNINGOther collateral-config change on a rated reserve (e.g. LTV/threshold raised). Recorded for visibility.
CollateralConfigurationChanged (non-rated asset)ProtocolParameterChangeINFOCollateral config change on a non-rated reserve — dashboard-only. 50 total on-chain.
BorrowCapChangedProtocolParameterChangeINFO (WARNING if a rated asset's cap is disabled →1)Sets the max total borrowable for a reserve (0=unlimited). Touches only new borrowing. A reduction to 1 (effectively disabled) on a rated asset is a wind-down canary → WARNING. Matches Aave. 498 on-chain — incl. one real signal: wstETH 17444→1 (block 23218585).
SupplyCapChangedProtocolParameterChangeINFO (WARNING if a rated asset's cap is disabled →1)Sets the max total suppliable for a reserve (0=unlimited). Same wind-down-canary logic. Matches Aave. 867 on-chain (all routine).
DebtCeilingChangedProtocolParameterChangeINFO (WARNING if a rated asset crosses the isolation boundary)Sets the isolation-mode debt ceiling (USD) for an isolated-collateral reserve. WARNING when a rated asset enters/exits isolation mode; else INFO. Matches Aave. 12 on-chain (none on rated).
SiloedBorrowingChangedProtocolParameterChangeWARNING (rated asset toggle) / INFO (non-rated)Toggles siloed borrowing — a siloed asset can only be borrowed alone. A real toggle on a rated reserve is a risk-posture change (WARNING); non-rated toggles and listing-time no-ops are INFO. Matches Aave. 15 on-chain.
EModeCategoryAddedProtocolParameterChangeERROR (rated-holding category, LT drop ≥500bps) / WARNING (rated-holding, other change) / INFODefines/updates an efficiency-mode category's LTV & liquidation threshold. For a position in the category, the category LT — not the per-asset LT — is binding, so a ≥500bps drop on a category that holds a rated asset (WETH/wstETH both sit in cat 1 "ETH", LT 93%) can make e-mode positions instantly liquidatable → ERROR. Stateful (compares to prior category LT). 4 on-chain (cat-1 LT only ever raised → 0 ERROR historically; clean trip-wire).
EModeAssetCategoryChangedProtocolParameterChangeERROR (rated asset removed, newCategory 0) / WARNING (rated added/moved) / INFO (non-rated)Assigns an asset to an e-mode category (or removes it). Removing a rated asset from e-mode collapses its effective LT from the category (93%) to its base value → mass-liquidation risk → ERROR. Adding/moving is governance-normal leverage → WARNING. 2 on-chain on rated assets (WETH & wstETH → cat 1 at launch).
Upgraded (Pool proxy)ContractUpgradeERRORERC1967 implementation swap on the main Pool proxy — the contract holding all core lending logic. Twins with PoolUpdated (registry-side). Matches Aave/HyperLend. 3 on-chain (SparkLend version upgrades).
Upgraded (spUSDC Vault proxy)ContractUpgradeERRORERC1967 implementation swap on the spUSDC savings-vault proxy — fund-bearing code on a rated product. Consistent with every fund-bearing proxy upgrade (Pool, aTokens, Treasury). 1 on-chain (setup).
RoleGranted (spUSDC Vault)RoleChangeCRITICAL (DEFAULT_ADMIN) / WARNING (SETTER, TAKER)Grants a vault role. DEFAULT_ADMIN controls the rated vault → CRITICAL; SETTER_ROLE (sets VSR/caps) and TAKER_ROLE (takes surplus) are bounded operational roles → WARNING. 5 on-chain (DEFAULT_ADMIN ×1, SETTER ×3, TAKER ×1).
RoleRevoked (spUSDC Vault)RoleChangeERROR (DEFAULT_ADMIN) / WARNING (others)Removes a vault role. Losing the admin key is notable (ERROR); other revokes are privilege reductions (WARNING). 2 on-chain.
RoleAdminChanged (spUSDC Vault)RoleChangeCRITICALChanges which role administers another vault role — restructures the vault's permission tree (consistent with the ACLManager decision). 0 on-chain (trip-wire).
DepositCapSet (spUSDC)ProtocolParameterChangeINFO (WARNING if cap →0)Sets the vault's max total deposits (0 = disabled here). Routine raises are INFO; a reduction to 0 (deposits disabled = wind-down) warns. 5 on-chain (all increases).
VsrSet (spUSDC)ProtocolParameterChangeINFOSets the Vault Savings Rate (depositor yield). Bounded on-chain by VsrBounds and economic-only, so dashboard-only regardless of value. On-chain range ~2.5–4.9% APY.
VsrBoundsSet (spUSDC)ProtocolParameterChangeINFO (WARNING if max bound raised)Sets the min/max the VSR may take — the governance guard-rail. Widening the max bound (what would enable an abnormal rate) warns; tightening is INFO. 1 on-chain (setup, max set to ~10% APY).
Upgraded (spUSDC Vault impl, UUPS)ContractUpgradeERRORUUPS self-upgrade of the spUSDC vault implementation (impl upgrades itself) — fund-bearing on a rated product. 1 on-chain.
Upgraded (spUSDT Vault proxy)ContractUpgradeERRORERC1967 implementation swap on the spUSDT savings-vault proxy — fund-bearing code on a rated product. Mirrors spUSDC. 1 on-chain.
RoleGranted (spUSDT Vault)RoleChangeCRITICAL (DEFAULT_ADMIN) / WARNING (SETTER, TAKER)Grants a vault role. DEFAULT_ADMIN controls the rated vault → CRITICAL; SETTER/TAKER → WARNING. Mirrors spUSDC. 5 on-chain.
RoleRevoked (spUSDT Vault)RoleChangeERROR (DEFAULT_ADMIN) / WARNING (others)Removes a vault role. Admin-key loss → ERROR; others → WARNING. Mirrors spUSDC. 2 on-chain.
RoleAdminChanged (spUSDT Vault)RoleChangeCRITICALChanges which role administers another vault role — restructures the permission tree. Mirrors spUSDC. 0 on-chain (trip-wire).
DepositCapSet (spUSDT)ProtocolParameterChangeINFO (WARNING if cap →0)Sets the vault's max total deposits (0 = disabled). Routine raises INFO; reduction to 0 (wind-down) warns. 5 on-chain (all increases).
VsrSet (spUSDT)ProtocolParameterChangeINFOSets the Vault Savings Rate. Bounded on-chain + economic-only → dashboard regardless. Fired 816× (automated) — confirms INFO. Range ~2.4–4.9% APY.
VsrBoundsSet (spUSDT)ProtocolParameterChangeINFO (WARNING if max bound raised)Sets the VSR guard-rail bounds. Widening the max bound warns; tightening INFO. 1 on-chain (setup).
Upgraded (spUSDT Vault impl, UUPS)ContractUpgradeERRORUUPS self-upgrade of the spUSDT vault implementation — fund-bearing. Mirrors spUSDC. 1 on-chain.
RoleGranted (ALMProxy)RoleChangeCRITICAL (DEFAULT_ADMIN) / WARNING (CONTROLLER, FREEZER) / INFO (RELAYER)Grants a role on the ALM (Spark Liquidity Layer) proxy that routes protocol liquidity. DEFAULT_ADMIN controls the router → CRITICAL; CONTROLLER routes liquidity but is rotated routinely (11× on-chain) → WARNING (not a page); FREEZER → WARNING; RELAYER (operational executor) → INFO. Not a rated product. 12 on-chain (DEFAULT_ADMIN ×1, CONTROLLER ×11).
RoleRevoked (ALMProxy)RoleChangeERROR (DEFAULT_ADMIN) / WARNING (others)Removes an ALM role. Admin-key loss → ERROR; others → WARNING. 10 on-chain.
RoleAdminChanged (ALMProxy)RoleChangeCRITICALChanges which role administers another ALM role — restructures the permission tree (consistent with all RoleAdminChanged). 0 on-chain (trip-wire).
AssetSourceUpdated (rated asset)ContractUpgradeERRORReplaces the price-feed source (e.g. Chainlink aggregator) for a rated asset (WETH/wstETH). A manipulation vector — a malicious feed can misprice the asset and trigger bad liquidations. A tier below the whole-oracle swap (CRITICAL). 7 on-chain on rated assets (legitimate feed migrations).
AssetSourceUpdated (non-rated asset)ContractUpgradeINFOPrice-feed source change on a non-rated reserve — dashboard-only. 33 total on-chain.
BaseCurrencySet (Oracle)ProtocolParameterChangeWARNINGSets the oracle's base/quote currency and its unit (e.g. USD, 8-decimal) — the denomination all prices are reported in. One-time foundational config. 1 on-chain (deploy).
FallbackOracleUpdated (Oracle)ContractUpgradeWARNINGSets/replaces the fallback oracle, queried only when a primary feed returns no/zero price — dormant while feeds are healthy. A tier below the live-path oracle events (it activates only during a primary-feed outage). 1 on-chain (deploy).
AdminChanged (Treasury)AdminChangeCRITICALChanges the proxy admin of the Treasury — the account allowed to upgrade its implementation. A malicious upgrade could drain protocol reserves, so it pages at top tier (consistent with how every upgrade-to-drain proxy-admin key is treated). 1 on-chain (early governance handoff).
Upgraded (Treasury)ContractUpgradeERRORERC1967 implementation swap on the Treasury proxy (the act event 56's admin can perform). Kept at ERROR for consistency with all other proxy Upgraded events — CRITICAL is reserved for the control/key moves (the AdminChanged that grants upgrade rights). 0 on-chain (never upgraded).
AddedOwner (Safe)MultisigChangeERRORA signer is added to a Spark admin Safe (ALMFreezer / Foundation / SparkLendFreezer) — changes the multisig's trust set. Pages to confirm against governance. Matches HyperLend/Moonwell. 10 on-chain across safes.
RemovedOwner (Safe)MultisigChangeERRORA signer is removed from a Spark admin Safe. Matches HyperLend/Moonwell. 6 on-chain.
ChangedThreshold (Safe)MultisigChangeCRITICALChanges M in the M-of-N requirement. Lowering it can hand fewer parties unilateral control. Matches HyperLend/Moonwell. 4 on-chain.
EnabledModule (Safe)MultisigChangeCRITICALEnables a module that executes through the Safe bypassing owner signatures entirely — the most dangerous Safe change. Matches HyperLend/Moonwell. 0 on-chain (trip-wire).
DisabledModule (Safe)MultisigChangeERRORDisables a previously-enabled module. Execution-surface change. Matches HyperLend/Moonwell. 0 on-chain.
ChangedGuard (Safe)MultisigChangeERRORSets/removes the transaction guard that gates every Safe txn (a malicious guard can freeze the Safe). Matches HyperLend/Moonwell. 0 on-chain.
ChangedFallbackHandler (Safe)MultisigChangeERRORSets the fallback handler (callable surface, e.g. EIP-1271 signature validation). Matches HyperLend/Moonwell. 0 on-chain.
Upgraded (spWETH aToken proxy)ContractUpgradeERRORERC1967 implementation swap on the spWETH aToken proxy — the SparkLend WETH-market deposit receipt (rated product spweth). Fund-bearing code. 0 on-chain.
Initialized (spWETH aToken impl)ContractUpgradeINFOOne-time aToken initializer (sets underlying, pool, treasury, incentives controller, decimals, name/symbol). Setup metadata, not a risk event.

Stader (stader)

  • Chain(s): Ethereum
  • Products: ethx (ProxyAdmin, Timelock, and Safe multisig events are protocol-wide)
  • Contracts monitored:
    • ETHx Token — 0xa35b1b31ce002fbf2058d22f30f95d405200a15b
    • StakingPoolManager — 0xcf5ea1b38380f6af39068375516daf40ed70d299
    • UserWithdrawalManager — 0x9f0491b32dbce587c50c4c43ab303b06478193a7
    • Stader Oracle — 0xf64bae65f6f2a5277571143a24faafdfc0c2a737
    • StaderConfig — 0x4abef2263d5a5ed582fc9a9789a41d85b68d69db
    • PermissionlessPool — 0xd1a72bd052e0d65b7c26d3dd97a98b74acbbb6c5
    • PermissionedPool — 0x09134c643a6b95d342bdaf081fa473338f066572
    • SDCollateral — 0x7af4730cc8ebad1a050dcad5c03c33d2793ee91f
    • CommunityMultisig (6-of-9) — 0x45b977cecb9dfaa17dfcba88826ef684b8489ff6
    • ManagerMultisig (3-of-5) — 0xaafb31780e4b9c95bc920e388f4925a874cd07af
    • ProxyAdmin — 0x67b12264ca3e0037fc7e22f2457b42643a04c86e
    • Timelock (7-day) — 0x1112d5c55670cb5144bf36114c20a122908068b9
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (each of 8 proxies)ContractUpgradeERRORProxy implementation upgraded
AdminChanged (each of 8 proxies)AdminChangeERRORProxy admin changed
OwnershipTransferred (ProxyAdmin)AdminChangeERRORProxyAdmin ownership transferred (controls upgrade authority for all proxies)
MinDelayChange (Timelock, decreased)TimelockChangeERRORTimelock min delay decreased
MinDelayChange (Timelock, increased)TimelockChangeWARNINGTimelock min delay increased
CallScheduled (Timelock)TimelockChangeWARNINGTimelock call scheduled
CallExecuted (Timelock)TimelockChangeINFOTimelock call executed
Cancelled (Timelock)TimelockChangeINFOTimelock call cancelled
RoleGranted (Timelock)RoleChangeWARNINGTimelock role granted
RoleRevoked (Timelock)RoleChangeWARNINGTimelock role revoked
RoleAdminChanged (Timelock)RoleChangeERRORTimelock role admin changed
AddedOwner (Safe)MultisigChangeWARNINGMultisig owner added
RemovedOwner (Safe)MultisigChangeWARNINGMultisig owner removed
ChangedThreshold (Safe)MultisigChangeWARNINGMultisig threshold changed
EnabledModule (Safe)MultisigChangeWARNINGMultisig module enabled
DisabledModule (Safe)MultisigChangeWARNINGMultisig module disabled
ChangedGuard (Safe)MultisigChangeWARNINGMultisig guard changed
ChangedFallbackHandler (Safe)MultisigChangeWARNINGMultisig fallback handler changed
RoleGranted (StaderConfig)RoleChangeWARNINGStaderConfig role granted
RoleRevoked (StaderConfig)RoleChangeWARNINGStaderConfig role revoked
RoleAdminChanged (StaderConfig)RoleChangeERRORStaderConfig role admin changed
SetAccountAdminChangeWARNINGStaderConfig account address rotated
SetContractContractUpgradeERRORStaderConfig contract address rotated (upgrade-by-pointer)
SetTokenContractUpgradeERRORStaderConfig token address rotated
SetConstantProtocolParameterChangeWARNINGStaderConfig constant updated
SetVariableProtocolParameterChangeWARNINGStaderConfig variable updated
RoleGranted (ETHx)RoleChangeWARNINGETHx role granted
RoleRevoked (ETHx)RoleChangeWARNINGETHx role revoked
RoleAdminChanged (ETHx)RoleChangeERRORETHx role admin changed
Paused (ETHx)EmergencyActionCRITICALETHx token paused (mints/burns/transfers halted)
Unpaused (ETHx)EmergencyActionWARNINGETHx token unpaused
RoleGranted (StakingPoolManager)RoleChangeWARNINGStakingPoolManager role granted
RoleRevoked (StakingPoolManager)RoleChangeWARNINGStakingPoolManager role revoked
RoleAdminChanged (StakingPoolManager)RoleChangeERRORStakingPoolManager role admin changed
Paused (StakingPoolManager)EmergencyActionCRITICALStakingPoolManager paused (deposits halted)
Unpaused (StakingPoolManager)EmergencyActionWARNINGStakingPoolManager unpaused
UpdatedExcessETHDepositCoolDownProtocolParameterChangeINFOStakingPoolManager excess ETH deposit cooldown updated
UpdatedStaderConfig (StakingPoolManager)ContractUpgradeERRORStakingPoolManager StaderConfig pointer rotated
RoleGranted (UserWithdrawalManager)RoleChangeWARNINGUserWithdrawalManager role granted
RoleRevoked (UserWithdrawalManager)RoleChangeWARNINGUserWithdrawalManager role revoked
RoleAdminChanged (UserWithdrawalManager)RoleChangeERRORUserWithdrawalManager role admin changed
Paused (UserWithdrawalManager)EmergencyActionCRITICALUserWithdrawalManager paused (withdrawal requests halted)
Unpaused (UserWithdrawalManager)EmergencyActionWARNINGUserWithdrawalManager unpaused
UpdatedFinalizationBatchLimitProtocolParameterChangeINFOWithdrawal finalization batch limit updated
UpdatedStaderConfig (UserWithdrawalManager)ContractUpgradeERRORUserWithdrawalManager StaderConfig pointer rotated
TrustedNodeAddedMultisigChangeWARNINGOracle TrustedNode added (Oracle multisig membership change)
TrustedNodeRemovedMultisigChangeWARNINGOracle TrustedNode removed (Oracle multisig membership change)
TrustedNodeChangeCoolingPeriodUpdatedProtocolParameterChangeINFOOracle TrustedNode change cooling period updated
SafeModeEnabledEmergencyActionCRITICALOracle Safe Mode enabled (withdrawals disabled)
SafeModeDisabledEmergencyActionWARNINGOracle Safe Mode disabled
Paused (Oracle)EmergencyActionCRITICALOracle paused
Unpaused (Oracle)EmergencyActionWARNINGOracle unpaused
UpdatedERChangeLimitProtocolParameterChangeWARNINGOracle exchange-rate change limit updated
UpdateFrequencyUpdatedProtocolParameterChangeINFOOracle update frequency changed
ERDataSourceToggledProtocolParameterChangeWARNINGOracle exchange-rate data source toggled (PoR-based)
ERInspectionModeActivatedEmergencyActionWARNINGOracle ER inspection mode activated
RoleGranted (Oracle)RoleChangeWARNINGOracle role granted
RoleRevoked (Oracle)RoleChangeWARNINGOracle role revoked
RoleAdminChanged (Oracle)RoleChangeERROROracle role admin changed
UpdatedStaderConfig (Oracle)ContractUpgradeERROROracle StaderConfig pointer rotated
RoleGranted (PermissionlessPool)RoleChangeWARNINGPermissionlessPool role granted
RoleRevoked (PermissionlessPool)RoleChangeWARNINGPermissionlessPool role revoked
RoleAdminChanged (PermissionlessPool)RoleChangeERRORPermissionlessPool role admin changed
UpdatedCommissionFees (PermissionlessPool)ProtocolParameterChangeWARNINGPermissionless pool commission fees updated
UpdatedStaderConfig (PermissionlessPool)ContractUpgradeERRORPermissionlessPool StaderConfig pointer rotated
RoleGranted (PermissionedPool)RoleChangeWARNINGPermissionedPool role granted
RoleRevoked (PermissionedPool)RoleChangeWARNINGPermissionedPool role revoked
RoleAdminChanged (PermissionedPool)RoleChangeERRORPermissionedPool role admin changed
UpdatedCommissionFees (PermissionedPool)ProtocolParameterChangeWARNINGPermissioned pool commission fees updated
UpdatedStaderConfig (PermissionedPool)ContractUpgradeERRORPermissionedPool StaderConfig pointer rotated
RoleGranted (SDCollateral)RoleChangeWARNINGSDCollateral role granted
RoleRevoked (SDCollateral)RoleChangeWARNINGSDCollateral role revoked
RoleAdminChanged (SDCollateral)RoleChangeERRORSDCollateral role admin changed
UpdatedPoolThresholdProtocolParameterChangeWARNINGSDCollateral pool threshold updated
SDSlashedEmergencyActionWARNINGSD operator collateral slashed
UpdatedStaderConfig (SDCollateral)ContractUpgradeERRORSDCollateral StaderConfig pointer rotated

StakeWise (stakewise)

  • Chain(s): Ethereum
  • Products: oseth, plus protocol-wide for Keeper/VaultsRegistry/Multisig governance contracts
  • Contracts monitored:
    • OsToken (osETH) — 0xf1C9acDc66974dFB6dEcB12aA385b9cD01190E38
    • OsTokenVaultController — 0x2A261e60FB14586B474C208b1B7AC6D0f5000306
    • Keeper — 0x6B5815467da09DaA7DC83Db21c9239d98Bb487b5
    • VaultsRegistry — 0x3a0008a588772446f6e656133C2D5029CC4FC20E
    • OsTokenConfig — 0x287d1e2A8dE183A8bf8f2b09Fa1340fBd766eb59
    • OsTokenVaultEscrow — 0x09e84205DF7c68907e619D07aFD90143c5763605
    • OsTokenRedeemer — 0xdF3123dD182b8d3e0266a2DC37eEb8366d149B5A
    • StakeWise Multisig (4-of-7) — 0x144a98cb1cdbb23610501fe6108858d9b7d24934
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
OwnershipTransferred (OsToken)AdminChangeERRORosETH ownership transferred
OwnershipTransferStarted (OsToken)AdminChangeWARNINGosETH ownership transfer started
ControllerUpdated (OsToken)RoleChangeWARNINGosETH controller enabled/disabled (mint/burn authority)
OwnershipTransferred (OsTokenVaultController)AdminChangeERROROsTokenVaultController ownership transferred
OwnershipTransferStarted (OsTokenVaultController)AdminChangeWARNINGOsTokenVaultController ownership transfer started
FeePercentUpdated (OsTokenVaultController)ProtocolParameterChangeWARNINGosETH fee percent updated
CapacityUpdated (OsTokenVaultController)ProtocolParameterChangeWARNINGosETH minting capacity updated
TreasuryUpdated (OsTokenVaultController)ProtocolParameterChangeWARNINGosETH treasury address updated
KeeperUpdated (OsTokenVaultController)ContractUpgradeERRORKeeper address updated (critical infrastructure)
OwnershipTransferred (Keeper)AdminChangeERRORKeeper ownership transferred
OwnershipTransferStarted (Keeper)AdminChangeWARNINGKeeper ownership transfer started
OracleAdded (Keeper)RoleChangeWARNINGKeeper oracle added
OracleRemoved (Keeper)RoleChangeWARNINGKeeper oracle removed
RewardsMinOraclesUpdated (Keeper)ProtocolParameterChangeWARNINGRewards min oracles updated
ValidatorsMinOraclesUpdated (Keeper)ProtocolParameterChangeWARNINGValidators min oracles updated
ConfigUpdated (Keeper)ProtocolParameterChangeINFOKeeper config updated (IPFS hash)
OwnershipTransferred (VaultsRegistry)AdminChangeERRORVaultsRegistry ownership transferred
OwnershipTransferStarted (VaultsRegistry)AdminChangeWARNINGVaultsRegistry ownership transfer started
VaultImplAdded (VaultsRegistry)ContractUpgradeWARNINGVault implementation added
VaultImplRemoved (VaultsRegistry)ContractUpgradeWARNINGVault implementation removed
FactoryAdded (VaultsRegistry)ContractUpgradeWARNINGVault factory added
FactoryRemoved (VaultsRegistry)ContractUpgradeWARNINGVault factory removed
VaultAdded (VaultsRegistry)ContractUpgradeINFONew vault registered
OwnershipTransferred (OsTokenConfig)AdminChangeERROROsTokenConfig ownership transferred
OwnershipTransferStarted (OsTokenConfig)AdminChangeWARNINGOsTokenConfig ownership transfer started
OsTokenConfigUpdated (OsTokenConfig)ProtocolParameterChangeWARNINGLTV/liquidation threshold/bonus parameters updated
RedeemerUpdated (OsTokenConfig)RoleChangeWARNINGRedeemer updated
OwnershipTransferred (OsTokenVaultEscrow)AdminChangeERROROsTokenVaultEscrow ownership transferred
OwnershipTransferStarted (OsTokenVaultEscrow)AdminChangeWARNINGOsTokenVaultEscrow ownership transfer started
AuthenticatorUpdated (OsTokenVaultEscrow)RoleChangeWARNINGEscrow authenticator updated
LiqConfigUpdated (OsTokenVaultEscrow)ProtocolParameterChangeWARNINGEscrow liquidation config updated
OwnershipTransferred (OsTokenRedeemer)AdminChangeERROROsTokenRedeemer ownership transferred
OwnershipTransferStarted (OsTokenRedeemer)AdminChangeWARNINGOsTokenRedeemer ownership transfer started
PositionsManagerUpdated (OsTokenRedeemer)RoleChangeWARNINGPositions manager updated
AddedOwner (Multisig)MultisigChangeWARNINGMultisig owner added
RemovedOwner (Multisig)MultisigChangeWARNINGMultisig owner removed
ChangedThreshold (Multisig)MultisigChangeWARNINGMultisig threshold changed
EnabledModule (Multisig)MultisigChangeWARNINGMultisig module enabled
DisabledModule (Multisig)MultisigChangeWARNINGMultisig module disabled
ChangedGuard (Multisig)MultisigChangeWARNINGMultisig guard changed
ChangedFallbackHandler (Multisig)MultisigChangeWARNINGMultisig fallback handler changed

USD.ai (usdai)

  • Chain(s): Arbitrum One
  • Products: susdai, usdai. sUSDai is the yield-bearing ERC-7540 vault and carries the credit exposure — it is the senior-tranche lender on the loan book. Governance, oracle, timelock, ProxyAdmin, Safe and bridge events are protocol-wide and apply to both products
  • Contracts monitored: 28. The V2 lending stack replaced V1 on 2026-06-26; both generations are monitored, V1 so its remaining positions and history stay visible
    • Products — sUSDai Vault 0x0b2b2b2076d95dda7817e785989fe353fe955ef9, USDai Token 0x0a1a1a107e45b7ced86833863f482bc5f4ed82ef
    • Lending stack (V2, live) — LoanRouter V2 0x1c2ed170de32846316784c4fd58a5e3c7563e12f, DepositTimelock V2 0x1d710cc0c435ba6e27abc82a51dfbca17c41fe3c, EscrowTimelock V2 0x1e710cc0b64e1d7572d35e43ad261587789b6438
    • Lending stack (V1, superseded) — LoanRouter V1 0x0c2ed170f2bb1df1a44292ad621b577b3c9597d1, DepositTimelock V1 0x0d710cc05f34d2ead9fba3c78d53d76a0623c9f8
    • Yield — BaseYieldEscrow 0x9ddfd49ac4689cf894203794d792dcb38e4b1a9e
    • Pricing — Price Oracle 0xd40a5298c6fced81eb5da8bb1f9328b16f741ebc
    • Governance — Chip Governor 0x0ddc1dd03c58e425f96567679b52f349db847b26, CHIP Token 0x0c1c1c109fe34733fca54b82d7b46b75cfb71f6e, Governance Timelock 0x0eec1ee03add82342a6ac68a9c5cf62cb2398221, Upgrade Timelock 0x0eea1ee08611ff4a4e83bfe3916712751995639b
    • Cross-chain — BridgeAdapter (LayerZero OFT) 0xffb20098fd7b8e84762eea4609f299d101427f24 (immutable, not a proxy)
    • Nine ProxyAdmins — sUSDai 0x0b3296b6f50611b28d466a6d5a49754dad4d8d9f, USDai 0x2ddf39c731377adcfa7f2a056ac60a8a81aadc3c, CHIP 0xaa93f045b057ac64f79ae3f7d115cd3880e854d9, LoanRouter V1 0xf53ae82727d40fefbf6088212e1fd7354a63b212, LoanRouter V2 0x506e15026a449103ca35616712c3434b2834ce35, DepositTimelock V1 0x86d266c383437e496c2972a02e379d7457688f15, DepositTimelock V2 0xfb7f94c6c3a3513d4da19a35d4711500bea19cbd, EscrowTimelock V2 0x8701a738af540d6115ea7262098c66fb8ce8f54f, BaseYieldEscrow 0xbbc62c75b72b233aa8d878adc4530bc495d055a3. The owner of each decides whether an upgrade is delayed at all — three (sUSDai, USDai, CHIP) are owned by the Upgrade Timelock; the six on the lending stack are owned directly by a 3-of-3 Safe with no delay
    • Five Safes — STRATEGY_ADMIN (3-of-4) 0xe7e53f940f8242fec57cbe88054463d4944b3670, DEFAULT_ADMIN (3-of-3) 0x5f0bc72fb5952b2f3f2e11404398ed507b25841f, upgrade-executor (3-of-3) 0x783b08aa21de056717173f72e04be0e91328a07b, PAUSE_ADMIN (2-of-3) 0x3a32e198cafeb0fcd061ac0c9d8a2256bccab872, ORIGINATOR (3-of-4) 0x844bb7b6223f6af028189bb34d6341a5733d6286
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (any of the nine proxies)ContractUpgradeERRORThe implementation behind a proxy is replaced while funds and storage stay in the unchanged proxy. Every upgrade pages so it can be matched to a known change. The alert also reports the previous implementation and the upgrade path — both read from chain state at the block of the upgrade itself, not at alert time, because six of the nine ProxyAdmins are owned directly by a Safe with no delay, and ownership has moved twice. A backfilled 2025 upgrade must not be described using today's ownership.
Initialized (version 1)ContractUpgradeINFOAn upgradeable contract cannot use a constructor, so OpenZeppelin replaces it with a one-shot initialize(). Version 1 is that first call, emitted inside the contract's own deployment transaction, when there is no prior state, no users and no funds. It means "this contract now exists" and is recorded for completeness only.
Initialized (version > 1)ContractUpgradeERRORA reinitializer — an upgrade shipped code that rewrote live storage on a contract that already holds state and user funds. Unlike an implementation swap this is not undoable by a further upgrade, because rolling back the code does not roll back the storage. Three have occurred; one of them ran with no accompanying Upgraded in the same transaction, i.e. live storage mutated outside an upgrade window, which is exactly why this is separated from the genesis case rather than blended with it.
AdminChanged (any proxy)AdminChangeERRORThe ProxyAdmin registered against a proxy is replaced — a change to who may upgrade this contract at all. A root-of-trust change, so it always pages.
OwnershipTransferred (any of the nine ProxyAdmins)AdminChangeCRITICALOwnership of a ProxyAdmin moves. Its owner is the single key that can replace the implementation of the contract behind it — for the sUSDai and USDai ProxyAdmins that means the code custodying every depositor's funds. Legitimate transfers happen only during a governance migration, so any other occurrence is a top-urgency, funds-at-risk event.
OwnershipTransferred (BridgeAdapter)AdminChangeCRITICALOwnership of the LayerZero OFT adapter moves. The owner sets which remote chains and addresses are trusted peers, so control of it is control of cross-chain USDai minting. The adapter is immutable — it has no ProxyAdmin — making ownership its only lever, and therefore total.
RoleGranted / RoleRevoked (DEFAULT_ADMIN_ROLE or BLACKLIST_ADMIN_ROLE)RoleChangeERRORThe two sweeping roles. DEFAULT_ADMIN_ROLE is the root key that administers every other role on that contract. BLACKLIST_ADMIN_ROLE gates setBlacklist on the USDai token and has never been held by anyone — so a grant is the only advance warning that USDai has gained a working censorship power. Escalation keys off the role, never off which contract emitted it.
RoleGranted / RoleRevoked (any other role)RoleChangeWARNINGA bounded operational role changes hands — strategy administration, pausing, liquidation, origination, deposit or escrow administration, or a timelock proposer/executor/canceller. Expected governance activity, recorded for visibility without paging. Seventeen role names are decoded; two hashes on this stack have never resolved to a preimage and are reported as raw bytes32 rather than labelled speculatively.
RoleAdminChanged (any AccessControl contract)RoleChangeERRORThe rule for who may grant or revoke a role is rewired — a structural change to the access-control graph rather than to who holds a role. A privilege-escalation vector and not part of normal operations, so it always pages.
Paused (sUSDai, USDai, either LoanRouter)EmergencyActionCRITICALAn emergency halt. On the vault it stops deposits and redemption-queue processing, so holders cannot exit; on the token it stops transfers; on a router it stops new origination. Whether protective incident response or hostile, it pages immediately.
Unpaused (sUSDai, USDai, either LoanRouter)EmergencyActionCRITICALThe protocol is taken out of pause. Held at the same tier as the pause deliberately: on this stack an unpause is the moment user funds become movable again, and confirming who performed it matters as much as the halt itself.
BlacklistUpdated (USDai)EmergencyActionERRORAn address is frozen or unfrozen on the USDai token. A notBlacklisted modifier reverts for frozen addresses and sUSDai gates withdraw, redeem and setOperator on it too, so a frozen holder cannot exit. Flat rather than conditional because the payload is an address and a boolean — the significance of the target is not knowable from it. Structurally incomplete as a signal: isBlacklisted() also falls through to native USDC's isBlacklisted() and USD₮0's isBlocked(), so USDai inherits Circle's and Tether's lists and those changes emit nothing here. sUSDai itself is hardcoded exempt and can never be frozen.
HookFailed (either LoanRouter)EmergencyActionCRITICALThe router called sUSDai's loan-accounting hook, the call reverted, and the router swallowed the error and continued. Cash moved while the vault's view of its own loan state may not have updated — a silent accounting divergence between the two contracts that no other event reports.
TransferFailed (either LoanRouter)EmergencyActionCRITICALA transfer to its intended recipient failed and the funds were sent somewhere else instead. Money reaching an address other than the one the protocol selected is a direct funds-at-risk condition.
ERC20Rescued (LoanRouter V2)EmergencyActionERRORAn admin sweeps an arbitrary ERC-20 balance out of the router to a chosen address. Intended for tokens sent by mistake, but it is a discretionary withdrawal path from a contract that handles loan cash, so every use pages for confirmation that it moved only stranded tokens.
LoanLiquidated (either LoanRouter)EmergencyActionCRITICALCollateral has been seized and the outcome is not yet known — the time-sensitive moment in a default. The recovery figures arrive later in separate events.
LoanBreached (LoanRouter V2)EmergencyActionERRORA loan is declared in breach of its terms by a LIQUIDATOR_ROLE holder — the step before liquidation. An early warning on the vault's credit exposure.
LoanCollateralLiquidated (V1) / LiquidationProceedsDeposited (V2)EmergencyActionERRORProceeds from liquidated collateral arrive, reporting the gross recovery, the liquidation fee and any surplus. Deliberately one tier below LoanLiquidated, which already paged on the same default — paging twice on one event was rejected. The payload carries what was recovered but not what was owed, so a shortfall cannot be computed on chain and no conditional is possible.
LenderLiquidationRepaid (either LoanRouter)EmergencyActionERRORWhat one tranche actually got back after a liquidation. Since sUSDai is the senior-tranche lender, this is the vault's realised recovery. Flat for the same reason: the amount owed is absent from the payload.
LoanMigratedOut (V1) / LoanMigrated (V2)ProtocolParameterChangeERRORA loan moves between router generations — the most directly readable signal that the lending stack itself has changed. The router address is an immutable constructor parameter, so a router swap otherwise surfaces only as an ordinary Upgraded on sUSDai and cannot be identified without decoding constructor arguments off chain. This event says it outright. All 17 occurrences fell inside one week during the June 2026 V1→V2 migration.
LoanOriginated (either LoanRouter)ProtocolParameterChangeINFOA new loan is written. The alert decodes the borrower, the currency, the collateral count and each tranche's principal and annualised rate, and reports the vault's own exposure aggregated across whichever tranches it holds. Routine business activity, so it is tracked rather than paged.
LoanRepaid (either LoanRouter, loan closure only)ProtocolParameterChangeINFOA loan is fully repaid and closed. The handler fires only on closure, not on each instalment — instalments are roughly 36× more frequent and carry no distinct risk signal.
LoanRefinanced (LoanRouter V2, both signatures)ProtocolParameterChangeWARNINGExisting loan terms are replaced — rate, duration, tranches or collateral can all change, and cash may move in either direction. It rewrites an existing credit position rather than creating a new one, so it is surfaced for review without paging. Two signatures are monitored because a July 2026 upgrade changed the event's shape.
LenderPositionMinted / LenderPositionsBurned (either LoanRouter)ProtocolParameterChangeINFOThe ERC-721 position tokens representing a lender's claim on a tranche are issued or retired. Bookkeeping that accompanies origination and closure, both of which carry their own entries.
FeePaid (LoanRouter V2)ProtocolParameterChangeINFOA fee is actually paid, naming which kind (origination, repayment, exit, liquidation or refinance) and the recipient. A record of money moving under existing rules rather than a change to them, so it is tracked rather than paged.
LiquidationFeeRateSet (LoanRouter V1)ProtocolParameterChangeWARNINGThe liquidation fee rate changes — the share of liquidation proceeds the protocol keeps before the remainder reaches lenders. Unlike the fee payment above this is a rule change, and it affects what the vault recovers on every future default, so it is surfaced for review. It does not page: the rate is bounded and cannot reach funds directly.
FeeRecipientSet (LoanRouter V1)ProtocolParameterChangeERRORThe address that receives protocol fees is changed. Fee redirection is a value-diversion lever, and V2 has no equivalent setter event at all, so this is the only place a recipient change is observable on either router.
BaseYieldRateTiersSet (USDai)ProtocolParameterChangeERRORThis event sets what USDai holders earn. Accrual is principal × rate × elapsed time and the rate is an administratively chosen number, not a pass-through of the backing assets' actual performance — the spread between them is protocol margin or subsidy. The alert renders each tier's annualised rate rather than just counting tiers, because the base yield has already been cut from 4.5% to 2.0% and restored roughly a day later, and a tier count alone cannot distinguish that from a no-op reordering. It has fired three times in six months, so it cannot spam.
Withdrawn (BaseYieldEscrow)ProtocolParameterChangeERRORFunds leave the reservoir that pays holder yield — the adverse direction, and it has never happened. Worth understanding alongside how the reservoir is filled: setRateTiers sets accrual independently of funding, so if top-ups stop or fall short the accrual keeps running and the escrow drains.
Deposited / Harvested (BaseYieldEscrow)ProtocolParameterChangeINFOThe reservoir is topped up by the STRATEGY_ADMIN Safe, or drawn down by the USDai token to pay accrued yield. Notable as a structural fact rather than a per-event risk: deposits are round numbers chosen by hand while harvests are exact and rate-driven, i.e. the base yield is manually funded, and two independent quantities are kept in line by discretionary transfers.
BaseYieldDeposited / BaseYieldHarvested / AdminFeeWithdrawn (sUSDai)ProtocolParameterChangeINFOYield credited to the vault, drawn from it, or the admin fee taken from it. The alert reports the admin fee as a share of the gross amount. Base yield arrives in discrete lumps rather than continuously, so the vault's exchange rate steps up in jumps at these moments.
Harvested / BaseTokenConverted (USDai)ProtocolParameterChangeINFOYield pulled into the token to accrue to holders, or a backing asset converted between forms. Routine operational activity.
SupplyCapSet (USDai)ProtocolParameterChangeWARNINGThe ceiling on total USDai supply changes. It limits new minting only and never affects existing holders, so it is surfaced without paging.
TokenPriceFeedAdded / TokenPriceFeedRemoved (Price Oracle)ProtocolParameterChangeERRORThe feed mapping that converts a deposit into a mint amount is edited. Whoever controls it controls the mint rate — repoint USDC's feed at $2 and every depositor mints double. A single call takes arrays and can rewrite several feeds at once. Also worth knowing what this oracle does not cover: price(wM) reverts and wM is unsupported, despite wM being roughly 73% of USDai's deposits — so the dominant backing asset is not priced by this contract at all.
CallScheduled (either Timelock)TimelockChangeERRORA privileged call is queued behind a delay. This is the only pre-warning in the system — it arrives while there is still time to inspect the call and act before it executes.
CallExecuted (either Timelock)TimelockChangeERRORA queued call runs. It pages independently of the target's own events because a timelock can act on contracts whose events are not monitored, making this the backstop for anything the per-contract handlers would miss.
Cancelled (either Timelock)TimelockChangeWARNINGA queued operation is withdrawn before execution — a veto. Recorded for the audit trail; the interesting case is a cancellation that reveals an abandoned plan, which the scheduled call already reported.
MinDelayChange (either Timelock, delay decreased)TimelockChangeERRORThe enforced waiting period is shortened, directly weakening the guarantee that a change can be reviewed before it takes effect. The conditional is exact — both the old and new durations are in the payload.
MinDelayChange (either Timelock, delay increased)TimelockChangeWARNINGThe waiting period is lengthened, strengthening the guarantee. Recorded without paging. Note the Upgrade Timelock's delay has already moved twice (from none, to 24 hours, to 48 hours), which is why no alert on this protocol states a delay as a fixed value — the delay in force is read from chain at the block of each event.
TimelockChange (Chip Governor)TimelockChangeERRORThe governor is repointed at a different timelock. This bypasses the delay itself rather than transferring a role, so it pages.
ProposalGuardianSet (Chip Governor)AdminChangeERRORSets the account that can cancel proposals outside the normal rules. It is currently unset, so a first assignment creates a veto power that did not previously exist.
ProposalQueued / ProposalExecuted (Chip Governor)ProtocolParameterChangeERRORA governance proposal reaches the timelock, or executes. The Chip Governor has never been used — zero proposals, zero votes, and every one of its six on-chain events to date is configuration from a single block. A first proposal is therefore a genuinely novel event on this protocol.
ProposalCreated (Chip Governor)ProtocolParameterChangeWARNINGA proposal is filed. Surfaced early so the queued and executed stages are not the first anyone hears of it.
VotingDelaySet / VotingPeriodSet / ProposalThresholdSet / QuorumNumeratorUpdatedProtocolParameterChangeWARNINGThe rules of governance itself — how long before voting opens, how long it runs, how much voting power is needed to propose, and what quorum applies. Bounded parameters, but they determine who can pass a proposal, so each is surfaced.
LateQuorumVoteExtensionSet / ProposalCanceled / ProposalExtendedProtocolParameterChangeINFOLower-impact governance mechanics: the late-quorum extension window, a withdrawn proposal, and a vote extended because quorum arrived late. Recorded for completeness.
DelegateVotesChanged (CHIP, crossing the proposal threshold)ProtocolParameterChangeWARNINGA delegate's voting power crosses the threshold needed to file a proposal, in either direction. Deliberately edge-triggered on the crossing rather than level-triggered on the value: the event re-fires on every transfer in or out of a delegating holder, so a level test would re-alert indefinitely once any delegate sat above the line. This is the tripwire for governance becoming usable at all — total delegated voting power is currently a tiny fraction of the threshold.
DelegateChanged (CHIP)ProtocolParameterChangeINFOA holder points their voting power at a different delegate. Ordinary token activity; the threshold crossing above is the signal that matters.
ChangedThreshold (any Safe)MultisigChangeCRITICALThe number of signatures a Safe requires changes. Lowering it directly weakens every privilege that Safe holds — and these Safes hold root administration, pausing, origination and direct ownership of six ProxyAdmins.
EnabledModule (any Safe)MultisigChangeCRITICALA module is enabled on a Safe. A module can execute transactions on the Safe's behalf without collecting any signatures, so enabling one creates a parallel authority path that bypasses the threshold entirely.
ChangedMasterCopy (any Safe)MultisigChangeCRITICALThe Safe's own implementation is swapped — the multisig equivalent of a proxy upgrade, replacing the code that enforces signature checking. Emitted by Safe 1.1.1 and seen once per Safe at creation.
AddedOwner / RemovedOwner / DisabledModule / ChangedGuard / ChangedFallbackHandlerMultisigChangeERRORSigner membership changes, or a module, guard or fallback handler is altered. Each changes who or what can act through the Safe, or removes a check on it, so each pages one tier below the threshold and module-enable cases.
ExecutionFromModuleSuccess / ExecutionFromModuleFailure (any Safe)MultisigChangeERRORA transaction is executed through the module path rather than by collecting signatures. Zodiac Delay modules are enabled on three of the five Safes, but not one transaction has ever been routed through a module and every module's queue is empty — so a first occurrence means a dormant bypass has been activated.
ExecutionFailure (any Safe)MultisigChangeWARNINGA Safe transaction was authorised by its signers but reverted on execution. Usually operational, but a failed privileged action is worth seeing.
SafeSetup (any Safe)MultisigChangeINFOA Safe's creation, carrying its initial owner set and threshold. This is the only place a Safe's starting threshold is emitted — ChangedThreshold never fires for it — which is why one Safe's 2-of-3 configuration was previously invisible to monitoring.
SwapAdapterAdded / SwapAdapterRemoved (DepositTimelock V1)ProtocolParameterChangeWARNINGThe set of whitelisted swap adapters changes. An adapter sits in the path deposits take, so which contracts are trusted there is a meaningful configuration change.
PeerSet (BridgeAdapter)ProtocolParameterChangeERRORSets which remote chain and address are trusted as the counterpart for cross-chain USDai. A wrong or hostile peer is a direct path to unbacked minting, so every change pages.
RateLimitsChanged / MsgInspectorSet / PreCrimeSet (BridgeAdapter)ProtocolParameterChangeWARNINGThe bridge's throughput caps and its optional message-inspection and pre-crime hooks change. These are the containment controls around cross-chain flow — relaxing them widens the blast radius of a bridge failure without being an exploit itself.
EnforcedOptionSet (BridgeAdapter)ProtocolParameterChangeINFOLayerZero execution options (gas limits and similar) for a destination are set. Message-delivery plumbing with no bearing on custody or authority.
RedemptionsServiced (sUSDai)ProtocolParameterChangeINFOThe STRATEGY_ADMIN role services the redemption queue. Holders cannot force their own exit, so this is the mechanism by which withdrawals actually complete; the per-request timing is tracked as a metric rather than paged.
LoanTimelockDeposited / LoanDepositTimelockDeposited / LoanEscrowTimelockDeposited / LoanEscrowTimelockWithdrawn / LoanRepaymentDeposited / PoolDeposited (sUSDai)ProtocolParameterChangeINFOVault capital being committed to, or returned from, the deposit and escrow timelocks on its way into and out of the loan book. Where a rate is present the alert reports it annualised. Routine capital movement.
LoanTimelockCancelled / LoanDepositTimelockCancelled / LoanEscrowTimelockCancelled (sUSDai)ProtocolParameterChangeWARNINGA queued deployment of vault capital is cancelled before it lands. The cancellation is the more informative half of the pair — it means an intended allocation was called off.
Migrated (sUSDai, USDai)ProtocolParameterChangeWARNINGAn admin-gated settings migration runs on the vault or the token. It rewrites configuration outside the normal parameter setters, so each occurrence is surfaced for review.

Valantis — stHYPE (valantis)

  • Chain(s): HyperEVM
  • Products: sthype
  • Contracts monitored:
    • Overseer — 0xB96f07367e69e86d6e9C3F29215885104813eeAE
    • stHYPE Token — 0xffaa4a3d97fe9107cef8a3f48c069f577ff76cc1
    • wstHYPE Token — 0x94e8396e0869c9F2200760aF0621aFd240E1CF38
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
ProtocolFeeSet (Overseer)ProtocolParameterChangeINFOProtocol fee changed
RoleGranted (Overseer)RoleChangeWARNINGRole granted
RoleRevoked (Overseer)RoleChangeWARNINGRole revoked
RoleAdminChanged (Overseer)RoleChangeERRORRole admin changed
DefaultAdminTransferScheduled (Overseer)AdminChangeWARNINGAdmin transfer scheduled
DefaultAdminTransferCanceled (Overseer)AdminChangeINFOAdmin transfer canceled
DefaultAdminDelayChangeScheduled (Overseer)TimelockChangeWARNINGAdmin delay change scheduled
DefaultAdminDelayChangeCanceled (Overseer)TimelockChangeINFOAdmin delay change cancelled
AprThresholdSet (Overseer)ProtocolParameterChangeINFOAPR threshold set
SlashThresholdSet (Overseer)ProtocolParameterChangeINFOSlash threshold set
SyncIntervalSet (Overseer)ProtocolParameterChangeINFOSync interval set
Upgraded (stHYPE Token)ContractUpgradeERRORstHYPE token contract upgraded
AdminChanged (stHYPE Token)AdminChangeERRORstHYPE token proxy admin changed
RoleGranted (stHYPE Token)RoleChangeWARNINGToken role granted
RoleRevoked (stHYPE Token)RoleChangeWARNINGToken role revoked
RoleAdminChanged (stHYPE Token)RoleChangeERRORToken role admin changed
DefaultAdminTransferScheduled (stHYPE Token)AdminChangeWARNINGToken admin transfer scheduled
DefaultAdminTransferCanceled (stHYPE Token)AdminChangeINFOToken admin transfer canceled
DefaultAdminDelayChangeScheduled (stHYPE Token)TimelockChangeWARNINGToken admin delay change scheduled
DefaultAdminDelayChangeCanceled (stHYPE Token)TimelockChangeINFOAdmin delay change cancelled
Upgraded (wstHYPE Token)ContractUpgradeERRORwstHYPE token contract upgraded
AdminChanged (wstHYPE Token)AdminChangeERRORwstHYPE token proxy admin changed
RoleGranted (wstHYPE Token)RoleChangeWARNINGwstHYPE role granted
RoleRevoked (wstHYPE Token)RoleChangeWARNINGwstHYPE role revoked
RoleAdminChanged (wstHYPE Token)RoleChangeERRORwstHYPE role admin changed
DefaultAdminTransferScheduled (wstHYPE Token)AdminChangeWARNINGwstHYPE admin transfer scheduled
DefaultAdminTransferCanceled (wstHYPE Token)AdminChangeINFOwstHYPE admin transfer canceled
DefaultAdminDelayChangeScheduled (wstHYPE Token)TimelockChangeWARNINGwstHYPE admin delay change scheduled
DefaultAdminDelayChangeCanceled (wstHYPE Token)TimelockChangeINFOwstHYPE admin delay change cancelled

Overview

Introduction to the Staking Rewards Ratings API - a REST-based API for accessing DeFi and Infrastructure ratings data.

List DeFi Chains GET

Returns the list of blockchains available in DeFi ratings. Use the returned `slug` values as the `chain` filter parameter in `GET /ratings/defi` and `GET /ratings/defi/{provider-slug}`.

On this page

Incident typesSeverity levelsCoverage summaryAave (aave)BlackRock (blackrock)Coinbase (coinbase)Compound (compound)Ethena (ethena)EtherFi (etherfi)HyperLend (hyperlend)Kelp (kelp)Lido — earnETH (lido-finance)Lido — earnUSD (lido-finance)Lido — stETH (lido)Lido — strETH (lido)Lombard (lombard)Looping Collective — lcBTC (looping-collective)Maple (maple)Moonwell Flagship ETH (moonwell)Morpho (morpho)Ondo (ondo)Puffer (puffer)Rocket Pool (rocketpool)Sky (sky)Spark (spark)Stader (stader)StakeWise (stakewise)USD.ai (usdai)Valantis — stHYPE (valantis)