Staking Data
Ratings API

Monitored Protocols & Events

The complete inventory of DeFi protocols, contracts, and on-chain events monitored by the Staking Rewards on-chain alerting pipeline, and how each maps to an alert incident type and severity.

DeFi alerts returned by the List DeFi Alerts endpoint are generated by on-chain monitors that watch governance- and risk-relevant contracts for each rated protocol. This page is the human-readable inventory of what is covered: which protocols and contracts are watched, which on-chain events trigger an alert, and the incident type and severity each maps to.

This page is maintained by hand alongside the monitors. If a protocol or event appears in an alert but not here, treat this page as lagging — the monitors are the source of truth.

Incident types

Every alert is classified into exactly one of seven incident types. The incident_type filter on the alerts endpoint matches these values.

Incident typeWhat it tracks
ContractUpgradeProxy upgrades, implementation changes, version updates, upgrade proposals/cancellations
TimelockChangeTimelock delay changes, call scheduling/execution/cancellation
AdminChangeOwner transfers, admin updates, pending-owner set/accepted, authority changes
MultisigChangeSafe owner add/remove, threshold changes, module/guard/fallback-handler updates
RoleChangeRole grants/revocations, role-admin changes, minter/pauser/oracle role assignments
ProtocolParameterChangeFee changes, reserve configs, rate limits, caps, cooldown durations
EmergencyActionPause/unpause, bunker mode, staking halt, seizure, emergency shutdown, reserve freeze

Severity levels

SeverityMeaning
CRITICALFunds-at-risk or protocol-halting events (pauses, seizures, emergency shutdown)
ERRORHigh-impact governance/upgrade events (implementation upgrades, admin transfers, timelock delay decreases)
WARNINGNotable governance/parameter changes (role grants, fee changes, multisig membership)
INFORoutine or low-impact updates (minor parameter tweaks, proposal scheduling)

The severity filter matches these values (case-insensitive).

Coverage summary

ProtocolChainProducts
AaveEthereumprotocol-wide + per-reserve
BlackRockEthereumbuidl
CoinbaseEthereumcbeth
CompoundEthereumusdt + protocol-wide
EthenaEthereumsusde
EtherFiEthereumeeth, weeth, liquid-eth
HyperLendHyperEVMprotocol-wide + per-asset
KelpEthereumrseth
Lido (earnETH)Ethereumearneth
Lido (earnUSD)Ethereumearnusd
Lido (stETH)Ethereumsteth
Lido (strETH)Ethereumstreth
LombardEthereumlbtc
Looping CollectiveEthereumlcbtc
MapleEthereumsyrupusdc, syrupusdt
Moonwell Flagship ETHBasemoonwell-flagship-eth
MorphoEthereumper-vault
OndoEthereumusdy, ousg
PufferEthereumpufeth
Rocket PoolEthereumreth
SkyEthereumsusds
SparkEthereumspweth, spusdc, spusdt + per-reserve
StaderEthereumethx
StakeWiseEthereumoseth
USD.aiArbitrum Onesusdai, usdai
Valantis (stHYPE)HyperEVMsthype

Aave (aave)

  • Chain(s): Ethereum
  • Products: the rated Aave Ethereum Core Market assets — weth, usdc, wbtc, eurc, usdt, wsteth, cbbtc, weeth, usde. Protocol-wide events (governance/admin/oracle/upgrades) apply to all of them; asset-scoped events only page for the rated assets (changes on other reserves are tracked on the dashboard at INFO)
  • Contracts monitored:
    • Pool — 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2
    • PoolConfigurator — 0x64b761D848206f447Fe2dd461b0c635Ec39EbB27
    • PoolAddressesProvider — 0x2f39d218133AFaB8F2B819B1066c7E434Ad94E9e
    • ACLManager — 0xc2aaCf6553D20d1e9d78E365AAba8032af9c85b0
    • ExecutorLvl1 — 0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A
    • ExecutorLvl2 — 0x17Dd33Ed0e3dD2a80E37489B8A63063161BE6957
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (ACLManager — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key that can administer every other role — effectively whole-protocol control. This is the highest-trust change Aave can make, so it pages at top urgency.
RoleGranted (ACLManager — POOL_ADMIN / EMERGENCY_ADMIN / ASSET_LISTING_ADMIN)RoleChangeERRORA new address gains a powerful privileged role: pool administration (including upgrading the tokens that hold user funds), the ability to pause the protocol, or control over which price oracles are used. Each can materially affect funds or availability, so granting it pages.
RoleGranted (ACLManager — RISK_ADMIN / BRIDGE)RoleChangeWARNINGA new address gains a bounded operational role — tuning risk parameters within limits, or bridge minting capped by configuration. Expected governance activity, so it is recorded for visibility but does not page.
RoleGranted (ACLManager — FLASH_BORROWER)RoleChangeINFOA new address is exempted from flash-loan premiums. This carries no governance power and cannot affect other users, so it is logged for completeness only.
RoleGranted (ACLManager — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name is granted. Because an unmapped or custom role could be powerful, it is treated as potentially dangerous and paged ("fail loud") rather than silently ignored.
RoleRevoked (ACLManager — DEFAULT_ADMIN / EMERGENCY_ADMIN / POOL_ADMIN)RoleChangeERRORA role whose loss is dangerous is removed — the root key (removal can lock out governance), the emergency-pause ability (losing it removes the protocol's exploit brake), or pool administration. Worth paging even though revocations usually reduce risk, because these can also signal a hostile takeover or an operational mistake.
RoleRevoked (ACLManager — other roles)RoleChangeWARNINGA lower-impact role (e.g. risk admin, flash borrower) is removed. Reducing privilege is generally safe, so it is recorded but does not page.
RoleAdminChanged (ACLManager)RoleChangeCRITICALThe rule for who may grant or revoke a role is rewired — a structural change to the access-control graph itself, not just who holds a role. This is meta-authority over the entire permission system: changing the admin of a powerful role (e.g. POOL_ADMIN or the root DEFAULT_ADMIN) is a direct privilege-escalation / takeover vector. This is not part of Aave's normal operations, so any occurrence is maximally anomalous (a classic way an attacker entrenches control) — paged at the highest severity, same tier as a root-authority or oracle swap.
OwnershipTransferred (Executor)AdminChangeCRITICALOwnership of a governance executor moves to a new address. The executor is where Aave's power actually resides — it holds pool-admin and root access-control rights and owns the AddressesProvider — and its owner can make it execute an arbitrary call from that privileged address (upgrade the fund-bearing token contracts, grant any role, swap the oracle). Owning the executor is therefore total control of the protocol. The legitimate owner is the governance payload-controller, never a person; ownership moves only as part of a governance migration, so any other occurrence is a top-urgency, funds-at-risk event.
ACLAdminUpdatedAdminChangeERRORChanges which address is registered as the ACL admin — the account tied to the ACLManager's root DEFAULT_ADMIN role that ultimately grants and revokes every other role. A root-of-trust change, so it always pages.
ACLManagerUpdatedContractUpgradeCRITICALRepoints the protocol at a different ACLManager contract. Because permission checks resolve the manager at runtime, a swap immediately changes the authority behind every privileged action — a malicious manager could make anyone a pool admin and drain funds. Outside the protocol's initial setup this is not a normal operation, so any occurrence is a top-urgency, funds-at-risk event.
PoolUpdatedContractUpgradeERRORUpgrades the implementation behind the core Pool proxy — replacing the code of Aave's main lending contract while funds and storage stay in the unchanged proxy. Governance-gated and routine, but because it ships new code for the contract at the heart of the protocol, every upgrade pages so it can be matched to a known governance proposal.
PoolConfiguratorUpdatedContractUpgradeERRORUpgrades the implementation behind the PoolConfigurator proxy — the privileged contract that sets every reserve's risk parameters (caps, collateral config, freeze/pause). Governance-gated; each upgrade pages so the new code can be matched to a known governance proposal.
PriceOracleUpdatedContractUpgradeCRITICALSwaps the protocol's entire price-oracle contract. Pricing is resolved at runtime, so a swap instantly repoints all collateral valuation and liquidations — a malicious or buggy oracle is one of the fastest ways to drain a lending pool. Outside initial setup this is not a normal operation; any occurrence is a top-urgency, funds-at-risk event. (Routine per-asset feed changes use a different event.)
PriceOracleSentinelUpdatedContractUpgradeERRORSets the PriceOracleSentinel — L2 machinery that blocks borrows/liquidations during sequencer downtime. This monitor covers only Aave's Ethereum-mainnet deployment, which has no sequencer, so the sentinel is inert here and is not set on this deployment; an occurrence is anomalous and pages. (On Aave's L2 markets the sentinel is live safety infrastructure; those deployments are outside this monitor's current scope.) Worst case if misconfigured is freezing liquidations — a slow solvency risk, not an instant drain.
PoolDataProviderUpdatedContractUpgradeWARNINGSwaps the PoolDataProvider, a read-only view/aggregation helper UIs and integrators call to read reserve data. It holds no funds, grants no privileges, and isn't used in any state-changing path, so a swap can at most return wrong data to off-chain readers — dashboard-only.
OwnershipTransferred (AddressesProvider)AdminChangeCRITICALOwnership of the PoolAddressesProvider — the market's master registry — moves to a new address. Its owner is the single key that can swap the Pool, the PoolConfigurator, the ACLManager, and the price oracle, i.e. it can trigger every one of the funds-at-risk events above. Transferring it is the protocol's top root-of-trust change. Ownership moves only as part of a governance migration (the legitimate owner is the governance executor), so any other occurrence is a top-urgency, funds-at-risk event.
ProxyCreatedContractUpgradeINFOThe AddressesProvider deploys a brand-new proxy for a registry slot. This fires only the first time a proxied component (the Pool, the PoolConfigurator, etc.) is registered, and always co-fires with the meaningful event for that component (PoolUpdated, AddressSetAsProxy) — which carries the real severity. On its own it grants no privileges and moves no funds, so it is recorded for completeness only. It fires only when proxied components are first registered, at protocol setup.
AddressSetAsProxyContractUpgradeERRORUpgrades the implementation behind a registered proxy via the generic registry path — the same mechanism as PoolUpdated, but for a registry slot that doesn't have its own dedicated setter. It swaps the executing code of a governance-controlled proxy, so it carries the same risk class as a Pool/Configurator upgrade and pages, to be matched against a known governance proposal. It fires only at protocol setup to register a proxied component, and is not part of routine operations.
AddressSetContractUpgradeERRORThe owner edits one entry in the market's address registry (its "phone book") for an id that has no dedicated setter — the dangerous core pointers (oracle, ACL manager, ACL admin, data provider) have their own events and do not flow through here. The risk is indirection: contracts resolve components by id at runtime, so a poisoned entry can redirect a trusted integration to an attacker's contract. Impact depends on who reads that id — e.g. the UMBRELLA entry wires in Aave's safety module that covers reserve bad debt. Owner-only and rare, so each occurrence pages to be matched against a known proposal.
ReserveFactorChanged (≤50%)ProtocolParameterChangeINFOThe reserve factor — the share of borrow interest diverted to the protocol treasury rather than to suppliers — is changed for an asset. A routine, frequently-adjusted economic knob the risk stewards tune; it does not touch fund custody, collateral safety, or solvency. Normal values sit in a 5–50% band, so changes within it are tracked on the dashboard, not paged.
ReserveFactorChanged (>50%)ProtocolParameterChangeWARNINGThe new reserve factor exceeds 50%, outside the normal operating band. The only values this high on record are Aave's GHO stablecoin at 100% (by design) and an asset being offboarded (SNX at 95%) — legitimate but unusual, so the change is surfaced for confirmation that it is an intended offboarding or special-asset setting. It does not page.
FlashloanPremiumTotalUpdated (≤1%)ProtocolParameterChangeINFOThe total flash-loan premium (the fee on a flash loan) is changed. This is the lowest-stakes fee on the protocol — it cannot reach funds or solvency (a high premium just makes flash loans expensive, a zero premium just makes them free; the loan must still be repaid in the same transaction). Historically it has only ever been 5–9 bps, so normal changes are tracked on the dashboard, not paged.
FlashloanPremiumTotalUpdated (>1%)ProtocolParameterChangeWARNINGThe new flash-loan premium exceeds 1% — roughly a tenfold jump over the 5–9 bps norm. There is no legitimate reason for such a value, so it is surfaced as a likely misconfiguration or tampering signal. It does not page.
FlashloanPremiumToProtocolUpdatedProtocolParameterChangeINFOChanges how the flash-loan premium is split between the protocol treasury and the liquidity suppliers (a bounded 0–100% share). The borrower's total fee is unchanged — only who receives it moves — so no setting carries fund or solvency risk, and 100% (all premium to treasury) is a legitimate endpoint governance has used. Tracked on the dashboard, not paged.
BridgeProtocolFeeUpdatedProtocolParameterChangeWARNINGChanges the protocol's cut of the fee on Aave's Portal feature (cross-chain "unbacked" minting). The fee itself is harmless, but the Portal subsystem is dormant on Ethereum mainnet — this fee and the bridge role are unused here — and it is higher-risk if activated. Any change is therefore treated as a canary that someone is configuring Portal on mainnet and is surfaced for review (correlate with a bridge-role grant). It does not page.
LiquidationProtocolFeeChanged (≤30%)ProtocolParameterChangeINFOThe protocol's cut of the liquidation bonus for an asset is changed. The liquidation bonus is what pays liquidators to keep the protocol solvent; the standard cut is 10% (historical band 0–20%), so changes within range are tracked on the dashboard, not paged.
LiquidationProtocolFeeChanged (>30%)ProtocolParameterChangeWARNINGThe new fee exceeds 30% — well outside the historical 0–20% band. Taking too large a share of the liquidation bonus erodes the liquidator's margin, which can slow or stall liquidations and lead to bad debt, so the change is surfaced for review. The risk is gradual and the parameter is bounded, so it does not page.
ATokenUpgradedContractUpgradeERRORUpgrades the implementation of an asset's aToken — the contract that custodies user deposits for that reserve. A fund-bearing code swap (a malicious implementation could drain the reserve), so it pages, same as a core Pool upgrade. Routine via governance — protocol-wide migrations upgrade every reserve in a single transaction — so each migration should map to a known proposal.
VariableDebtTokenUpgradedContractUpgradeERRORUpgrades the implementation of an asset's variable-debt token — the contract that accounts for that reserve's borrows. Same risk class as the aToken upgrade: a code swap on core reserve accounting, so it pages and each upgrade should map to a known governance proposal.
ReserveInterestRateStrategyChangedProtocolParameterChangeINFOSwaps the interest-rate-strategy contract a reserve uses (the contract that computes borrow and supply rates from utilization). It affects only rates, not custody — a bad strategy could grief with extreme rates but cannot move funds, and it is fully recoverable. A routine, historically high-volume risk-steward action (largely superseded from V3.2 by interest-rate data changes), so it is tracked on the dashboard, not paged.
ReserveInterestRateDataChangedProtocolParameterChangeINFOThe V3.2+ routine way to retune a reserve's interest-rate curve — a risk steward writes new rate data (optimal usage ratio, base rate, and the two utilization slopes) onto a shared strategy contract, rather than deploying a new strategy. Purely economic: it moves borrow and supply rates, never touches custody or solvency, and is fully recoverable. The highest-volume reserve event, so it is tracked on the dashboard, not paged.
ReservePaused (rated asset, paused)EmergencyActionCRITICALEmergency halt of a monitored reserve — pausing blocks every interaction with the asset including withdrawals and liquidations, so the product goes fully dark and user funds are locked in place. Strictly more severe than a freeze (which still lets users exit). No monitored asset has ever been paused on Aave's Ethereum market (the few pauses to date were on non-monitored assets), so a pause on a monitored product is exceptional and paged immediately, whether it is protective incident response or hostile. Non-monitored assets are tracked on the dashboard at INFO.
ReservePaused (rated asset, unpaused)EmergencyActionWARNINGA monitored reserve is taken out of pause and restored to normal operation — the recovery / all-clear signal. Tracked on the dashboard rather than paged.
ReserveFrozen (rated asset, frozen)EmergencyActionERRORA monitored reserve is frozen — new supply and borrow are blocked, but users can still repay, withdraw, and be liquidated, so funds are not locked. This is Aave's graceful asset-offboarding tool, one tier below a pause; freezing a monitored product is material enough to page but, because exits stay open, is not treated as critical. Non-monitored assets are tracked on the dashboard at INFO.
ReserveFrozen (rated asset, unfrozen)EmergencyActionWARNINGA monitored reserve is unfrozen and re-enabled for new supply and borrow — the recovery signal. Tracked on the dashboard rather than paged.
CollateralConfigurationChanged (rated asset, LTV→0 or liquidation-threshold cut ≥5%)ProtocolParameterChangeERRORThe solvency-critical collateral parameters of a monitored reserve — loan-to-value (LTV), liquidation threshold (LT), and liquidation bonus. Two cases page: (1) a drop in the liquidation threshold, which makes existing positions immediately liquidatable and can trigger a wave of forced liquidations and bad debt — the genuinely dangerous direction; (2) LTV set to 0, which disables the asset as new collateral (a protective de-risking / wind-down signal). Evaluated against the previous on-chain value, so only a real transition pages.
CollateralConfigurationChanged (rated asset, other change)ProtocolParameterChangeWARNINGRoutine collateral re-parameterisation of a monitored reserve — raising LTV/threshold, small ±1% adjustments, or liquidation-bonus tweaks. Material enough to record but not dangerous to existing positions, so it is tracked on the dashboard rather than paged. Changes on non-monitored reserves are INFO.
BorrowCapChanged (rated asset, disabled)ProtocolParameterChangeWARNINGThe borrow cap of a monitored reserve is cut to the "disabled" sentinel (a cap of 1 token), which effectively stops new borrowing of the asset — a wind-down / de-risking signal. Surfaced on the dashboard for prominence (it correlates with freezes and collateral de-risking), but not paged: the borrow cap only limits new borrowing and never affects existing positions or funds.
BorrowCapChanged (other)ProtocolParameterChangeINFORoutine adjustment of how much of an asset can be borrowed (raising/lowering the cap as the market grows or de-risks). It cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
SupplyCapChanged (rated asset, disabled)ProtocolParameterChangeWARNINGThe supply cap of a monitored reserve is cut to the "disabled" sentinel (a cap of 1 token), effectively stopping new deposits of the asset — a wind-down signal. Surfaced on the dashboard for prominence, but not paged: the supply cap only limits new deposits and never affects existing positions or funds.
SupplyCapChanged (other)ProtocolParameterChangeINFORoutine adjustment of how much of an asset can be supplied (raising/lowering the cap as the pool grows or de-risks). It cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
DebtCeilingChanged (rated asset, isolation-mode transition)ProtocolParameterChangeWARNINGA monitored asset enters or exits isolation mode — Aave's sandbox for riskier collateral, where the asset can only be used alone (not combined with other collateral), can only borrow stablecoins, and has a capped total debt (the debt ceiling, in USD). Entering isolation is a restricted/de-risk listing; exiting (ceiling set to 0) promotes it to normal collateral. This is a genuine risk-posture change, so it is surfaced on the dashboard — but not paged, since the ceiling only limits exposure and never affects existing positions.
DebtCeilingChanged (other)ProtocolParameterChangeINFORoutine adjustment of an isolated asset's debt ceiling (raising/lowering the capped total debt while it stays in isolation mode), or a listing-time no-op. It cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
SiloedBorrowingChanged (rated asset, toggled)ProtocolParameterChangeWARNINGA monitored asset is switched into or out of siloed borrowing — a siloed asset can only be borrowed on its own (you can't borrow anything else against it in the same account), a containment control for assets with manipulable or thin-liquidity prices. Turning it on signals a price-manipulation concern; turning it off relaxes that. A risk-posture change surfaced on the dashboard, but not paged: it constrains borrowing behaviour only and never affects existing positions.
SiloedBorrowingChanged (other)ProtocolParameterChangeINFOA listing-time no-op (siloed status set to its default at reserve init) or a change on a non-monitored asset. Tracked on the dashboard, not paged.
LiquidationGracePeriodChanged (rated asset)ProtocolParameterChangeWARNINGWhen a paused reserve is reopened, a grace period can keep liquidations blocked for a short window so borrowers can react before liquidations resume. This sets that window for a monitored asset. Surfaced on the dashboard as context for the reserve pause/unpause that triggered it (the pause itself is the page); not paged on its own. Non-monitored assets are INFO.
LiquidationGracePeriodDisabled (rated asset)ProtocolParameterChangeWARNINGCancels an active liquidation grace period on a monitored asset, re-enabling liquidations immediately. Dashboard context for the pause/unpause lifecycle; not paged on its own. Non-monitored assets are INFO.
PendingLtvChangedProtocolParameterChangeINFOBookkeeping for the freeze mechanism: when a reserve is frozen its current LTV is cached here (and effective LTV set to 0), then restored on unfreeze. It always accompanies a reserve freeze and the related collateral-config change, both of which already carry the alert, so this is tracked on the dashboard at INFO to avoid double-counting the same incident.
EModeCategoryAddedProtocolParameterChangeERROR (rated-holding category, LT drop ≥500bps) / INFODefines/updates an efficiency-mode category's LTV & liquidation threshold; for a position in the category the category LT is the binding constraint. Aave v3.2 e-mode is high-churn (~40 categories, many ephemeral PT-token expiry categories, LTs tuned upward almost daily), so only a genuine ≥500bps LT drop on a category holding a rated asset pages — everything else is dashboard INFO. Stateful. 353 on-chain; 0 ≥500bps drops on rated categories → clean trip-wire (a flat WARNING tier would have been 95 rows of noise).
AssetCollateralInEModeChangedProtocolParameterChangeINFOEnables/disables an asset as collateral in an e-mode category. High-churn in v3.2 (assets move between categories — collateral=false is routine restructuring, not a removal), so dashboard-only; used to maintain which categories hold a rated asset for the LT-drop rule above. Only rated-asset changes are recorded. (A naive "disabled → ERROR" rule would have mis-paged 20× on restructuring.)
AssetLtvzeroInEModeChangedProtocolParameterChangeERROR (rated asset, ltvzero=true) / INFOForces (or restores) a rated asset's e-mode LTV to 0 — disabling it as e-mode borrowing power, a real de-risk/disable signal → ERROR; restoring → INFO. 1 on-chain on a rated asset (WETH cat 1 forced to 0, later restored).
Upgraded (Pool)ContractUpgradeERRORThe main Pool contract's implementation is upgraded — this replaces the core money-market logic for the entire market (every monitored product and reserve), so it is always paged. It is kept at ERROR rather than the top severity because Pool upgrades are a routine, recurring governance migration (a few per year); the page exists so the upgrade can be confirmed against a known Aave governance proposal.

BlackRock (blackrock)

  • Chain(s): Ethereum
  • Products: buidl
  • Contracts monitored:
    • BUIDL — 0x7712c34205737192402172409a8f7ccef8aa2aec
    • BUIDL-I — 0x6a9da2d710bb9b700acde7cb81f10f1ff8c89041
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
ProxyTargetSetContractUpgradeERRORBUIDL proxy target changed to new implementation
ProxyOwnerChangedAdminChangeERRORBUIDL proxy owner changed
OwnershipTransferredAdminChangeERRORDSToken ownership transferred
DSServiceSetRoleChangeWARNINGSecuritize infrastructure service address changed
WalletAddedRoleChangeINFOWallet added to BUIDL whitelist
WalletRemovedRoleChangeINFOWallet removed from BUIDL whitelist
SeizeEmergencyActionCRITICALToken seizure (regulatory) executed
OmnibusSeizeEmergencyActionCRITICALOmnibus account seizure executed
PauseEmergencyActionCRITICALProtocol paused
UnpauseEmergencyActionCRITICALProtocol unpaused
Upgraded (BUIDL-I)ContractUpgradeERRORBUIDL-I proxy upgraded to new implementation

Coinbase (coinbase)

  • Chain(s): Ethereum
  • Products: cbeth
  • Contracts monitored:
    • cbETH — 0xbe9895146f7af43049ca1c1ae358b0541ea49704
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
UpgradedContractUpgradeERRORcbETH proxy upgraded to new implementation
AdminChangedAdminChangeERRORcbETH proxy admin changed
OwnershipTransferredAdminChangeERROROwnership transferred
MasterMinterChangedRoleChangeWARNINGMasterMinter (controls who can mint) changed
MinterConfiguredRoleChangeWARNINGMinter added/updated with allowance
MinterRemovedRoleChangeWARNINGMinter removed
PauserChangedRoleChangeWARNINGPauser role changed
BlacklisterChangedRoleChangeWARNINGBlacklister role changed
RescuerChangedRoleChangeWARNINGRescuer role changed
OracleUpdatedRoleChangeWARNINGOracle (exchange-rate updater) address updated
PauseEmergencyActionCRITICALProtocol paused
UnpauseEmergencyActionCRITICALProtocol unpaused

Compound (compound)

  • Chain(s): Ethereum
  • Products: usdt (Comet market events); protocol-wide for governance/admin/multisig
  • Contracts monitored:
    • cUSDTv3 (Comet) — 0x3afdc9bca9213a35503b077a6072f3d0d5ab0840
    • CometProxyAdmin — 0x1ec63b5883c3481134fd50d5daebc83ecd2e8779
    • Timelock — 0x6d903f6003cca6255d85cca4d3b5e5146dc33925
    • GovernorBravo — 0xc0da02939e1441f497fd74f78ce7decb17b66529
    • Community MultiSig (Pause Guardian) — 0xbbf3f1421d886e9b2c5d716b5192ac998af2012c
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
PauseActionEmergencyActionERRORMarket operations paused/unpaused
WithdrawReservesProtocolParameterChangeWARNINGProtocol reserves withdrawn to treasury
OwnershipTransferred (ProxyAdmin)AdminChangeERRORCometProxyAdmin ownership transferred
NewDelayTimelockChangeERRORTimelock delay changed
QueueTransactionTimelockChangeINFOGovernance action queued
ExecuteTransactionTimelockChangeINFOGovernance action executed
CancelTransactionTimelockChangeINFOGovernance action cancelled
NewAdmin (Timelock)AdminChangeERRORTimelock admin changed
NewPendingAdmin (Timelock)AdminChangeWARNINGTimelock pending admin set
NewImplementation (Governor)ContractUpgradeERRORGovernor implementation upgraded
VotingDelaySetProtocolParameterChangeWARNINGVoting delay changed
VotingPeriodSetProtocolParameterChangeWARNINGVoting period changed
ProposalThresholdSetProtocolParameterChangeWARNINGProposal threshold changed
NewAdmin (Governor)AdminChangeERRORGovernor admin changed
NewPendingAdmin (Governor)AdminChangeWARNINGGovernor pending admin set
AddedOwnerMultisigChangeWARNINGSigner added to Pause Guardian multisig
RemovedOwnerMultisigChangeWARNINGSigner removed from Pause Guardian multisig
ChangedThresholdMultisigChangeWARNINGPause Guardian multisig threshold changed
EnabledModuleMultisigChangeWARNINGModule enabled on multisig
DisabledModuleMultisigChangeWARNINGModule disabled on multisig
ChangedGuardMultisigChangeWARNINGGuard contract changed on multisig
ChangedFallbackHandlerMultisigChangeWARNINGFallback handler changed on multisig

Ethena (ethena)

  • Chain(s): Ethereum
  • Products: susde
  • Contracts monitored:
    • StakedUSDeV2 (sUSDe) — 0x9D39A5DE30e57443BfF2A8307A4256c8797A3497
    • USDe Token — 0x4c9EDD5852cd905f086C759E8383e09bff1E68B3
    • EthenaMinting — 0xe3490297a08d6fC8Da46Edb7B6142E4F461b62D3
    • StakingRewardsDistributor — 0xf2fa332bd83149c66b09b45670bce64746c6b439
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
CooldownDurationUpdated (decreased)ProtocolParameterChangeERRORsUSDe unstaking cooldown shortened — smaller defensive window before redemptions
CooldownDurationUpdated (increased)ProtocolParameterChangeWARNINGsUSDe unstaking cooldown lengthened
AdminTransferRequested (sUSDe)AdminChangeWARNINGsUSDe admin transfer requested (two-step step 1; pages on completion)
AdminTransferred (sUSDe)AdminChangeCRITICALsUSDe root admin transferred — root-of-trust takeover of the staked vault
RoleGranted (sUSDe, BLACKLIST_MANAGER_ROLE)RoleChangeERRORFreeze-power role granted (can restrict/blacklist stakers)
RoleGranted (sUSDe, REWARDER_ROLE)RoleChangeWARNINGRewarder role granted
RoleGranted (sUSDe, other/unlabeled role)RoleChangeERRORUnknown or unexpected role granted (fail-loud). DEFAULT_ADMIN_ROLE and restricted-staker roles are suppressed as echo/compliance noise
RoleRevoked (sUSDe, BLACKLIST_MANAGER_ROLE)RoleChangeERRORFreeze-power role revoked
RoleRevoked (sUSDe, other role)RoleChangeWARNINGNon-freeze role revoked (risk-reducing)
RoleAdminChanged (sUSDe)RoleChangeCRITICALsUSDe role-admin rewired — meta-authority over the permission system
LockedAmountRedistributedEmergencyActionCRITICALsUSDe locked stake seized/redistributed from restricted stakers
MaxMintPerBlockChanged (set to 0)EmergencyActionERRORUSDe minting halted — per-block mint limit dropped to 0
MaxMintPerBlockChanged (re-enabled from 0)EmergencyActionWARNINGUSDe minting re-enabled — mint limit raised off 0
MaxMintPerBlockChanged (other change)ProtocolParameterChangeWARNINGMax mint per block changed
MaxRedeemPerBlockChanged (set to 0)EmergencyActionERRORUSDe redemption halted — per-block redeem limit dropped to 0
MaxRedeemPerBlockChanged (re-enabled from 0)EmergencyActionWARNINGUSDe redemption re-enabled — redeem limit raised off 0
MaxRedeemPerBlockChanged (other change)ProtocolParameterChangeWARNINGMax redeem per block changed
AssetAddedProtocolParameterChangeERRORNew collateral asset added to USDe backing — needs eyeball ("is this asset legit?")
AssetRemovedProtocolParameterChangeWARNINGCollateral asset removed (de-risking)
TokenTypeSetProtocolParameterChangeERRORCollateral token classification changed (e.g. stable-bucket treatment)
CustodianAddressAddedAdminChangeERRORNew custodian destination authorized — collateral can be sent off-chain to it
CustodianAddressRemovedAdminChangeWARNINGCustodian destination removed (de-risking)
USDeSetContractUpgradeERROREthenaMinting USDe address changed
DelegatedSignerAddedRoleChangeWARNINGBenefactor delegated its own signing authority (counterparty-level)
DelegatedSignerRemovedRoleChangeWARNINGBenefactor removed a delegated signer
AdminTransferRequested (EthenaMinting)AdminChangeWARNINGEthenaMinting admin transfer requested (two-step step 1; pages on completion)
AdminTransferred (EthenaMinting)AdminChangeCRITICALEthenaMinting root admin transferred — controls mint, redeem and collateral custody
RoleGranted (EthenaMinting, MINTER/REDEEMER/COLLATERAL_MANAGER_ROLE)RoleChangeERRORFund- or supply-affecting role granted (mint USDe, release collateral, move backing to custody)
RoleGranted (EthenaMinting, GATEKEEPER_ROLE)RoleChangeWARNINGDefensive circuit-breaker role granted (can halt, not steal)
RoleGranted (EthenaMinting, other/unlabeled role)RoleChangeERRORUnknown or unexpected role granted (fail-loud). DEFAULT_ADMIN_ROLE suppressed (echo of AdminTransferred)
RoleRevoked (EthenaMinting)RoleChangeWARNINGAny EthenaMinting role revoked (de-risking); DEFAULT_ADMIN_ROLE suppressed
RoleAdminChanged (EthenaMinting)RoleChangeCRITICALEthenaMinting role-admin rewired — meta-authority over the permission system
MinterUpdated (USDe)RoleChangeCRITICALUSDe minter changed — sole authority to mint the synthetic dollar
OwnershipTransferred (USDe)AdminChangeERRORUSDe ownership transferred
OwnershipTransferStarted (USDe)AdminChangeWARNINGUSDe ownership transfer started (two-step step 1; pages on completion)
OperatorUpdated (StakingRewardsDistributor)RoleChangeWARNINGStakingRewardsDistributor operator updated
MintingContractUpdatedContractUpgradeERRORStakingRewardsDistributor minting contract updated
OwnershipTransferred (StakingRewardsDistributor)AdminChangeERRORStakingRewardsDistributor ownership transferred
OwnershipTransferStarted (StakingRewardsDistributor)AdminChangeWARNINGStakingRewardsDistributor ownership transfer started (two-step step 1; pages on completion)
TokensRescued (StakingRewardsDistributor)EmergencyActionCRITICALArbitrary ERC-20 swept out of the rewards distributor via rescueTokens — always warrants review

EtherFi (etherfi)

  • Chain(s): Ethereum
  • Products: eeth, weeth, liquid-eth, plus protocol-wide for governance/admin contracts
  • Contracts monitored:
    • eETH — 0x35fA164735182de50811E8e2E824cFb9B6118ac2
    • weETH — 0xCd5fE23C85820F7B72D0926FC9b05b43E359b7ee
    • LiquidityPool — 0x308861A430be4cce5502d0A12724771Fc6DaF216
    • WithdrawRequestNFT — 0x7d5706f6ef3F89B3951E23e557CDFBC3239D4E2c
    • MembershipManager — 0x3d320286E014C3e1ce99Af6d6B00f0C1D63E3000
    • EtherFiAdmin — 0x0EF8fa4760Db8f5Cd4d993f3e3416f30f942D705
    • EtherFiTimelock — 0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761
    • Treasury — 0x6329004E903B7F420245E7aF3f355186f2432466
    • BoringVault (Liquid ETH) — 0xf0bb20865277aBd641a307eCe5ee04E79073416C
    • Teller (Liquid ETH) — 0x9AA79C84b79816ab920bBcE20f8f74557B514734
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (LiquidityPool)ContractUpgradeERRORLiquidityPool implementation upgraded
OwnershipTransferred (LiquidityPool)AdminChangeERRORLiquidityPool ownership transferred
AdminChanged (LiquidityPool)AdminChangeERRORLiquidityPool proxy admin changed
Paused (LiquidityPool)EmergencyActionERRORLiquidityPool paused
Unpaused (LiquidityPool)EmergencyActionERRORLiquidityPool unpaused
UpdatedFeeRecipient (LiquidityPool)ProtocolParameterChangeWARNINGLiquidityPool fee recipient updated
UpdatedTreasury (LiquidityPool)ProtocolParameterChangeWARNINGLiquidityPool treasury address updated
Upgraded (WithdrawRequestNFT)ContractUpgradeERRORWithdrawRequestNFT upgraded
OwnershipTransferred (WithdrawRequestNFT)AdminChangeERRORWithdrawRequestNFT ownership transferred
Paused (WithdrawRequestNFT)EmergencyActionERRORWithdrawRequestNFT paused
Unpaused (WithdrawRequestNFT)EmergencyActionERRORWithdrawRequestNFT unpaused
MinDelayChange (Timelock, decreased)TimelockChangeERRORTimelock min delay decreased (higher risk)
MinDelayChange (Timelock, increased)TimelockChangeWARNINGTimelock min delay increased/unchanged
RoleGranted (Timelock)RoleChangeWARNINGTimelock role granted
RoleRevoked (Timelock)RoleChangeWARNINGTimelock role revoked
RoleAdminChanged (Timelock)RoleChangeERRORTimelock role admin changed
CallScheduled (Timelock)TimelockChangeINFOTimelock call scheduled
CallExecuted (Timelock)TimelockChangeINFOTimelock call executed
Cancelled (Timelock)TimelockChangeINFOTimelock call cancelled
AdminUpdated (EtherFiAdmin)AdminChangeERROREtherFiAdmin admin added/removed
Upgraded (EtherFiAdmin)ContractUpgradeERROREtherFiAdmin upgraded
OwnershipTransferred (EtherFiAdmin)AdminChangeERROREtherFiAdmin ownership transferred
Upgraded (eETH)ContractUpgradeERROReETH token contract upgraded
OwnershipTransferred (eETH)AdminChangeERROReETH token ownership transferred
Upgraded (weETH)ContractUpgradeERRORweETH token contract upgraded
OwnershipTransferred (weETH)AdminChangeERRORweETH token ownership transferred
Upgraded (MembershipManager)ContractUpgradeERRORMembershipManager upgraded
OwnershipTransferred (MembershipManager)AdminChangeERRORMembershipManager ownership transferred
Paused (MembershipManager)EmergencyActionERRORMembershipManager paused
Unpaused (MembershipManager)EmergencyActionERRORMembershipManager unpaused
OwnershipTransferred (Treasury)AdminChangeERRORTreasury ownership transferred
AuthorityUpdated (BoringVault)AdminChangeERRORBoringVault authority updated
OwnershipTransferred (BoringVault)AdminChangeERRORBoringVault ownership transferred
AssetDataUpdated (Teller)ProtocolParameterChangeINFOTeller asset data updated
Paused (Teller)EmergencyActionERRORTeller paused
Unpaused (Teller)EmergencyActionERRORTeller unpaused
AuthorityUpdated (Teller)AdminChangeERRORTeller authority updated
OwnershipTransferred (Teller)AdminChangeERRORTeller ownership transferred

HyperLend (hyperlend)

  • Chain(s): HyperEVM
  • Products: rated as a single product — the HYPE Core Market (product hype, the WHYPE reserve 0x5555…5555). Most incidents are protocol-wide (product: ""); only events on the rated HYPE reserve escalate above INFO and carry product: hype. The exchange-rate series (getReserveNormalizedIncome, the HYPE supply liquidity index) is polled for hype.
  • Contracts monitored:
    • Pool — 0x00A89d7a5A02160f20150EbEA7a2b5E4879A1A8b
    • PoolConfigurator — 0x8CB4310dD38F6fD59388C9DE225f328092bdC379
    • PoolAddressesProvider — 0x72c98246a98bFe64022a3190e7710E157497170C
    • ACLManager — 0x10914Ee2C2dd3F3dEF9EFFB75906CA067700a04A
    • ProxyAdmin — 0xdb3Bf3e22380780F75D7F57C772e71fCa7EBA027
    • TimelockA — 0xaAaaaAAAa810beD1EDA93A18FEC940857ED17879
    • TimelockB — 0xbbBBbbBB81e9B92918AA51e0CDfB3B53f7D72432
    • TimelockC — 0xCCcCCcCCC4B6CD09594E7c5bF108695F79313115
    • GovernanceMultisig — 0x2110E7B8e925C387A88259CEac9bd82c47868E9C
    • TreasuryMultisig — 0xCBF400610DBF462fE316D8A7db6Ba78d57E43d7b
    • EmergencyAdminMultisig — 0xC2A0F2c78dd7E37C82aA3A8e37fc712a3ddb7cAc
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (ACLManager — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key that can administer every other role — effectively whole-protocol control. The highest-trust change the protocol can make, so it pages at top urgency.
RoleGranted (ACLManager — POOL_ADMIN / EMERGENCY_ADMIN / ASSET_LISTING_ADMIN)RoleChangeERRORA new address gains a powerful privileged role: pool administration (including upgrading the tokens that hold user funds), the ability to pause the protocol, or control over which price oracles are used. Each can materially affect funds or availability, so granting it pages.
RoleGranted (ACLManager — RISK_ADMIN / BRIDGE)RoleChangeWARNINGA new address gains a bounded operational role — tuning risk parameters within limits, or bridge minting capped by configuration. Expected governance activity, recorded for visibility but does not page.
RoleGranted (ACLManager — FLASH_BORROWER)RoleChangeINFOA new address is exempted from flash-loan premiums. Carries no governance power and cannot affect other users, logged for completeness only.
RoleGranted (ACLManager — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name is granted. An unmapped or custom role could be powerful, so it is treated as potentially dangerous and paged ("fail loud").
RoleRevoked (ACLManager — DEFAULT_ADMIN / EMERGENCY_ADMIN / POOL_ADMIN)RoleChangeERRORA role whose loss is dangerous is removed — the root key (removal can lock out governance), the emergency-pause ability (losing it removes the protocol's exploit brake), or pool administration. Worth paging even though revocations usually reduce risk, because these can also signal a hostile takeover or an operational mistake.
RoleRevoked (ACLManager — other roles)RoleChangeWARNINGA lower-impact role (e.g. risk admin, asset-listing admin) is removed. Reducing privilege is generally safe, so it is recorded but does not page.
RoleAdminChanged (ACLManager)RoleChangeCRITICALThe rule for who may grant or revoke a role is rewired — a structural change to the access-control graph itself, not just who holds a role. This is meta-authority over the entire permission system: changing the admin of a powerful role (e.g. POOL_ADMIN or the root DEFAULT_ADMIN) is a direct privilege-escalation / takeover vector. It is not part of normal operations, so any occurrence is maximally anomalous — paged at the highest severity, same tier as a root-authority or oracle swap.
MinDelayChange (Timelock, decrease)TimelockChangeERRORTimelock delay decreased
MinDelayChange (Timelock, increase)TimelockChangeWARNINGTimelock delay increased
RoleGranted (Timelock — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the timelock's own admin role — it can grant itself proposer and executor and bypass the delay entirely, i.e. full control of the governance queue. Pages at top urgency.
RoleGranted (Timelock — PROPOSER / CANCELLER)RoleChangeERRORA new address gains the ability to schedule arbitrary privileged operations into the timelock queue (proposer), or to cancel a pending operation before it executes (canceller — can block an emergency governance action). Each is a governance-integrity change worth paging.
RoleGranted (Timelock — EXECUTOR)RoleChangeWARNINGA new address may execute operations that are already scheduled and past their delay — it cannot introduce new actions, so it is recorded but does not page.
RoleGranted (Timelock — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name is granted; treated as potentially powerful and paged ("fail loud").
RoleRevoked (Timelock — DEFAULT_ADMIN / CANCELLER)RoleChangeERRORA capability whose loss is dangerous is removed — the timelock admin (removal can lock out / brick governance) or the canceller (removes the brake that can stop a malicious pending operation). Worth paging.
RoleRevoked (Timelock — PROPOSER / EXECUTOR)RoleChangeWARNINGA lower-impact timelock role is removed. Reducing privilege is generally safe and recoverable, so it is recorded but does not page.
ACLAdminUpdatedAdminChangeERRORChanges which address is registered as the ACL admin — the account tied to the ACLManager's root DEFAULT_ADMIN role that ultimately grants and revokes every other role. A root-of-trust change, so it always pages. Unlike ACLManagerUpdated, this updates a stored pointer rather than swapping the live authority contract, so it is ERROR rather than CRITICAL.
ACLManagerUpdatedContractUpgradeCRITICALRepoints the protocol at a different ACLManager contract. Because permission checks resolve the manager at runtime, a swap immediately changes the authority behind every privileged action — a malicious manager could make anyone a pool admin and drain funds. Outside initial setup this is not a normal operation, so any occurrence is a top-urgency, funds-at-risk event.
PoolUpdatedContractUpgradeERRORUpgrades the implementation behind the core Pool proxy — replacing the code of the main lending contract while funds and storage stay in the unchanged proxy. Governance-gated and routine, but because it ships new code for the contract at the heart of the protocol, every upgrade pages so it can be matched to a known governance proposal. (Co-fires with the Pool-proxy Upgraded event.)
PoolConfiguratorUpdatedContractUpgradeERRORUpgrades the implementation behind the PoolConfigurator proxy — the privileged contract that sets every reserve's risk parameters (caps, collateral config, freeze/pause). A malicious configurator could mis-set parameters market-wide, but it does not custody funds; each upgrade pages so the new code can be matched to a known governance proposal.
PriceOracleUpdatedContractUpgradeCRITICALSwaps the protocol's entire price-oracle contract. Pricing is resolved at runtime, so a swap instantly repoints all collateral valuation and liquidations — a malicious or buggy oracle is one of the fastest ways to drain a lending pool. Outside initial setup this is not a normal operation; any occurrence is a top-urgency, funds-at-risk event. (Routine per-asset feed changes use a different event.)
OwnershipTransferred (AddressesProvider)AdminChangeCRITICALOwnership of the PoolAddressesProvider — the market's master registry — moves to a new address. Its owner is the single key that can swap the Pool, the PoolConfigurator, the ACLManager, and the price oracle, i.e. it can trigger every one of the funds-at-risk events above. Transferring it is the protocol's top root-of-trust change. Ownership moves only as part of a governance migration (the legitimate owner is the governance pipeline), so any other occurrence is a top-urgency, funds-at-risk event.
ProxyCreatedContractUpgradeINFOThe AddressesProvider deploys a brand-new proxy for a registry slot. Fires only the first time a proxied component is registered, and co-fires with the meaningful event for that component (PoolUpdated / AddressSetAsProxy) which carries the real severity. On its own it grants no privileges and moves no funds, so it is recorded for completeness only.
AddressSetAsProxyContractUpgradeERRORUpgrades the implementation behind a registered proxy via the generic registry path — the same mechanism as PoolUpdated, but for a registry slot without its own dedicated setter. It swaps the executing code of a governance-controlled proxy, so it carries the same risk class as a Pool/Configurator upgrade and pages, to be matched against a known governance proposal.
ReserveFactorChanged (≤50%)ProtocolParameterChangeINFOThe reserve factor — the share of borrow interest diverted to the treasury rather than to suppliers — is changed for an asset. A routine economic knob with no fund-custody, collateral, or solvency reach. Normal values sit in a ~5–50% band, so changes within it are dashboard-only.
ReserveFactorChanged (>50%)ProtocolParameterChangeWARNINGThe new reserve factor exceeds 50%, outside the normal operating band — typically an asset being offboarded or a special-asset setting. Surfaced for confirmation that it is intended; it does not page.
FlashloanPremiumTotalUpdated (≤1%)ProtocolParameterChangeINFOThe total flash-loan premium (the fee on a flash loan) is changed. The lowest-stakes fee — it cannot reach funds or solvency (a high premium just makes flash loans expensive, a zero premium just makes them free; the loan must still be repaid in the same transaction). Normal values are a few bps, so changes within range are dashboard-only.
FlashloanPremiumTotalUpdated (>1%)ProtocolParameterChangeWARNINGThe new flash-loan premium exceeds 1% — roughly a tenfold jump over the 5–9 bps norm. There is no legitimate reason for such a value, so it is surfaced as a likely misconfiguration or tampering signal. It does not page.
FlashloanPremiumToProtocolUpdatedProtocolParameterChangeINFOChanges how the flash-loan premium is split between the treasury and suppliers (0–100%). The borrower's total fee is unchanged — only who receives it — so there is no fund or solvency reach. Recorded for completeness.
BridgeProtocolFeeUpdatedProtocolParameterChangeWARNINGThe bridge protocol fee is changed. The fee itself is a harmless bounded split, but it belongs to the dormant Portal / unbacked-mint subsystem, which has never been used on HyperLend. Any change is a canary that someone is configuring Portal, so it is surfaced — dashboard-only, never pages.
LiquidationProtocolFeeChanged (≤30%)ProtocolParameterChangeINFOThe protocol's cut of the liquidation bonus for an asset is changed, within the normal band. Routine; recorded dashboard-only.
LiquidationProtocolFeeChanged (>30%)ProtocolParameterChangeWARNINGThe new cut exceeds 30% — high enough to erode the liquidator's margin, which can stall liquidations and create bad-debt / solvency risk. Surfaced for review; the risk is gradual (not instant loss) and the parameter is bounded, so it is dashboard-only and does not page.
ATokenUpgradedContractUpgradeERRORUpgrades the aToken implementation for a reserve — the contract that custodies suppliers' deposits. A fund-bearing code swap, so it pages to be matched against a known governance proposal. Not CRITICAL (routine per-asset migration). The HYPE reserve tags product hype; other reserves are protocol-wide.
VariableDebtTokenUpgradedContractUpgradeERRORUpgrades the variable-debt-token implementation for a reserve — the contract that tracks borrowers' debt. Same fund-bearing risk class as the aToken upgrade; pages to be matched against a known governance proposal.
ReserveInterestRateStrategyChangedProtocolParameterChangeINFOPoints a reserve at a different interest-rate-strategy contract (the contract that computes borrow/supply rates from utilization). Affects only rates, not custody — a bad curve could grief with extreme rates but cannot move funds and is fully recoverable. On HyperLend (Aave v3.0.2) this is the sole rate-model-change signal; there is no V3.2 interest-rate-data event. Tracked on the dashboard, not paged.
ReservePaused (HYPE, paused)EmergencyActionCRITICALEmergency halt of the HYPE reserve — pausing blocks every interaction with the asset including withdrawals and liquidations, so the rated product goes fully dark and user funds are locked in place. Strictly more severe than a freeze (which still lets users exit). Paged immediately whether it is protective incident response or hostile. Never fired on HyperLend to date.
ReservePaused (HYPE, unpaused)EmergencyActionWARNINGThe HYPE reserve is taken out of pause and restored to normal operation — the recovery / all-clear signal. Dashboard, not paged.
ReservePaused (other reserves)EmergencyActionINFOA non-rated reserve in the market is paused/unpaused. Tracked on the dashboard only.
ReserveFrozen (HYPE, frozen)EmergencyActionERRORThe HYPE reserve is frozen — new supply and borrow are blocked, but users can still repay, withdraw, and be liquidated, so funds are not locked. The graceful asset-offboarding tool, one tier below a pause; material enough to page, but not critical because exits stay open.
ReserveFrozen (HYPE, unfrozen)EmergencyActionWARNINGThe HYPE reserve is unfrozen and re-enabled for new supply and borrow — the recovery signal. Dashboard, not paged.
ReserveFrozen (other reserves)EmergencyActionINFOA non-rated reserve is frozen/unfrozen. Tracked on the dashboard only (the freezes to date were all on non-rated reserves).
CollateralConfigurationChanged (HYPE, LTV→0 or liquidation-threshold cut ≥5%)ProtocolParameterChangeERRORThe solvency-critical collateral parameters of the HYPE reserve — loan-to-value (LTV), liquidation threshold (LT), and liquidation bonus. Two cases page: (1) a drop in the liquidation threshold, which makes existing positions immediately liquidatable and can trigger a wave of forced liquidations and bad debt — the genuinely dangerous direction; (2) LTV set to 0, which disables HYPE as new collateral (a protective de-risking signal). Evaluated against the previous on-chain value, so only a real transition pages.
CollateralConfigurationChanged (HYPE, other change)ProtocolParameterChangeWARNINGRoutine re-parameterisation of HYPE collateral — raising LTV/threshold, small adjustments, or liquidation-bonus tweaks. Material enough to record but not dangerous to existing positions, so it is tracked on the dashboard rather than paged.
CollateralConfigurationChanged (other reserves)ProtocolParameterChangeINFOCollateral config change on a non-rated reserve. Dashboard only.
BorrowCapChanged (HYPE, disabled)ProtocolParameterChangeWARNINGThe HYPE borrow cap is cut to the "disabled" sentinel (a cap of 1 token), effectively stopping new borrowing of the asset — a wind-down / de-risking signal. Surfaced on the dashboard for prominence (it correlates with freezes and collateral de-risking), but not paged: the cap only limits new borrowing and never affects existing positions or funds.
BorrowCapChanged (other)ProtocolParameterChangeINFORoutine borrow-cap adjustment, or any change on a non-rated reserve. Cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
SupplyCapChanged (HYPE, disabled)ProtocolParameterChangeWARNINGThe HYPE supply cap is cut to the "disabled" sentinel (a cap of 1 token), effectively stopping new deposits — a wind-down signal. Surfaced on the dashboard for prominence, but not paged: the cap only limits new deposits and never affects existing positions or funds.
SupplyCapChanged (other)ProtocolParameterChangeINFORoutine supply-cap adjustment, or any change on a non-rated reserve. Cannot affect existing positions or cause loss, so it is tracked on the dashboard, not paged.
OwnershipTransferred (ProxyAdmin)AdminChangeCRITICALOwnership of the ProxyAdmin — the contract that owns the transparent proxies and can upgrade their implementations — moves to a new address. Whoever owns it can swap the fund-bearing proxy code, i.e. upgrade the protocol; it is HyperLend's root upgrade key (the structural equivalent of Aave's governance executor). The legitimate owner is the governance pipeline; ownership moves only during a governance migration, so any other occurrence is a top-urgency, funds-at-risk event.
Upgraded (Pool)ContractUpgradeERRORThe implementation behind the main Pool proxy is swapped. The Pool holds all core lending logic (supply, borrow, liquidate, interest accrual), so a logic swap can change every accounting rule in the market — the single most powerful upgrade in the protocol. Twins with PoolUpdated from the PoolAddressesProvider (the registry-side announcement of the same swap). Pages at ERROR; CRITICAL is reserved for unstoppable-takeover changes (Safe threshold/module). Seen 4 times — all legitimate Aave-fork version upgrades.
AddedOwner (Safe)MultisigChangeERRORA new signer is added to one of HyperLend's admin Safes (Governance / Treasury / EmergencyAdmin), which sit atop the governance pipeline. Changing who can authorize the multisig's actions alters the protocol's trust set, so it pages to be confirmed against a known governance decision. Not CRITICAL: adding a signer without also lowering the threshold does not grant unilateral control.
RemovedOwner (Safe)MultisigChangeERRORA signer is removed from one of HyperLend's admin Safes (Governance / Treasury / EmergencyAdmin). The mirror of AddedOwner — it alters who controls the multisig (rotating out a compromised key, or a hostile actor pruning honest signers). Pages to be confirmed against a known governance decision; not CRITICAL on its own unless paired with a threshold drop (which pages CRITICAL separately).
ChangedThreshold (Safe)MultisigChangeCRITICALChanges how many signer approvals (M of N) the Safe requires. The threshold is the multisig's security — lowering it, especially to 1, collapses the Safe to effectively single-signer control, so one key (compromised, malicious, or coerced) can unilaterally execute anything it controls (here, the whole governance pipeline). An instant takeover-class change, so it pages at the top tier on any threshold change.
EnabledModule (Safe)MultisigChangeCRITICALA Safe module is enabled. Modules can execute transactions through the Safe bypassing the M-of-N signature check entirely — so a malicious or buggy module can move funds and drive the governance pipeline with zero signer approvals, regardless of the threshold. The most dangerous Safe change there is; never used on HyperLend, so a first-ever occurrence is highly anomalous and paged at the top tier.
DisabledModule (Safe)MultisigChangeERRORA previously-enabled Safe module is removed. Generally risk-reducing (it removes a signature-bypass path), so a tier below enabling one — but still an execution-surface change worth a look, since it could be benign cleanup or the hostile removal of a legitimate safety/recovery module. Never used on HyperLend.
ChangedGuard (Safe)MultisigChangeERRORA transaction guard is set, replaced, or removed on a HyperLend Safe. A guard hooks every Safe transaction (pre/post execution) and can revert any of them, so a malicious guard can freeze the multisig (DoS) and removing one strips a protective check — an execution-control change paged at ERROR. Never used on HyperLend.
ChangedFallbackHandler (Safe)MultisigChangeERRORThe fallback handler on a HyperLend Safe is set or replaced. The handler runs in the Safe's context for calls that match none of its own functions and can expand the Safe's callable surface — e.g. forging EIP-1271 "valid signature" responses so other contracts accept the Safe's approval without a real multisig vote. Quieter than a guard/module change and can't move funds itself, but still a callable-surface change paged at ERROR. Never used on HyperLend.

Kelp (kelp)

  • Chain(s): Ethereum
  • Products: rseth, plus protocol-wide for Timelock/Safe governance contracts
  • Contracts monitored:
    • rsETH Token — 0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7
    • LRTDepositPool — 0x036676389e48133B63a802f8635AD39E752D375D
    • LRTOracle — 0x349A73444b1a310BAe67ef67973022020d70020d
    • TimelockController — 0x49bD9989E31aD35B0A62c20BE86335196A3135B1
    • External Admin Safe (6/8) — 0xb3696a817D01C8623E66D156B6798291fa10a46d
    • ProxyAdmin — 0xb61e0E39b6d4030C36A176f576aaBE44BF59Dc78
    • LRTWithdrawalManager — 0x62De59c08eB5dAE4b7E6F7a8cAd3006d6965ec16
    • LRTUnstakingVault — 0xc66830e2667bc740c0bed9a71f18b14b8c8184ba
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Paused (rsETH)EmergencyActionCRITICALrsETH token paused
Unpaused (rsETH)EmergencyActionCRITICALrsETH token unpaused
CustodyAddressUpdated (rsETH)AdminChangeERRORrsETH custody address updated
UpdatedLRTConfig (rsETH)AdminChangeERRORrsETH LRT config updated
FrozenFundsRecovered (rsETH)EmergencyActionCRITICALFrozen funds recovered from/to addresses
UserTransfersBlocked (rsETH)EmergencyActionERRORUser transfers blocked until timestamp
MaxMintAmountPerDayUpdated (rsETH)ProtocolParameterChangeWARNINGrsETH max mint amount per day updated
Paused (LRTDepositPool)EmergencyActionCRITICALLRTDepositPool paused
Unpaused (LRTDepositPool)EmergencyActionCRITICALLRTDepositPool unpaused
MinAmountToDepositUpdatedProtocolParameterChangeINFOMin amount to deposit updated
MaxNodeDelegatorLimitUpdatedProtocolParameterChangeWARNINGMax node delegator limit updated
NodeDelegatorAddedinQueueAdminChangeWARNINGNode delegator added to queue
NodeDelegatorRemovedFromQueueAdminChangeWARNINGNode delegator removed from queue
UpdatedLRTConfig (LRTDepositPool)AdminChangeERRORLRTDepositPool LRT config updated
RsETHPriceDecrease (LRTOracle)EmergencyActionERRORrsETH price decreased
RsETHPriceBelowPeak (LRTOracle)EmergencyActionWARNINGrsETH price below peak
AssetPriceOracleUpdate (LRTOracle)ProtocolParameterChangeWARNINGAsset price oracle updated
PricePercentageLimitUpdate (LRTOracle)ProtocolParameterChangeWARNINGPrice percentage limit updated
MaxFeeMintAmountPerDayUpdated (LRTOracle)ProtocolParameterChangeWARNINGMax fee mint amount per day updated
Paused (LRTOracle)EmergencyActionCRITICALLRTOracle paused
Unpaused (LRTOracle)EmergencyActionCRITICALLRTOracle unpaused
UpdatedLRTConfig (LRTOracle)AdminChangeERRORLRTOracle LRT config updated
Paused (LRTWithdrawalManager)EmergencyActionCRITICALLRTWithdrawalManager paused
Unpaused (LRTWithdrawalManager)EmergencyActionCRITICALLRTWithdrawalManager unpaused
EmergencyWithdrawFromAaveEmergencyActionCRITICALEmergency withdrawal from Aave
InstantWithdrawalFeeUpdatedProtocolParameterChangeWARNINGInstant withdrawal fee updated
InstantWithdrawalFeeRecipientUpdatedProtocolParameterChangeWARNINGInstant withdrawal fee recipient updated
InstantWithdrawalEnabledUpdatedProtocolParameterChangeWARNINGInstant withdrawal enabled/disabled for asset
WithdrawalDelayBlocksUpdatedProtocolParameterChangeWARNINGWithdrawal delay blocks updated
MinAmountToWithdrawUpdatedProtocolParameterChangeINFOMin amount to withdraw updated
AaveIntegrationConfiguredProtocolParameterChangeWARNINGAave integration configured
AaveIntegrationEnabledProtocolParameterChangeWARNINGAave integration enabled/disabled
UpdatedLRTConfig (LRTWithdrawalManager)AdminChangeERRORLRTWithdrawalManager LRT config updated
Paused (LRTUnstakingVault)EmergencyActionERRORLRTUnstakingVault paused
Unpaused (LRTUnstakingVault)EmergencyActionERRORLRTUnstakingVault unpaused
MaxUncompletedWithdrawalCountSetProtocolParameterChangeWARNINGMax uncompleted withdrawal count set
QueuedWithdrawalsBufferUpdatedProtocolParameterChangeINFOQueued withdrawals buffer updated
UpdatedLRTConfig (LRTUnstakingVault)AdminChangeERRORLRTUnstakingVault LRT config updated
MinDelayChange (Timelock, decreased)TimelockChangeERRORTimelock min delay decreased (higher risk)
MinDelayChange (Timelock, increased)TimelockChangeWARNINGTimelock min delay increased/unchanged
RoleGranted (Timelock)RoleChangeWARNINGTimelock role granted
RoleRevoked (Timelock)RoleChangeWARNINGTimelock role revoked
RoleAdminChanged (Timelock)RoleChangeERRORTimelock role admin changed
CallScheduled (Timelock)TimelockChangeINFOTimelock call scheduled
CallExecuted (Timelock)TimelockChangeINFOTimelock call executed
Cancelled (Timelock)TimelockChangeINFOTimelock call cancelled
AddedOwner (Safe)MultisigChangeWARNINGOwner added to External Admin Safe
RemovedOwner (Safe)MultisigChangeWARNINGOwner removed from External Admin Safe
ChangedThreshold (Safe)MultisigChangeWARNINGExternal Admin Safe threshold changed
EnabledModule (Safe)MultisigChangeWARNINGModule enabled on External Admin Safe
DisabledModule (Safe)MultisigChangeWARNINGModule disabled on External Admin Safe
ChangedGuard (Safe)MultisigChangeWARNINGGuard changed on External Admin Safe
ChangedFallbackHandler (Safe)MultisigChangeWARNINGFallback handler changed on External Admin Safe

Lido — earnETH (lido-finance)

  • Chain(s): Ethereum
  • Products: earneth. The Mellow-global Factories and the seven governing Safes are shared with earnUSD, so their events are emitted protocol-wide (product: "") and appear in both Lido Earn sections
  • Contracts monitored:
    • Vault — 0x6a37725ca7f4CE81c004c955f7280d5C704a249e
    • ShareManager (earnETH share token) — 0xBBFC8683C8fE8cF73777feDE7ab9574935fea0A4
    • Oracle — 0xAda1f4c24603aB2fe5aBd35BCD12370e98A20358
    • OracleSubmitter — 0xFbD83f7C531D35D99392a5A20bb5F1e75E97076e
    • FeeManager — 0xed4Fac879eE86F3aB0101993A3713e7cAA0488E1
    • RiskManager — 0xa2a4C4ecE27229aF51c546844AB752824Ccb557e
    • TimelockController — 0x363Ba8843d06BA5968f55C26aB055162eDd62189
    • Verifiers (the curator's permission set):
      • Verifier 0 — 0xBc46B79d79fCac1F4232D4Da1BA31aCED0AABFE0
      • Verifier 1 — 0xc0FC0B74923A80Af21B1E49633cAA309f432140F
    • Redemption queues:
      • RedeemQueue (wstETH) — 0x095bFAca9f1c6F2B063Cd67C6d6bfcd0c3aaB7b4
      • SyncRedeemQueue (wstETH) — 0xB5984D87d21C4375d18972fd546b688BD4Fc1f0A
    • Instant-deposit queues:
      • SyncDepositQueue (ETH) — 0xb99394f8b95d426Cb2F013B857C74aCC924b20D5
      • SyncDepositQueue (WETH) — 0xCe6C2505fEF74d2dE10FCF1d534cB73eCc837976
      • SyncDepositQueue (wstETH) — 0xECD2Bfe725fa14f5Ed86e9bDcc0eA4b34A4ed522
      • SyncDepositQueue (GG) — 0x2792004b709E3E88b8FCCb06c3C5e1A6dff0EC2B
      • SyncDepositQueue (strETH) — 0xA4F23f56442C01a478af20fe06b9F5f8f05aDD96
      • SyncDepositQueue (DVstETH) — 0xA80f247b92C79740b0610b754403D5cb0bf216b5
    • Subvaults and async deposit queues (monitored for proxy upgrades and upgrade-authority changes only):
      • Subvault 0 — 0xC5901C2481ca9C26398A9Da258b13717894bfebF
      • Subvault 1 — 0x7F515C80fA4C1FCFF34F0329141A9C3b20468FE5
      • DepositQueue (ETH) — 0x1db7094Ef0D994B0b62f6Cd67dB801ad194999A8
      • DepositQueue (WETH) — 0x3Fc48660d02e59fBedD0a5Cc18a5580D1f8dD6A4
      • DepositQueue (wstETH) — 0xe39EED9A454C4918F8d0682062777cB251cd513F
      • DepositQueue (GG) — 0x411172F1E5310d03b38128F2a294F2e33c691B30
      • DepositQueue (strETH) — 0x268ea1cc674cdaE200c4609E7b09d03Dc618E663
      • DepositQueue (DVstETH) — 0x4bDd2Ea1E20acb13f2758190c92a84175107A86f
    • Shared Earn governance (also covers earnUSD) — Mellow-global Factories:
      • DepositQueue Factory — 0xBB92A7B9695750e1234BaB18F83b73686dd09854
      • RedeemQueue Factory — 0xfe76b5fd238553D65Ce6dd0A572C0fda629F8421
      • Subvault Factory — 0x75FE0d73d3C64cdC1C6449D9F977Be6857c4d011
      • Verifier Factory — 0x04B30b1e98950e6A13550d84e991bE0d734C2c61
    • Shared Earn governance (also covers earnUSD) — Safes:
      • Mellow Upgrade Authority (Safe) — 0x81698f87C6482bF1ce9bFcfC0F103C4A0Adf0Af0
      • LazyVaultAdmin (Safe) — 0x0Dd73341d6158a72b4D224541f1094188f57076E
      • Curator (Safe) — 0xe5abcc40196174Ae0d12153dE286F0D8E401769d
      • OracleUpdater (Safe) — 0x93a797643d74fC81e7A51F3f84a9D78F930435D1
      • Lido Pauser (Safe) — 0xA916fD5252160A7E56A6405741De76dc0Da5A0Cd
      • Mellow Pauser (Safe) — 0x6E887aF318c6b29CEE42Ea28953Bd0BAdb3cE638
      • ActiveVaultAdmin (Safe) — 0x982aB69785f5329BB59c36B19CBd4865353fEf10
    • Every proxy listed above also has its own dedicated OpenZeppelin v5 ProxyAdmin contract, each monitored for ownership transfer — 43 across both Earn products and the four Factories, all currently owned by the Mellow Upgrade Authority Safe
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (Vault — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key of the Vault. The Vault is the single access-control registry for the whole earnETH stack — the share token, oracle, risk manager, verifiers and every queue all check permissions against it — so this key can hand out every other privilege in the product.
RoleGranted (Vault — pause / oracle / queue-composition roles)RoleChangeERRORA new address gains one of the roles that can freeze the share token, blacklist accounts, pause a queue, replace a verifier's permission root, set a hook, create a queue or subvault, write oracle prices, or loosen the oracle's price checks.
RoleGranted (Vault — other roles)RoleChangeWARNINGA new address gains a bounded operational role — deposit/subvault caps, balance accounting, or moving assets between the vault and its subvaults.
RoleRevoked (Vault — DEFAULT_ADMIN)RoleChangeCRITICALA root admin is removed from the Vault registry. If none remains, no role can ever be granted or revoked again, including to remove a compromised holder.
RoleRevoked (Vault — pause / oracle / queue-composition roles)RoleChangeERRORA holder loses one of the emergency or oracle roles. If it was the last holder, the pre-staged freeze, queue pause or curator-revocation operations become unexecutable and nobody can halt the product.
RoleRevoked (Vault — other roles)RoleChangeWARNINGA bounded operational role is removed — generally risk-reducing.
RoleAdded (Vault)RoleChangeERRORA role in the Vault registry goes from having no holders to having one. Seventeen role classes normally have no holder at all — including account blacklisting, hook setting, and queue and subvault creation — so this is the signal that a whole class of otherwise-impossible privileged action just became possible.
RoleRemoved (Vault — pause / oracle / queue-composition roles)RoleChangeERRORAn emergency or oracle role loses its last holder, retiring that capability entirely; the resulting state looks identical to a healthy protocol but incident response is gone.
RoleRemoved (Vault — other roles)RoleChangeWARNINGA bounded operational role loses its last holder — the expected tail of a temporary grant-use-revoke maintenance sequence.
RoleAdminChanged (Vault)RoleChangeERRORRe-points which role administers another role. No code path in the deployed Vault implementation can do this, so a firing implies the implementation changed underneath the monitor.
SetQueueStatus (redeem queue paused)EmergencyActionCRITICALOne of the redemption queues is paused, closing a user exit path. Also pre-staged inside the TimelockController as a permanently-executable operation, so it can co-fire with CallExecuted in the same transaction.
SetQueueStatus (deposit queue paused)EmergencyActionERROROne deposit queue is paused, blocking new money into that asset while existing holders can still exit. Six earnETH instant-deposit queues were held paused for four weeks in 2026.
SetQueueStatus (queue unpaused)EmergencyActionWARNINGA previously paused queue is reopened — the recovery signal.
QueueCreated (Vault)ContractUpgradeWARNINGA new deposit or redeem queue is registered on the vault — a new mint or redeem path for user funds, constrained to a queue implementation the corresponding Mellow Factory has already accepted.
QueueRemoved (Vault)ContractUpgradeWARNINGA queue is de-registered. It cannot strand funds: removal reverts unless the queue reports no outstanding user claims.
QueueLimitSet (Vault)ProtocolParameterChangeINFOChanges the cap on the number of queues the vault may hold. A count, not a value, so there is no fund exposure.
SubvaultCreated (Vault)ContractUpgradeWARNINGA new subvault is registered — a new destination the curator can push user assets into, arriving with its own verifier.
SubvaultDisconnected (Vault)EmergencyActionERRORA subvault is removed from the vault's set, after which assets held there stop being reachable by the pull path used to fund redemptions.
SubvaultReconnected (Vault)ContractUpgradeWARNINGA previously disconnected subvault is restored after its verifier is re-validated — the all-clear pairing.
CustomHookSet (Vault — hook set)ContractUpgradeCRITICALInstalls a hook for one specific queue. Hooks are invoked with delegatecall, so the hook's code runs in the Vault's own storage context and can rewrite the access-control registry and share accounting — the same class of change as an implementation upgrade, not a parameter tweak.
CustomHookSet (Vault — hook cleared)ContractUpgradeERRORThe queue's custom hook is removed and it falls back to the vault-wide default hook.
DefaultHookSet (Vault — hook set)ContractUpgradeCRITICALInstalls the vault-wide default deposit or redeem hook, applying to every queue without a custom hook. Same delegatecall mechanism as above, so it runs in the Vault's storage context.
DefaultHookSet (Vault — hook cleared)ContractUpgradeERRORThe vault-wide default hook is removed.
SetFlags (ShareManager — exits blocked)EmergencyActionCRITICALBurn or transfer is paused, or globalLockup is set to a future time. globalLockup is an absolute timestamp, not a duration, and is enforced on every path that moves shares away from a holder — so it blocks redemptions as well as transfers. The operation staged in the timelock sets it to uint32.max (year 2106). It is reversible, but asymmetrically: freezing executes an already-armed operation with one signature, while unfreezing needs a fresh proposal from a 5-of-8 Safe and no unfreeze operation is staged.
SetFlags (ShareManager — entry gated)EmergencyActionERRORMinting is paused or a whitelist is switched on, so new deposits are gated while existing holders can still transfer and redeem.
SetFlags (ShareManager — all flags clear)EmergencyActionWARNINGThe share-token flag bitmask is rewritten to fully open — the all-clear state.
SetAccountInfo (ShareManager — blacklisted)EmergencyActionERROROne account is blacklisted on the share token, after which it can neither transfer nor burn — meaning it cannot redeem.
SetAccountInfo (ShareManager — other)EmergencyActionWARNINGOne account's deposit or transfer permission is changed without blacklisting it.
SetWhitelistMerkleRoot (ShareManager — root set)ProtocolParameterChangeWARNINGSets the deposit-whitelist root on the share token. It gates the mint path only and cannot block an exit, and it is inert unless the whitelist flag is also on. The root's contents are off-chain, so who is on the list is not observable.
SetWhitelistMerkleRoot (ShareManager — root cleared)ProtocolParameterChangeINFOThe deposit whitelist root is cleared, removing the deposit gate.
ReportAccepted (Oracle)EmergencyActionERRORA NAV price report that failed the oracle's own suspicion check is manually force-accepted and applied to every queue. Note it also fires benignly when a new asset is onboarded — the first report for any asset is always flagged suspicious, so an accept is a required step in listing an asset — meaning this can fire on routine asset additions as well as on a genuine price override.
SecurityParamsSet (Oracle — guard rails loosened)ProtocolParameterChangeERRORThe oracle's price-validation guard rails are widened: a larger permitted deviation, a shorter report timeout, or a longer redeem interval. These checks are the only on-chain protection between a compromised rate submitter and every holder's share value. Compared against the previous on-chain values. On earnETH the bounds have twice been opened to 100% and 200% with a one-second timeout, then restored.
SecurityParamsSet (Oracle — tightened or unchanged)ProtocolParameterChangeWARNINGThe guard rails are narrowed or left effectively unchanged — the conservative direction.
SupportedAssetsAdded (Oracle)ProtocolParameterChangeWARNINGThe oracle starts pricing additional assets into NAV. A bad price on any supported asset moves the whole share price, so the set of priced assets is a real risk surface.
SupportedAssetsRemoved (Oracle)ProtocolParameterChangeWARNINGThe oracle stops pricing assets. Guarded — it reverts if the asset still has queues or a non-zero vault balance — so it cannot orphan user funds.
RoleGranted (OracleSubmitter — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root key of the OracleSubmitter's own registry, the second permission layer that decides who may move the published exchange rate.
RoleGranted (OracleSubmitter — SUBMIT_REPORTS / ACCEPT_REPORT)RoleChangeERRORA new address gains the ability to push NAV prices into the oracle, or to force-accept a report the oracle flagged as suspicious. Either is a write path to the value of every holder's shares.
RoleGranted (OracleSubmitter — other roles)RoleChangeWARNINGA role with no specific mapping on this contract is granted.
RoleRevoked (OracleSubmitter — root admin or last rate submitter)RoleChangeERRORThe registry's root admin is removed, or the last remaining rate submitter is. Losing the last submitter silently stops NAV updates: the published rate goes stale and, past the oracle timeout, the instant deposit and redeem paths stop accepting it.
RoleRevoked (OracleSubmitter — other roles)RoleChangeWARNINGA submitter or report-acceptor is rotated out while others remain.
RoleAdminChanged (OracleSubmitter)RoleChangeERRORRe-points which role administers another on the submitter. The contract is not upgradeable and has no code path that does this, so a firing is structurally anomalous.
SetFees (FeeManager — outside the demonstrated range)ProtocolParameterChangeERRORAny deposit or redeem fee is switched on, or the performance fee exceeds 10% or the protocol fee 1%. The contract permits a total fee of 100%, and fees have not always been zero here: a 10% performance plus 1% protocol fee ran on both Earn products for three weeks in July 2026.
SetFees (FeeManager — all four rates zero)ProtocolParameterChangeINFOAll four fee rates are set to zero — fees are off.
SetFees (FeeManager — within the demonstrated range)ProtocolParameterChangeWARNINGA non-zero performance or protocol fee is set inside the range already used in production, with no deposit or redeem fee.
SetFeeRecipient (FeeManager)AdminChangeERRORRe-points the address that receives freshly minted fee shares on every NAV report, and which is exempt from the redeem fee.
OwnershipTransferred (FeeManager — real transfer)AdminChangeCRITICALOwnership of the FeeManager moves to a new address. The owner can set a 100% fee and re-point the recipient, so this is direct authority over value diverted from holders.
OwnershipTransferred (FeeManager — initial assignment)AdminChangeINFOThe deploy-time log where ownership is first assigned from the zero address.
SetVaultLimit (RiskManager — at or below the live balance)ProtocolParameterChangeERRORThe vault-wide deposit cap is set to a value at or below the current balance, which halts all deposits immediately. The live balance is read in-handler to distinguish this from a routine cap change.
SetVaultLimit (RiskManager — above the live balance)ProtocolParameterChangeWARNINGThe vault-wide deposit cap is changed while leaving headroom for new deposits.
SetSubvaultLimit (RiskManager)ProtocolParameterChangeWARNINGCaps how much a single subvault may hold, bounded by the vault-level limit.
AllowSubvaultAssets (RiskManager)ProtocolParameterChangeWARNINGWidens the set of assets a subvault may hold. Doubly constrained: the asset must already be oracle-priced and the curator still needs a verifier proof to move it.
DisallowSubvaultAssets (RiskManager)ProtocolParameterChangeWARNINGNarrows a subvault's allowed asset set — the risk-reducing pairing.
CallScheduled (TimelockController)TimelockChangeERRORAn operation is staged in the product's timelock. The timelock's minimum delay is zero, so a scheduled operation is immediately executable — "timelock" here is propose/execute role separation across two different Safes, not a waiting period. Scheduling therefore means armed, and the message decodes the target and function.
CallExecuted (TimelockController — freeze, curator revocation or queue pause)EmergencyActionCRITICALA staged operation that freezes the share token, clears a verifier's permission root, or pauses a queue has actually been fired. Each timelock permanently holds such operations in state Ready — sixteen on earnETH, none ever executed — including a full mint, burn and transfer freeze, and the executor role includes a 1-of-8 Safe.
CallExecuted (TimelockController — other payload)EmergencyActionERRORA staged timelock operation with some other payload has been executed; the message decodes the target and function.
Cancelled (TimelockController)TimelockChangeERRORA pending timelock operation is cancelled. Because the pending operations are the emergency plan itself, cancelling one silently disarms a pre-staged freeze, curator revocation or queue pause.
MinDelayChange (TimelockController — decrease)TimelockChangeERRORThe timelock's minimum delay is reduced. The current value is already zero, so a decrease is not possible from here without an implementation change.
MinDelayChange (TimelockController — increase)TimelockChangeWARNINGThe minimum delay is raised, introducing a real waiting period where there is currently none.
RoleGranted (TimelockController — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the timelock's root admin, which can hand out the proposer, canceller and executor roles — full control over both the staging and the firing of the pre-staged emergency operations.
RoleGranted (TimelockController — EXECUTOR / PROPOSER)RoleChangeERRORA new address gains the ability to fire any ready operation, or to stage arbitrary new privileged calls. With the minimum delay at zero, anything staged is immediately fireable.
RoleGranted (TimelockController — other roles)RoleChangeWARNINGAnother timelock role, such as canceller, is granted.
RoleRevoked (TimelockController — root admin or last executor)RoleChangeERRORThe timelock's root admin is removed, or the last known executor is. Without an executor the pre-staged emergency operations stay permanently ready but unfireable — the kill switch is present and dead.
RoleRevoked (TimelockController — other roles)RoleChangeWARNINGA proposer, canceller or one of several executors is removed.
RoleAdminChanged (TimelockController)RoleChangeERRORRe-points which role administers another on the timelock. No code path in OpenZeppelin's TimelockController does this, so a firing is structurally anomalous.
SetMerkleRoot (Verifier — root cleared)EmergencyActionERRORA verifier's permission root is cleared to zero, revoking every call the curator was allowed to make against subvault assets. This is the pre-staged emergency revocation of curator powers.
SetMerkleRoot (Verifier — root replaced)ProtocolParameterChangeERRORA verifier's permission root is replaced with a different one, changing the set of calls the curator may execute. Only the 32-byte root is on-chain and the tree's contents are off-chain, so there is no way to tell from the event whether the curator's powers widened or narrowed.
AllowCall (Verifier)RoleChangeERRORWrites an explicit caller-target-selector allowance on a verifier that bypasses the merkle tree entirely. The one historical use of this granted a raw wstETH transfer permission.
DisallowCall (Verifier)RoleChangeWARNINGRemoves an explicit verifier allowance — the risk-reducing pairing.
SyncDepositParamsSet (SyncDepositQueue — materially costly)ProtocolParameterChangeERRORAn instant-deposit queue's penalty reaches 0.5% or its maximum accepted oracle-price age exceeds 48 hours. The penalty is a direct haircut on the shares an instant depositor receives and the contract permits up to 50%; the max-age setting governs how stale a price the instant path will accept, against an oracle reporting roughly every 20 hours.
SyncDepositParamsSet (SyncDepositQueue — other change)ProtocolParameterChangeWARNINGAn instant-deposit queue's penalty or oracle max-age is changed to a level that is not materially costly to depositors. This includes values above anything used in production so far — the alert records that separately, but a penalty of a few hundredths of a percent is not treated as urgent.
SyncRedeemParamsSet (SyncRedeemQueue — materially costly)ProtocolParameterChangeERRORThe instant-exit path gains a penalty of 0.25% or more (a direct haircut on instant exits, permitted up to 50%), or is set to accept an oracle price older than 48 hours. The role needed to call this has never been granted on either Earn vault.
SyncRedeemParamsSet (SyncRedeemQueue — other change)ProtocolParameterChangeWARNINGThe instant-exit parameters are changed to a level that is not materially costly, including a reduction in daily exit capacity. The instant path is capped at a small fraction of supply per day and the standard redemption queue carries no penalty, so small changes here are recorded rather than treated as urgent.
Upgraded (any earnETH proxy)ContractUpgradeCRITICALThe implementation behind one of the product's proxies is replaced. A Vault or ShareManager upgrade can rewrite the access-control registry, the share accounting and the pause logic in a single transaction, and the upgrade authority is a 5-of-8 Safe acting with no delay. Monitored on all 43 Earn proxies; the proxies' own AdminChanged is not monitored because the OpenZeppelin v5 proxy admin is immutable and can only fire at construction, which is why the ProxyAdmin ownership event below is the substitute signal.
OwnershipTransferred (ProxyAdmin — real transfer)AdminChangeCRITICALUpgrade authority over one specific contract moves to a new owner. Each proxy has its own dedicated ProxyAdmin, and that ProxyAdmin is the only way to change the proxy's implementation, so this is the sole on-chain signal that the power to upgrade a given contract changed hands.
OwnershipTransferred (ProxyAdmin — initial assignment)AdminChangeINFOThe deploy-time log where a ProxyAdmin's ownership is first assigned from the zero address.
AcceptProposedImplementation (Factory — shared Earn governance)ContractUpgradeERRORThe Factory owner admits a new implementation into the set that may be instantiated for queues, subvaults or verifiers. It does not upgrade anything already deployed, but it is a reliable precursor: the implementation accepted on 2026-07-21 is the one both new instant-redeem queues were deployed from two days later.
ProposeImplementation (Factory — shared Earn governance)ContractUpgradeINFOAn implementation address is proposed to a Factory. The function is permissionless — it has no access control at all, so anyone can propose any address — and a proposal grants nothing until the owner accepts it via the event above. Recorded so a stranger cannot generate noise.
SetBlacklistStatus (Factory — shared Earn governance)ProtocolParameterChangeWARNINGA Factory implementation version is marked as blacklisted, or unmarked. It affects future deployments only; instances already deployed are untouched.
OwnershipTransferred (Factory — real transfer, shared Earn governance)AdminChangeCRITICALOwnership of one of the four Mellow-global Factories moves. The owner gates which implementations either Earn product can ever deploy.
OwnershipTransferred (Factory — initial assignment, shared Earn governance)AdminChangeINFOThe deploy-time log where a Factory's ownership is first assigned from the zero address.
AddedOwner (Safe — Upgrade Authority, LazyVaultAdmin, Curator, OracleUpdater, Lido Pauser, Mellow Pauser)MultisigChangeERRORA new signer joins one of the Safes that hold upgrade authority, vault root admin, curator keys, the rate-submitter role, or the timelock executor role. On the Mellow Pauser Safe, which is 1-of-8, each new owner is one more party able to fire the pre-staged freeze on both products alone.
AddedOwner (Safe — ActiveVaultAdmin)MultisigChangeWARNINGA new signer joins the Safe that holds only the deposit-cap and balance-accounting roles.
RemovedOwner (Safe — Upgrade Authority, LazyVaultAdmin, Curator, OracleUpdater, Lido Pauser, Mellow Pauser)MultisigChangeERRORA signer leaves one of the high-authority Safes, concentrating control among fewer parties at an unchanged threshold.
RemovedOwner (Safe — ActiveVaultAdmin)MultisigChangeWARNINGA signer leaves the limits-only Safe.
ChangedThreshold (Safe — Upgrade Authority or LazyVaultAdmin, lowered)MultisigChangeCRITICALThe signature requirement is lowered on one of the two root-of-trust Safes — the one owning all 43 ProxyAdmins and all four Factories, or the one holding root admin on both vaults and both oracle submitters. Fewer signatures for total control. Compared against the previous on-chain value.
ChangedThreshold (Safe — root-of-trust raised, or any other Safe lowered)MultisigChangeERRORA root-of-trust Safe raises its requirement, or one of the asset, oracle, pauser or limits Safes lowers its own.
ChangedThreshold (Safe — any other Safe raised)MultisigChangeWARNINGA non-root Safe raises its signature requirement — the conservative direction.
EnabledModule (Safe)MultisigChangeCRITICALA module is enabled on a governing Safe. A module can execute transactions from that Safe with no signatures at all, bypassing the signing threshold entirely. No module has ever been enabled on any of the seven Safes.
DisabledModule (Safe)MultisigChangeWARNINGA module is disabled, removing a signature-bypass path.
ChangedGuard (Safe)MultisigChangeERRORA transaction guard is installed on or removed from a governing Safe. A guard's pre-execution hook can revert unconditionally, which would brick the pauser Safes and with them the ability to fire the emergency operations.
ChangedFallbackHandler (Safe)MultisigChangeWARNINGA governing Safe's fallback handler is changed. The handler is invoked with call rather than delegatecall, so it cannot write Safe storage; the exposure is signature-validation spoofing.

Lido — earnUSD (lido-finance)

  • Chain(s): Ethereum
  • Products: earnusd. The Mellow-global Factories and the seven governing Safes are shared with earnETH, so their events are emitted protocol-wide (product: "") and appear in both Lido Earn sections
  • Contracts monitored:
    • Vault — 0x014e6DA8F283C4aF65B2AA0f201438680A004452
    • ShareManager (earnUSD share token) — 0x4Ce1ac8F43E0E5BD7A346A98aF777bF8fbeA1981
    • Oracle — 0x827044735c9708a2cf850e7Ea37EBa43bc786028
    • OracleSubmitter — 0xB105DaEeFEb1390ce49172c99E3e12C607367156
    • FeeManager — 0x72fa23f40e08eB9E45953233b2Dd9665E347e8Dc
    • RiskManager — 0x7b1e06C46d4510277FC37a37bBeF65F3794fdDE4
    • TimelockController — 0xdA6Da82DFF8cD29D828e4775Cc003f504A968845
    • Verifiers (the curator's permission set):
      • Verifier 0 — 0xB65A8E0937c77a76C3f4F86A1110f81A299CB481
      • Verifier 1 — 0xBEa44cd2f58f3CC6f37aaeC82A2dee57911d0b36
    • Redemption queues:
      • RedeemQueue (USDC) — 0x9e36A74FE278906a76e7615263e46a83fC40c47F
      • SyncRedeemQueue (USDC) — 0xE0eee7e956A94BD00546d9CA07e5012F11A5059d
    • Instant-deposit queues:
      • SyncDepositQueue (USDC) — 0xf6AFAf6afcAe116dD37A779D50fE6c5fa6f8C8f5
      • SyncDepositQueue (USDT) — 0x534d0bEb82C47cf703BFb9E959297658b65Ec8E9
    • Subvaults and async deposit queues (monitored for proxy upgrades and upgrade-authority changes only):
      • Subvault 0 — 0x77B9441d5Cb89fca435190A9B6D108ad4B00ccFd
      • Subvault 1 — 0xe3e0111e31FA3AEB7A528128F2DbAe1C15397242
      • DepositQueue (USDC) — 0xC75E7E73B25fEa8bB23EB55CC48BA55067b5be76
      • DepositQueue (USDT) — 0xEeC5041c47Cba1e31321AC6941Bf09Ad60645B73
      • DepositQueue (USDe) — 0xeEc37568b01e0C4d5028501A49E024B475E2D7cA
    • Shared Earn governance (also covers earnETH) — Mellow-global Factories:
      • DepositQueue Factory — 0xBB92A7B9695750e1234BaB18F83b73686dd09854
      • RedeemQueue Factory — 0xfe76b5fd238553D65Ce6dd0A572C0fda629F8421
      • Subvault Factory — 0x75FE0d73d3C64cdC1C6449D9F977Be6857c4d011
      • Verifier Factory — 0x04B30b1e98950e6A13550d84e991bE0d734C2c61
    • Shared Earn governance (also covers earnETH) — Safes:
      • Mellow Upgrade Authority (Safe) — 0x81698f87C6482bF1ce9bFcfC0F103C4A0Adf0Af0
      • LazyVaultAdmin (Safe) — 0x0Dd73341d6158a72b4D224541f1094188f57076E
      • Curator (Safe) — 0xe5abcc40196174Ae0d12153dE286F0D8E401769d
      • OracleUpdater (Safe) — 0x93a797643d74fC81e7A51F3f84a9D78F930435D1
      • Lido Pauser (Safe) — 0xA916fD5252160A7E56A6405741De76dc0Da5A0Cd
      • Mellow Pauser (Safe) — 0x6E887aF318c6b29CEE42Ea28953Bd0BAdb3cE638
      • ActiveVaultAdmin (Safe) — 0x982aB69785f5329BB59c36B19CBd4865353fEf10
    • Every proxy listed above also has its own dedicated OpenZeppelin v5 ProxyAdmin contract, each monitored for ownership transfer — 43 across both Earn products and the four Factories, all currently owned by the Mellow Upgrade Authority Safe
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (Vault — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key of the Vault. The Vault is the single access-control registry for the whole earnUSD stack — the share token, oracle, risk manager, verifiers and every queue all check permissions against it — so this key can hand out every other privilege in the product.
RoleGranted (Vault — pause / oracle / queue-composition roles)RoleChangeERRORA new address gains one of the roles that can freeze the share token, blacklist accounts, pause a queue, replace a verifier's permission root, set a hook, create a queue or subvault, write oracle prices, or loosen the oracle's price checks.
RoleGranted (Vault — other roles)RoleChangeWARNINGA new address gains a bounded operational role — deposit/subvault caps, balance accounting, or moving assets between the vault and its subvaults.
RoleRevoked (Vault — DEFAULT_ADMIN)RoleChangeCRITICALA root admin is removed from the Vault registry. If none remains, no role can ever be granted or revoked again, including to remove a compromised holder.
RoleRevoked (Vault — pause / oracle / queue-composition roles)RoleChangeERRORA holder loses one of the emergency or oracle roles. If it was the last holder, the pre-staged freeze, queue pause or curator-revocation operations become unexecutable and nobody can halt the product.
RoleRevoked (Vault — other roles)RoleChangeWARNINGA bounded operational role is removed — generally risk-reducing.
RoleAdded (Vault)RoleChangeERRORA role in the Vault registry goes from having no holders to having one. Seventeen role classes normally have no holder at all — including account blacklisting, hook setting, and queue and subvault creation — so this is the signal that a whole class of otherwise-impossible privileged action just became possible.
RoleRemoved (Vault — pause / oracle / queue-composition roles)RoleChangeERRORAn emergency or oracle role loses its last holder, retiring that capability entirely; the resulting state looks identical to a healthy protocol but incident response is gone.
RoleRemoved (Vault — other roles)RoleChangeWARNINGA bounded operational role loses its last holder — the expected tail of a temporary grant-use-revoke maintenance sequence.
RoleAdminChanged (Vault)RoleChangeERRORRe-points which role administers another role. No code path in the deployed Vault implementation can do this, so a firing implies the implementation changed underneath the monitor.
SetQueueStatus (redeem queue paused)EmergencyActionCRITICALOne of the redemption queues is paused, closing a user exit path. Also pre-staged inside the TimelockController as a permanently-executable operation, so it can co-fire with CallExecuted in the same transaction.
SetQueueStatus (deposit queue paused)EmergencyActionERROROne deposit queue is paused, blocking new money into that asset while existing holders can still exit.
SetQueueStatus (queue unpaused)EmergencyActionWARNINGA previously paused queue is reopened — the recovery signal.
QueueCreated (Vault)ContractUpgradeWARNINGA new deposit or redeem queue is registered on the vault — a new mint or redeem path for user funds, constrained to a queue implementation the corresponding Mellow Factory has already accepted.
QueueRemoved (Vault)ContractUpgradeWARNINGA queue is de-registered. It cannot strand funds: removal reverts unless the queue reports no outstanding user claims.
QueueLimitSet (Vault)ProtocolParameterChangeINFOChanges the cap on the number of queues the vault may hold. A count, not a value, so there is no fund exposure.
SubvaultCreated (Vault)ContractUpgradeWARNINGA new subvault is registered — a new destination the curator can push user assets into, arriving with its own verifier.
SubvaultDisconnected (Vault)EmergencyActionERRORA subvault is removed from the vault's set, after which assets held there stop being reachable by the pull path used to fund redemptions.
SubvaultReconnected (Vault)ContractUpgradeWARNINGA previously disconnected subvault is restored after its verifier is re-validated — the all-clear pairing.
CustomHookSet (Vault — hook set)ContractUpgradeCRITICALInstalls a hook for one specific queue. Hooks are invoked with delegatecall, so the hook's code runs in the Vault's own storage context and can rewrite the access-control registry and share accounting — the same class of change as an implementation upgrade, not a parameter tweak.
CustomHookSet (Vault — hook cleared)ContractUpgradeERRORThe queue's custom hook is removed and it falls back to the vault-wide default hook.
DefaultHookSet (Vault — hook set)ContractUpgradeCRITICALInstalls the vault-wide default deposit or redeem hook, applying to every queue without a custom hook. Same delegatecall mechanism as above, so it runs in the Vault's storage context.
DefaultHookSet (Vault — hook cleared)ContractUpgradeERRORThe vault-wide default hook is removed.
SetFlags (ShareManager — exits blocked)EmergencyActionCRITICALBurn or transfer is paused, or globalLockup is set to a future time. globalLockup is an absolute timestamp, not a duration, and is enforced on every path that moves shares away from a holder — so it blocks redemptions as well as transfers. The operation staged in the timelock sets it to uint32.max (year 2106). It is reversible, but asymmetrically: freezing executes an already-armed operation with one signature, while unfreezing needs a fresh proposal from a 5-of-8 Safe and no unfreeze operation is staged.
SetFlags (ShareManager — entry gated)EmergencyActionERRORMinting is paused or a whitelist is switched on, so new deposits are gated while existing holders can still transfer and redeem.
SetFlags (ShareManager — all flags clear)EmergencyActionWARNINGThe share-token flag bitmask is rewritten to fully open — the all-clear state.
SetAccountInfo (ShareManager — blacklisted)EmergencyActionERROROne account is blacklisted on the share token, after which it can neither transfer nor burn — meaning it cannot redeem.
SetAccountInfo (ShareManager — other)EmergencyActionWARNINGOne account's deposit or transfer permission is changed without blacklisting it.
SetWhitelistMerkleRoot (ShareManager — root set)ProtocolParameterChangeWARNINGSets the deposit-whitelist root on the share token. It gates the mint path only and cannot block an exit, and it is inert unless the whitelist flag is also on. The root's contents are off-chain, so who is on the list is not observable.
SetWhitelistMerkleRoot (ShareManager — root cleared)ProtocolParameterChangeINFOThe deposit whitelist root is cleared, removing the deposit gate.
ReportAccepted (Oracle)EmergencyActionERRORA NAV price report that failed the oracle's own suspicion check is manually force-accepted and applied to every queue. Note it also fires benignly when a new asset is onboarded — the first report for any asset is always flagged suspicious, so an accept is a required step in listing an asset — meaning this can fire on routine asset additions as well as on a genuine price override.
SecurityParamsSet (Oracle — guard rails loosened)ProtocolParameterChangeERRORThe oracle's price-validation guard rails are widened: a larger permitted deviation, a shorter report timeout, or a longer redeem interval. These checks are the only on-chain protection between a compromised rate submitter and every holder's share value. Compared against the previous on-chain values.
SecurityParamsSet (Oracle — tightened or unchanged)ProtocolParameterChangeWARNINGThe guard rails are narrowed or left effectively unchanged — the conservative direction.
SupportedAssetsAdded (Oracle)ProtocolParameterChangeWARNINGThe oracle starts pricing additional assets into NAV. A bad price on any supported asset moves the whole share price, so the set of priced assets is a real risk surface.
SupportedAssetsRemoved (Oracle)ProtocolParameterChangeWARNINGThe oracle stops pricing assets. Guarded — it reverts if the asset still has queues or a non-zero vault balance — so it cannot orphan user funds.
RoleGranted (OracleSubmitter — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root key of the OracleSubmitter's own registry, the second permission layer that decides who may move the published exchange rate.
RoleGranted (OracleSubmitter — SUBMIT_REPORTS / ACCEPT_REPORT)RoleChangeERRORA new address gains the ability to push NAV prices into the oracle, or to force-accept a report the oracle flagged as suspicious. Either is a write path to the value of every holder's shares.
RoleGranted (OracleSubmitter — other roles)RoleChangeWARNINGA role with no specific mapping on this contract is granted.
RoleRevoked (OracleSubmitter — root admin or last rate submitter)RoleChangeERRORThe registry's root admin is removed, or the last remaining rate submitter is. Losing the last submitter silently stops NAV updates: the published rate goes stale and, past the oracle timeout, the instant deposit and redeem paths stop accepting it.
RoleRevoked (OracleSubmitter — other roles)RoleChangeWARNINGA submitter or report-acceptor is rotated out while others remain.
RoleAdminChanged (OracleSubmitter)RoleChangeERRORRe-points which role administers another on the submitter. The contract is not upgradeable and has no code path that does this, so a firing is structurally anomalous.
SetFees (FeeManager — outside the demonstrated range)ProtocolParameterChangeERRORAny deposit or redeem fee is switched on, or the performance fee exceeds 10% or the protocol fee 1%. The contract permits a total fee of 100%, and fees have not always been zero here: a 10% performance plus 1% protocol fee ran on both Earn products for three weeks in July 2026.
SetFees (FeeManager — all four rates zero)ProtocolParameterChangeINFOAll four fee rates are set to zero — fees are off.
SetFees (FeeManager — within the demonstrated range)ProtocolParameterChangeWARNINGA non-zero performance or protocol fee is set inside the range already used in production, with no deposit or redeem fee.
SetFeeRecipient (FeeManager)AdminChangeERRORRe-points the address that receives freshly minted fee shares on every NAV report, and which is exempt from the redeem fee.
OwnershipTransferred (FeeManager — real transfer)AdminChangeCRITICALOwnership of the FeeManager moves to a new address. The owner can set a 100% fee and re-point the recipient, so this is direct authority over value diverted from holders.
OwnershipTransferred (FeeManager — initial assignment)AdminChangeINFOThe deploy-time log where ownership is first assigned from the zero address.
SetVaultLimit (RiskManager — at or below the live balance)ProtocolParameterChangeERRORThe vault-wide deposit cap is set to a value at or below the current balance, which halts all deposits immediately. The live balance is read in-handler to distinguish this from a routine cap change.
SetVaultLimit (RiskManager — above the live balance)ProtocolParameterChangeWARNINGThe vault-wide deposit cap is changed while leaving headroom for new deposits.
SetSubvaultLimit (RiskManager)ProtocolParameterChangeWARNINGCaps how much a single subvault may hold, bounded by the vault-level limit.
AllowSubvaultAssets (RiskManager)ProtocolParameterChangeWARNINGWidens the set of assets a subvault may hold. Doubly constrained: the asset must already be oracle-priced and the curator still needs a verifier proof to move it.
DisallowSubvaultAssets (RiskManager)ProtocolParameterChangeWARNINGNarrows a subvault's allowed asset set — the risk-reducing pairing.
CallScheduled (TimelockController)TimelockChangeERRORAn operation is staged in the product's timelock. The timelock's minimum delay is zero, so a scheduled operation is immediately executable — "timelock" here is propose/execute role separation across two different Safes, not a waiting period. Scheduling therefore means armed, and the message decodes the target and function.
CallExecuted (TimelockController — freeze, curator revocation or queue pause)EmergencyActionCRITICALA staged operation that freezes the share token, clears a verifier's permission root, or pauses a queue has actually been fired. Each timelock permanently holds such operations in state Ready — seven on earnUSD, none ever executed — including a full mint, burn and transfer freeze, and the executor role includes a 1-of-8 Safe.
CallExecuted (TimelockController — other payload)EmergencyActionERRORA staged timelock operation with some other payload has been executed; the message decodes the target and function.
Cancelled (TimelockController)TimelockChangeERRORA pending timelock operation is cancelled. Because the pending operations are the emergency plan itself, cancelling one silently disarms a pre-staged freeze, curator revocation or queue pause.
MinDelayChange (TimelockController — decrease)TimelockChangeERRORThe timelock's minimum delay is reduced. The current value is already zero, so a decrease is not possible from here without an implementation change.
MinDelayChange (TimelockController — increase)TimelockChangeWARNINGThe minimum delay is raised, introducing a real waiting period where there is currently none.
RoleGranted (TimelockController — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the timelock's root admin, which can hand out the proposer, canceller and executor roles — full control over both the staging and the firing of the pre-staged emergency operations.
RoleGranted (TimelockController — EXECUTOR / PROPOSER)RoleChangeERRORA new address gains the ability to fire any ready operation, or to stage arbitrary new privileged calls. With the minimum delay at zero, anything staged is immediately fireable.
RoleGranted (TimelockController — other roles)RoleChangeWARNINGAnother timelock role, such as canceller, is granted.
RoleRevoked (TimelockController — root admin or last executor)RoleChangeERRORThe timelock's root admin is removed, or the last known executor is. Without an executor the pre-staged emergency operations stay permanently ready but unfireable — the kill switch is present and dead.
RoleRevoked (TimelockController — other roles)RoleChangeWARNINGA proposer, canceller or one of several executors is removed.
RoleAdminChanged (TimelockController)RoleChangeERRORRe-points which role administers another on the timelock. No code path in OpenZeppelin's TimelockController does this, so a firing is structurally anomalous.
SetMerkleRoot (Verifier — root cleared)EmergencyActionERRORA verifier's permission root is cleared to zero, revoking every call the curator was allowed to make against subvault assets. This is the pre-staged emergency revocation of curator powers.
SetMerkleRoot (Verifier — root replaced)ProtocolParameterChangeERRORA verifier's permission root is replaced with a different one, changing the set of calls the curator may execute. Only the 32-byte root is on-chain and the tree's contents are off-chain, so there is no way to tell from the event whether the curator's powers widened or narrowed.
AllowCall (Verifier)RoleChangeERRORWrites an explicit caller-target-selector allowance on a verifier that bypasses the merkle tree entirely.
DisallowCall (Verifier)RoleChangeWARNINGRemoves an explicit verifier allowance — the risk-reducing pairing.
SyncDepositParamsSet (SyncDepositQueue — materially costly)ProtocolParameterChangeERRORAn instant-deposit queue's penalty reaches 0.5% or its maximum accepted oracle-price age exceeds 48 hours. The penalty is a direct haircut on the shares an instant depositor receives and the contract permits up to 50%; the max-age setting governs how stale a price the instant path will accept, against an oracle reporting roughly every 20 hours.
SyncDepositParamsSet (SyncDepositQueue — other change)ProtocolParameterChangeWARNINGAn instant-deposit queue's penalty or oracle max-age is changed to a level that is not materially costly to depositors. This includes values above anything used in production so far — the alert records that separately, but a penalty of a few hundredths of a percent is not treated as urgent.
SyncRedeemParamsSet (SyncRedeemQueue — materially costly)ProtocolParameterChangeERRORThe instant-exit path gains a penalty of 0.25% or more (a direct haircut on instant exits, permitted up to 50%), or is set to accept an oracle price older than 48 hours. The role needed to call this has never been granted on either Earn vault.
SyncRedeemParamsSet (SyncRedeemQueue — other change)ProtocolParameterChangeWARNINGThe instant-exit parameters are changed to a level that is not materially costly, including a reduction in daily exit capacity. The instant path is capped at a small fraction of supply per day and the standard redemption queue carries no penalty, so small changes here are recorded rather than treated as urgent.
Upgraded (any earnUSD proxy)ContractUpgradeCRITICALThe implementation behind one of the product's proxies is replaced. A Vault or ShareManager upgrade can rewrite the access-control registry, the share accounting and the pause logic in a single transaction, and the upgrade authority is a 5-of-8 Safe acting with no delay. Monitored on all 43 Earn proxies; the proxies' own AdminChanged is not monitored because the OpenZeppelin v5 proxy admin is immutable and can only fire at construction, which is why the ProxyAdmin ownership event below is the substitute signal.
OwnershipTransferred (ProxyAdmin — real transfer)AdminChangeCRITICALUpgrade authority over one specific contract moves to a new owner. Each proxy has its own dedicated ProxyAdmin, and that ProxyAdmin is the only way to change the proxy's implementation, so this is the sole on-chain signal that the power to upgrade a given contract changed hands.
OwnershipTransferred (ProxyAdmin — initial assignment)AdminChangeINFOThe deploy-time log where a ProxyAdmin's ownership is first assigned from the zero address.
AcceptProposedImplementation (Factory — shared Earn governance)ContractUpgradeERRORThe Factory owner admits a new implementation into the set that may be instantiated for queues, subvaults or verifiers. It does not upgrade anything already deployed, but it is a reliable precursor: the implementation accepted on 2026-07-21 is the one both new instant-redeem queues were deployed from two days later.
ProposeImplementation (Factory — shared Earn governance)ContractUpgradeINFOAn implementation address is proposed to a Factory. The function is permissionless — it has no access control at all, so anyone can propose any address — and a proposal grants nothing until the owner accepts it via the event above. Recorded so a stranger cannot generate noise.
SetBlacklistStatus (Factory — shared Earn governance)ProtocolParameterChangeWARNINGA Factory implementation version is marked as blacklisted, or unmarked. It affects future deployments only; instances already deployed are untouched.
OwnershipTransferred (Factory — real transfer, shared Earn governance)AdminChangeCRITICALOwnership of one of the four Mellow-global Factories moves. The owner gates which implementations either Earn product can ever deploy.
OwnershipTransferred (Factory — initial assignment, shared Earn governance)AdminChangeINFOThe deploy-time log where a Factory's ownership is first assigned from the zero address.
AddedOwner (Safe — Upgrade Authority, LazyVaultAdmin, Curator, OracleUpdater, Lido Pauser, Mellow Pauser)MultisigChangeERRORA new signer joins one of the Safes that hold upgrade authority, vault root admin, curator keys, the rate-submitter role, or the timelock executor role. On the Mellow Pauser Safe, which is 1-of-8, each new owner is one more party able to fire the pre-staged freeze on both products alone.
AddedOwner (Safe — ActiveVaultAdmin)MultisigChangeWARNINGA new signer joins the Safe that holds only the deposit-cap and balance-accounting roles.
RemovedOwner (Safe — Upgrade Authority, LazyVaultAdmin, Curator, OracleUpdater, Lido Pauser, Mellow Pauser)MultisigChangeERRORA signer leaves one of the high-authority Safes, concentrating control among fewer parties at an unchanged threshold.
RemovedOwner (Safe — ActiveVaultAdmin)MultisigChangeWARNINGA signer leaves the limits-only Safe.
ChangedThreshold (Safe — Upgrade Authority or LazyVaultAdmin, lowered)MultisigChangeCRITICALThe signature requirement is lowered on one of the two root-of-trust Safes — the one owning all 43 ProxyAdmins and all four Factories, or the one holding root admin on both vaults and both oracle submitters. Fewer signatures for total control. Compared against the previous on-chain value.
ChangedThreshold (Safe — root-of-trust raised, or any other Safe lowered)MultisigChangeERRORA root-of-trust Safe raises its requirement, or one of the asset, oracle, pauser or limits Safes lowers its own.
ChangedThreshold (Safe — any other Safe raised)MultisigChangeWARNINGA non-root Safe raises its signature requirement — the conservative direction.
EnabledModule (Safe)MultisigChangeCRITICALA module is enabled on a governing Safe. A module can execute transactions from that Safe with no signatures at all, bypassing the signing threshold entirely. No module has ever been enabled on any of the seven Safes.
DisabledModule (Safe)MultisigChangeWARNINGA module is disabled, removing a signature-bypass path.
ChangedGuard (Safe)MultisigChangeERRORA transaction guard is installed on or removed from a governing Safe. A guard's pre-execution hook can revert unconditionally, which would brick the pauser Safes and with them the ability to fire the emergency operations.
ChangedFallbackHandler (Safe)MultisigChangeWARNINGA governing Safe's fallback handler is changed. The handler is invoked with call rather than delegatecall, so it cannot write Safe storage; the exposure is signature-validation spoofing.

Lido — stETH (lido)

  • Chain(s): Ethereum
  • Products: steth
  • Contracts monitored:
    • Lido stETH — 0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84
    • WithdrawalQueue — 0x889edC2eDab5f40e902b864aD4d7AdE8E412F9B1
    • Aragon Voting — 0x2e59A20f205bB85a89C53f1936454680651E618e
    • NodeOperatorsRegistry — 0x55032650b14df07b85bF18A3a3eC8E0Af2e028d5
    • InsuranceFund — 0x8B3f33234ABD88493c0Cd28De33D583B70beDe35
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
ContractVersionSet (stETH)ContractUpgradeERRORThe stETH proxy's implementation is upgraded — new code for the core token contract while user balances and storage stay in the unchanged proxy. Governance-gated (Aragon DAO) and rare (twice in the protocol's life), so every upgrade pages to be matched against a known governance vote.
LidoLocatorSetContractUpgradeCRITICALRe-points stETH at a different LidoLocator — the central registry that resolves ~15 core system components (the oracle, withdrawal queue, treasury, staking router, reward vaults). Because the protocol resolves these dependencies at runtime, swapping the locator instantly redirects the whole system's trust to a new set of contracts — the same top-tier root-of-trust change as swapping an access-control manager or price oracle. Outside initial setup this is not a normal operation; any occurrence is top-urgency.
StakingPausedEmergencyActionERRORNew deposits (submit()) are halted while transfers and withdrawals stay live — user funds are not frozen, so this sits one tier below a full protocol stop. A deliberate, privileged emergency action worth paging.
StakingResumedEmergencyActionWARNINGThe deposit path is re-opened after a staking pause — the recovery / all-clear signal. The paired StakingPaused already paged, so this is recorded for visibility rather than paged.
StoppedEmergencyActionCRITICALThe Aragon-era top-level halt of the entire stETH contract — freezes the core mutating paths. Has never fired in production and can only be triggered by the privileged pauser; if it ever does, the whole protocol is halted, so it pages at top urgency.
ResumedEmergencyActionWARNINGThe top-level protocol halt is lifted and normal operation resumes — the recovery / all-clear signal. The paired Stopped already paged (CRITICAL), so the resume is recorded rather than paged.
StakingLimitSetProtocolParameterChangeWARNINGConfigures the staking rate-limiter (max stake limit + per-block refill) that smooths large ETH inflows. It never touches withdrawals, transfers, fees, or trust — worst case it briefly throttles new deposits — so it is recorded for visibility, not paged.
StakingLimitRemovedProtocolParameterChangeWARNINGRemoves the deposit rate-limiter entirely (deposits become unthrottled). Still only affects new-deposit smoothing, with no bearing on withdrawals, custody, or solvency, so it is recorded rather than paged.
MaxExternalRatioBPSet (increase)ProtocolParameterChangeERRORCaps the fraction of stETH backing that may come from V3 stVaults (external shares) rather than the core staking pool — the ceiling on how much of the rated token can be exposed to the newer vault mechanism and its socialised-bad-debt risk. Raising the cap expands that risk surface, so it pages. Evaluated against the previous on-chain value; an unset prior counts as 0, so first establishing a cap pages.
MaxExternalRatioBPSet (decrease)ProtocolParameterChangeWARNINGThe stVault backing cap is lowered, shrinking the share of stETH exposed to the external-vault mechanism. A de-risking change, so it is recorded rather than paged. Evaluated against the previous on-chain value.
RoleGranted (WithdrawalQueue — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key of the WithdrawalQueue, which can grant or revoke every other role on the contract that processes user redemptions. The highest-trust change on this contract, so it pages at top urgency.
RoleGranted (WithdrawalQueue — FINALIZE / ORACLE / PAUSE)RoleChangeERRORA new address gains a powerful operational role: finalizing withdrawal batches (controls payouts), feeding the finalization oracle data, or the GateSeal ability to freeze all withdrawals. Each can materially affect redemptions, so granting it pages. (PAUSE is periodically rotated to a fresh GateSeal — expected but still page-worthy to confirm the new holder.)
RoleGranted (WithdrawalQueue — RESUME)RoleChangeWARNINGA new address gains the ability to lift a withdrawal pause — a recovery-side capability. Recorded for visibility; does not page.
RoleGranted (WithdrawalQueue — MANAGE_TOKEN_URI)RoleChangeINFOA new address gains control of the withdrawal-NFT metadata URI — cosmetic, with no power over funds or protocol state. Logged for completeness only.
RoleGranted (WithdrawalQueue — unrecognized role)RoleChangeERRORA role the monitor cannot map to a known name is granted. Because an unmapped or custom role could be powerful, it is paged ("fail loud") rather than silently ignored.
RoleRevoked (WithdrawalQueue — DEFAULT_ADMIN / FINALIZE / ORACLE)RoleChangeERRORA role whose loss is dangerous is removed — the root key (removal can lock out governance), the finalize capability, or the oracle feed (losing either can stall withdrawal finalization). Worth paging even though revocations usually reduce risk, since these can also signal a hostile takeover or an operational mistake.
RoleRevoked (WithdrawalQueue — other roles)RoleChangeWARNINGA lower-impact role (PAUSE, RESUME, token-URI) is removed. PAUSE revocation is the other half of a routine GateSeal rotation, so it is recorded rather than paged (the matching grant already carries the signal).
RoleAdminChanged (WithdrawalQueue)RoleChangeERRORThe rule for who may grant or revoke a WithdrawalQueue role is rewired — a structural change to the permission graph rather than to who holds a role. Rare and deeply privileged, so it pages.
Paused (WithdrawalQueue)EmergencyActionCRITICALThe entire WithdrawalQueue is paused — halting requests, finalization, and claims, so users cannot redeem in-flight withdrawals. Fires for any holder of PAUSE_ROLE: the GateSeal break-glass is the expected caller, but governance can pause directly and did so at the V2 launch. The pause is either time-boxed (a GateSeal seal runs for a fixed window) or indefinite with no expiry, which the alert reports explicitly. Distinct from bunker mode (this is a manual guardian action, typically taken when an active threat is suspected), so it pages at top urgency.
Resumed (WithdrawalQueue)EmergencyActionWARNINGThe pause on withdrawals is lifted and redemptions resume — the recovery / all-clear signal. The paired Paused already paged, so this is recorded rather than paged.
BunkerModeEnabledEmergencyActionCRITICALThe oracle detected abnormal beacon-chain losses (mass slashing or a large validator-balance drop) and activated bunker mode, which pauses withdrawal finalization so the loss is socialised fairly instead of letting early withdrawers escape it. One of the strongest distress signals the protocol can emit, so it pages at top urgency.
BunkerModeDisabledEmergencyActionWARNINGBunker mode is lifted and normal finalization resumes — losses have been resolved. The recovery / all-clear signal, recorded rather than paged.
ContractVersionSet (WithdrawalQueue)ContractUpgradeERRORThe WithdrawalQueue proxy's implementation is upgraded — new code for the contract that processes user redemptions, while funds and storage stay in the proxy. Governance-gated; pages so it can be matched to a known governance vote.
ChangeSupportRequiredProtocolParameterChangeERRORChanges the % of yes-votes a governance proposal needs to pass — one of the two thresholds that define Lido's governance-capture resistance. Lowering it makes it cheaper for a coalition to pass proposals (which control upgrades, roles, and the locator), so any change is a rating-relevant governance-security event and pages. Has never been changed on-chain.
ChangeMinQuorumProtocolParameterChangeERRORChanges the minimum turnout a vote needs to be valid — the second governance-security threshold. Lowering it weakens capture resistance, so any change pages. Has never been changed on-chain.
ChangeVoteTime (shortened)ProtocolParameterChangeERRORChanges how long a governance vote stays open — a governance safety-time window. Shortening it reduces the time to react to a malicious proposal, so it pages. Evaluated against the previous on-chain value.
ChangeVoteTime (lengthened)ProtocolParameterChangeWARNINGThe vote-open window is lengthened, giving more time to react to a proposal. A conservative change, so it is recorded rather than paged. A first, baseline-establishing value (no previous on-chain value to compare) is also recorded rather than paged.
ChangeObjectionPhaseTime (shortened)ProtocolParameterChangeERRORChanges the length of Lido's final objection window, during which token holders can veto a passed vote. Shortening it cuts the veto reaction time, so it pages. Same directional, previous-value comparison as the vote-time window.
ChangeObjectionPhaseTime (lengthened)ProtocolParameterChangeWARNINGThe objection/veto window is lengthened, giving holders more time to veto a passed vote. A conservative change, so it is recorded rather than paged. A first, baseline-establishing value is also recorded rather than paged.
StartVoteTimelockChangeINFOA new governance proposal is created. Fires well before the proposal can execute (a multi-day vote plus objection window), and its metadata is an opaque IPFS reference, so it is recorded as governance-lifecycle context for review rather than paged.
ExecuteVoteTimelockChangeWARNINGA passed governance vote is enacted. The specific privileged changes it makes fire their own events (upgrades, role grants, parameter changes), so this is recorded as the governance-level "a proposal executed" marker to correlate those changes against — surfaced for visibility, not paged.
ExitDeadlineThresholdChangedProtocolParameterChangeWARNINGSets how long after a requested validator exit an operator is considered delinquent (plus the reporting window) — operator exit-discipline tuning. Operational rather than a fund/security lever, so it is recorded rather than paged.
ContractVersionSet (NodeOperatorsRegistry)ContractUpgradeERRORThe NodeOperatorsRegistry proxy's implementation is upgraded — new code for the operator/validator registry, funds and storage unchanged. Governance-gated; pages to be matched to a known governance vote.
LocatorContractSet (NodeOperatorsRegistry)ContractUpgradeERRORRe-points the NodeOperatorsRegistry at a different LidoLocator (used to resolve the StakingRouter and Burner). A root-of-trust redirect for operator/reward plumbing — a malicious locator could let an attacker impersonate the StakingRouter and manipulate validator accounting or reward distribution. Its damage ceiling is the operator/reward layer (not user custody or withdrawals), so it pages at ERROR, one tier below the stETH-hub locator change.
OwnershipTransferred (InsuranceFund)AdminChangeCRITICALOwnership of the InsuranceFund — the protocol's cover reserve (thousands of stETH, tens of millions of dollars) — moves to a new address. The owner can transfer every asset out of the fund, so a handover is control of the entire reserve and pages at top urgency, giving the earliest possible warning before any drain.
ERC20Transferred (InsuranceFund)EmergencyActionCRITICALAn ERC-20 asset (the fund holds stETH) is transferred out of the InsuranceFund. A material outflow of the cover reserve is either a covered-loss event (the reserve being used because a loss occurred) or theft — both are top-urgency signals, so it pages at CRITICAL.
EtherTransferred (InsuranceFund)EmergencyActionCRITICALRaw ETH is transferred out of the InsuranceFund — the same reserve-drain signal as the ERC-20 path (covered loss or theft), paged at top urgency.
ERC1155Transferred (InsuranceFund)EmergencyActionERRORAn ERC-1155 asset is transferred out of the InsuranceFund via the same owner-only drain path. NFTs are not a designed reserve asset here (the fund holds stETH), so the drain vector is monitored but at ERROR rather than the CRITICAL of the fungible-value paths.
ERC721Transferred (InsuranceFund)EmergencyActionERRORAn ERC-721 asset is transferred out of the InsuranceFund via the owner-only drain path. Monitored for completeness at ERROR, since NFTs are not a designed/valued reserve asset here.

Lido — strETH (lido)

  • Chain(s): Ethereum
  • Products: streth
  • Contracts monitored:
    • OracleSubmitter — 0x00000000df0088bd598df1e4ae57943dc481907a
    • Vault — 0x277c6a642564a91ff78b008022d65683cee5ccc5
    • Oracle — 0x8a78e6b7e15c4ae3aeaee3bf0de4f2de4078c1cd
    • LazyAdmin (Safe) — 0xabe20d266ae54b9ae30492dea6b6407bf18feeb5
    • VaultProxyAdmin — 0x94abdf2b59c6495071f32eb8fb4a0f4d2465a2f2
    • OracleProxyAdmin — 0x6ce7c72d54e9bdfb97101bd5c4988b61eb4fa156
    • wstETH RedeemQueue — 0x1ae8c006b5c97707aa074aaed42becad2cf80da2
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (OracleSubmitter)RoleChangeWARNINGRole granted on Oracle Submitter
RoleRevoked (OracleSubmitter)RoleChangeWARNINGRole revoked on Oracle Submitter
RoleAdminChanged (OracleSubmitter)RoleChangeERRORRole admin changed on Oracle Submitter
Upgraded (Vault proxy)ContractUpgradeERRORVault contract upgraded
AdminChanged (Vault proxy)AdminChangeERRORVault proxy admin changed
RoleGranted (Vault impl)RoleChangeWARNINGVault role granted
RoleRevoked (Vault impl)RoleChangeWARNINGVault role revoked
RoleAdminChanged (Vault impl)RoleChangeERRORVault role admin changed
SetQueueStatusEmergencyActionCRITICALVault queue paused/unpaused
QueueLimitSetProtocolParameterChangeINFOVault queue limit set
Upgraded (Oracle proxy)ContractUpgradeERROROracle contract upgraded
AdminChanged (Oracle proxy)AdminChangeERROROracle proxy admin changed
AddedOwner (Safe)MultisigChangeWARNINGSigner added to LazyAdmin Safe
RemovedOwner (Safe)MultisigChangeWARNINGSigner removed from LazyAdmin Safe
ChangedThreshold (Safe)MultisigChangeWARNINGLazyAdmin Safe threshold changed
EnabledModule (Safe)MultisigChangeWARNINGModule enabled on LazyAdmin Safe
DisabledModule (Safe)MultisigChangeWARNINGModule disabled on LazyAdmin Safe
ChangedGuard (Safe)MultisigChangeWARNINGGuard changed on LazyAdmin Safe
ChangedFallbackHandler (Safe)MultisigChangeWARNINGFallback handler changed on LazyAdmin Safe
OwnershipTransferred (VaultProxyAdmin)AdminChangeERRORVault ProxyAdmin ownership transferred
OwnershipTransferred (OracleProxyAdmin)AdminChangeERROROracle ProxyAdmin ownership transferred

Lombard (lombard)

  • Chain(s): Ethereum
  • Products: lbtc (timelock and consortium incidents are protocol-wide)
  • Contracts monitored:
    • LBTC Token — 0x8236a87084f8B84306f72007F36F2618A5634494
    • Timelock — 0x055E84e7FE8955E2781010B866f10Ef6E1E77e59
    • Consortium — 0xdAD58DfA5c1a7a34419AFdBE1f0d610efeea95E4
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
UpgradedContractUpgradeERRORLBTC proxy upgraded to new implementation
AdminChangedAdminChangeERRORLBTC proxy admin changed
OwnershipTransferredAdminChangeERRORLBTC ownership transferred
OwnershipTransferStartedAdminChangeWARNINGLBTC ownership transfer initiated
PauserRoleTransferredRoleChangeWARNINGLBTC pauser role transferred
OperatorRoleTransferredRoleChangeWARNINGLBTC operator role transferred
MinterUpdatedRoleChangeWARNINGLBTC minter added or removed
ClaimerUpdatedRoleChangeWARNINGLBTC claimer added or removed
ConsortiumChangedProtocolParameterChangeERRORLBTC consortium address changed
BasculeChangedProtocolParameterChangeERRORLBTC bascule drawbridge address changed
AssetRouterChangedProtocolParameterChangeWARNINGLBTC asset router changed
TreasuryAddressChangedProtocolParameterChangeWARNINGLBTC treasury address changed
FeeChangedProtocolParameterChangeWARNINGLBTC minting fee changed
RedeemFeeChangedProtocolParameterChangeWARNINGLBTC redeem fee changed
BurnCommissionChangedProtocolParameterChangeWARNINGLBTC burn commission changed
DustFeeRateChangedProtocolParameterChangeWARNINGLBTC dust fee rate changed
RedeemsForBtcEnabledProtocolParameterChangeWARNINGLBTC redeems for BTC enabled/disabled
NameAndSymbolChangedProtocolParameterChangeINFOLBTC name and symbol changed
PausedEmergencyActionCRITICALLBTC token paused
UnpausedEmergencyActionCRITICALLBTC token unpaused
MinDelayChange (decreased)TimelockChangeERRORTimelock min delay decreased
MinDelayChange (increased)TimelockChangeWARNINGTimelock min delay increased
CallScheduledTimelockChangeWARNINGTimelock call scheduled
CallExecutedTimelockChangeINFOTimelock call executed
CancelledTimelockChangeINFOTimelock call cancelled
RoleGranted (Timelock)RoleChangeWARNINGTimelock role granted
RoleRevoked (Timelock)RoleChangeWARNINGTimelock role revoked
RoleAdminChanged (Timelock)RoleChangeERRORTimelock role admin changed
OwnershipTransferred (Consortium)AdminChangeERRORConsortium ownership transferred
OwnershipTransferStarted (Consortium)AdminChangeWARNINGConsortium ownership transfer initiated
ValidatorSetUpdatedProtocolParameterChangeERRORConsortium validator set updated

Looping Collective — lcBTC (looping-collective)

  • Chain(s): Ethereum
  • Products: lcbtc
  • Contracts monitored:
    • Vault — 0xaa3cb36be406e6cf208d218fd214e0f1a71e957d
    • Oracle — 0xbae89dc56874ed0f790ce9bc698674b2da947ebf
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
UpgradeExecutedContractUpgradeERRORVault upgrade executed
UpgradeProposedContractUpgradeINFOVault upgrade proposed
UpgradeCancelledContractUpgradeINFOVault upgrade cancelled
UpgradedContractUpgradeERRORVault contract upgraded
RoleAdminChanged (Vault)RoleChangeWARNINGVault role admin changed
RoleGranted (Vault)RoleChangeWARNINGVault role granted
RoleRevoked (Vault)RoleChangeWARNINGVault role revoked
PausedEmergencyActionCRITICALVault paused
UnpausedEmergencyActionCRITICALVault unpaused
FeesUpdatedProtocolParameterChangeWARNINGVault fees updated
FeesRecipientUpdatedProtocolParameterChangeWARNINGVault fees recipient updated
OperatorSetRoleChangeWARNINGVault operator set
OracleProposedProtocolParameterChangeWARNINGOracle change proposed
OracleUpdatedProtocolParameterChangeWARNINGOracle updated
RateProviderProposedProtocolParameterChangeWARNINGRate provider change proposed
RateProviderUpdatedProtocolParameterChangeWARNINGRate provider updated
FundsHolderProposedProtocolParameterChangeWARNINGFunds holder change proposed
FundsHolderChangedProtocolParameterChangeWARNINGFunds holder changed
OwnershipTransferred (Oracle)AdminChangeERROROracle ownership transferred
OwnershipTransferStarted (Oracle)AdminChangeWARNINGOracle ownership transfer started

Maple (maple)

  • Chain(s): Ethereum
  • Products: syrupusdc, syrupusdt, plus protocol-wide for the shared GovernorTimelock
  • Contracts monitored:
    • Maple Pool (syrupUSDC) — 0x80ac24aa929eaf5013f6436cda2a7ba190f5cc0b
    • Maple PoolManager (syrupUSDC) — 0x7ad5ffa5fdf509e30186f4609c2f6269f4b6158f
    • Maple WithdrawalManagerQueue (syrupUSDC) — 0x1bc47a0dd0fdab96e9ef982fdf1f34dc6207cfe3
    • Maple Pool (syrupUSDT) — 0x356b8d89c1e1239cbbb9de4815c39a1474d5ba7d
    • Maple PoolManager (syrupUSDT) — 0x0cda32e08b48bfddbc7ee96b44b09cf286f9e21a
    • Maple WithdrawalManagerQueue (syrupUSDT) — 0x86ebdf902d800f2a82038290b6dbb2a5ee29eb8c
    • Maple GovernorTimelock — 0x2efff88747eb5a3ff00d4d8d0f0800e306c0426b
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
PendingOwnerSet (Pool)AdminChangeWARNINGPool two-step ownership transfer initiated
OwnershipAccepted (Pool)AdminChangeERRORPool ownership transfer completed
PendingDelegateSet (PoolManager)AdminChangeWARNINGPool delegate change initiated
PendingDelegateAccepted (PoolManager)AdminChangeERRORPool delegate changed
DelegateManagementFeeRateSetProtocolParameterChangeINFODelegate management fee rate set
LiquidityCapSetProtocolParameterChangeINFOPool liquidity cap changed
CollateralLiquidationTriggeredEmergencyActionCRITICALLoan default / collateral liquidation started
CollateralLiquidationFinishedEmergencyActionWARNINGCollateral liquidation completed
SetAsActive (active)EmergencyActionWARNINGPool activated
SetAsActive (inactive)EmergencyActionERRORPool deactivated
PoolPermissionManagerSetAdminChangeERRORPool access control manager changed
WithdrawalManagerSetContractUpgradeERRORWithdrawal manager contract changed
StrategyAddedProtocolParameterChangeWARNINGNew lending strategy added
IsStrategySetProtocolParameterChangeWARNINGStrategy enabled/disabled
Upgraded (PoolManager)ContractUpgradeERRORPoolManager implementation upgraded
Upgraded (WithdrawalManager)ContractUpgradeERRORWithdrawalManager implementation upgraded
DefaultTimelockSetTimelockChangeERRORDefault timelock delay/execution window changed
FunctionTimelockSetTimelockChangeWARNINGPer-function timelock override set
ProposalScheduledTimelockChangeWARNINGGovernance proposal scheduled
ProposalExecutedTimelockChangeWARNINGGovernance proposal executed
ProposalUnscheduledTimelockChangeWARNINGGovernance proposal unscheduled
RoleUpdatedRoleChangeWARNINGTimelock role granted/revoked
PendingTokenWithdrawerSetAdminChangeWARNINGPending token withdrawer set
TokenWithdrawerAcceptedAdminChangeWARNINGToken withdrawer accepted

Moonwell Flagship ETH (moonwell)

  • Chain(s): Base
  • Products: moonwell-flagship-eth (Morpho Blue base layer, governor, and multisig incidents are protocol-wide)
  • Contracts monitored:
    • Moonwell Flagship ETH Vault — 0xa0E430870c4604CcfC7B38Ca7845B1FF653D0ff1
    • Moonwell Temporal Governor — 0x8b621804a7637b781e2BbD58e256a591F2dF7d51
    • Moonwell Security Council (Guardian 3-of-5) — 0xB9d4acf113a423Bc4A64110B8738a52E51C2AB38
    • Block Analitica + B.Protocol (Curator 2-of-4) — 0x08eDEbFFaE68970DCf751baa826182b3a4aCFC05
    • MorphoBlue (Base) — 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
SetOwner (MorphoBlue)AdminChangeERRORMorphoBlue (Base) owner changed
SetFee (MorphoBlue)ProtocolParameterChangeWARNINGMorphoBlue (Base) market fee changed
SetFeeRecipient (MorphoBlue)ProtocolParameterChangeWARNINGMorphoBlue (Base) fee recipient changed
EnableIrm (MorphoBlue)ProtocolParameterChangeWARNINGMorphoBlue (Base) IRM enabled
EnableLltv (MorphoBlue)ProtocolParameterChangeWARNINGMorphoBlue (Base) LLTV tier enabled
OwnershipTransferred (Vault)AdminChangeERRORVault ownership transferred
OwnershipTransferStarted (Vault)AdminChangeWARNINGVault ownership transfer started
SetCuratorRoleChangeWARNINGVault curator changed
SetGuardianRoleChangeWARNINGVault guardian set
SubmitGuardianAdminChangeWARNINGVault guardian change submitted
RevokePendingGuardianAdminChangeINFOPending guardian change revoked
SetIsAllocatorRoleChangeWARNINGVault allocator added/removed
SetTimelockTimelockChangeWARNINGVault timelock set
SubmitTimelockTimelockChangeWARNINGVault timelock change submitted
RevokePendingTimelockTimelockChangeINFOPending timelock change revoked
SetFee (Vault)ProtocolParameterChangeWARNINGVault performance fee changed
SetFeeRecipient (Vault)ProtocolParameterChangeWARNINGVault fee recipient changed
SetSkimRecipientProtocolParameterChangeINFOVault skim recipient changed
RevokePendingCapProtocolParameterChangeINFOPending market cap change revoked
SubmitMarketRemovalProtocolParameterChangeWARNINGMarket removal submitted
RevokePendingMarketRemovalProtocolParameterChangeINFOPending market removal revoked
OwnershipTransferred (Governor)AdminChangeERRORTemporal Governor ownership transferred
GuardianChanged (Governor)RoleChangeWARNINGTemporal Governor guardian changed
GuardianPauseGrantedRoleChangeWARNINGTemporal Governor guardian pause window granted
GuardianRevokedRoleChangeWARNINGTemporal Governor guardian revoked
TrustedSenderUpdatedAdminChangeWARNINGTemporal Governor trusted (cross-chain) sender added/removed
Paused (Governor)EmergencyActionCRITICALTemporal Governor paused
Unpaused (Governor)EmergencyActionWARNINGTemporal Governor unpaused
PermissionlessUnpausedEmergencyActionWARNINGTemporal Governor permissionlessly unpaused
AddedOwner (Safe)MultisigChangeWARNINGMultisig owner added
RemovedOwner (Safe)MultisigChangeWARNINGMultisig owner removed
ChangedThreshold (Safe)MultisigChangeCRITICALMultisig threshold changed (takeover prelude)
EnabledModule (Safe)MultisigChangeCRITICALMultisig module enabled (arbitrary-tx backdoor)
DisabledModule (Safe)MultisigChangeWARNINGMultisig module disabled
ChangedGuard (Safe)MultisigChangeERRORMultisig guard changed
ChangedFallbackHandler (Safe)MultisigChangeERRORMultisig fallback handler changed

Morpho (morpho)

  • Chain(s): Ethereum
  • Products: the rated Morpho vaults, each a per-vault slug (the slugified vault label, e.g. steakhouse-usdc, gauntlet-usdc-prime-v2). MorphoBlue-core events apply protocol-wide — MorphoBlue is the shared lending singleton every vault is built on, so those events touch all of them; vault-scoped events attach only to the specific vault that emitted them
  • Contracts monitored:
    • MorphoBlue (core singleton) — 0xBBBBBBBBbb9cc5e90e3b3Af64bdAF62C37EEFFCb
    • MetaMorpho V1 vaults:
      • Steakhouse USDC — 0xBEEF01735c132Ada46AA9aA4c54623cAA92A64CB
      • Steakhouse USDT — 0xbEef047a543E45807105E51A8BBEFCc5950fcfBa
      • Steakhouse ETH — 0xBEEf050ecd6a16c4e7bfFbB52Ebba7846C4b8cD4
      • Smokehouse USDC — 0xBEeFFF209270748ddd194831b3fa287a5386f5bC
      • Gauntlet USDC Frontier — 0xc582F04d8a82795aa2Ff9c8bb4c1c889fe7b754e
      • Gauntlet USDC Prime — 0xdd0f28e19C1780eb6396170735D45153D261490d
      • Gauntlet USDC Core — 0x8eB67A509616cd6A7c1B3c8C21D48FF57df3d458
      • Gauntlet LRT Core — 0x4881Ef0BF6d2365D3dd6499ccd7532bcdBCE0658
      • Gauntlet EURC Core — 0x2ed10624315b74a78f11FAbedAa1A228c198aEfB
      • VaultBridge WBTC — 0x812B2C6Ab3f4471c0E43D4BB61098a9211017427
    • Morpho Vaults V2 (adapter-based):
      • Steakhouse Prime Instant V2 USDT — 0xbeef003C68896c7D2c3c60d363e8d71a49Ab2bf9
      • Steakhouse Prime Instant V2 USDC — 0xbeef088055857739C12CD3765F20b7679Def0f51
      • Steakhouse Prime Instant V2 EURCV — 0xbeef0C075Da5D01112AE5cF34d257074fB5DDB2f
      • Gauntlet USDC Prime V2 — 0x8c106EEDAd96553e64287A5A6839c3Cc78afA3D0
      • Gauntlet USDC Frontier V2 — 0x9a1D6bd5b8642C41F25e0958129B85f8E1176F3e
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
SetOwner (MorphoBlue)AdminChangeCRITICALTransfers ownership of MorphoBlue, the shared lending singleton that every monitored vault is built on. This is the protocol's ultimate root of trust — its owner can change core lending parameters for all vaults — so any change pages at the highest urgency.
SetFee (MorphoBlue)ProtocolParameterChangeWARNINGTurns on or changes MorphoBlue's protocol fee on a lending market — a revenue skim capped at 25% of borrow interest that never touches deposited principal. The fee has never been switched on anywhere, so a change is surfaced on the dashboard, not paged.
SetFeeRecipient (MorphoBlue)ProtocolParameterChangeWARNINGChanges where MorphoBlue's protocol fees are sent. Revenue routing only — it cannot affect deposits or solvency — so it is recorded for visibility, not paged.
EnableIrm (MorphoBlue)ProtocolParameterChangeWARNINGWhitelists a new interest-rate model that markets may opt into. It is additive (it removes nothing and cannot alter existing markets) and has only happened at protocol genesis, so it is tracked on the dashboard, not paged.
EnableLltv (MorphoBlue)ProtocolParameterChangeWARNINGWhitelists a new maximum loan-to-value tier that new markets may use. Additive and genesis-era only — it cannot change any existing market — so it is tracked on the dashboard, not paged.
OwnershipTransferred (V1 Vault)AdminChangeERROROwnership of a monitored vault passes to a new address. The vault owner controls its curator, guardian and timelock, so a completed handover is a root-of-trust change for that vault and pages.
OwnershipTransferStarted (V1 Vault)AdminChangeWARNINGThe first step of a two-step vault-ownership handover: a new owner is nominated but not yet in control, and the move can still be cancelled. Surfaced as an early signal; the page comes when it finalizes (the ERROR above).
SetCurator (V1 Vault)RoleChangeWARNINGChanges the vault's curator — the role that proposes market caps and risk policy. Its powers are timelocked and cap-bounded and the guardian can veto them, so a change is surfaced for review but does not page.
SetGuardian (V1 Vault)RoleChangeWARNINGSets or replaces the vault's guardian, the safety role that can veto risky pending changes. A safety-role change worth recording, but going through the normal process, so it is surfaced rather than paged.
SubmitGuardian (V1 Vault)AdminChangeWARNINGProposes a new guardian; the change enters the timelock queue and is not yet effective. Surfaced as an early signal of a safety-role change, not paged.
RevokePendingGuardian (V1 Vault)AdminChangeINFOCancels a pending guardian change before it takes effect, restoring the prior state. Logged for completeness only.
SetIsAllocator (V1 Vault)RoleChangeWARNINGGrants or removes an allocator — the role that can move vault funds between lending markets, but only within the caps the curator has set. Bounded authority, so it is surfaced for visibility rather than paged.
SetTimelock (V1 Vault)TimelockChangeWARNINGFinalizes a new timelock length for the vault's governance queue. The dangerous direction (shortening the safety window) is caught earlier and pages via SubmitTimelock below, so this finalization is surfaced but not paged.
SubmitTimelock (V1 Vault)TimelockChangeERRORProposes shortening the vault's timelock — the delay that gives holders and the guardian time to react to risky changes. The handler fires only on a decrease, i.e. a request to weaken that safety window, so it pages as the earliest warning.
RevokePendingTimelock (V1 Vault)TimelockChangeINFOCancels a pending timelock change before it takes effect, keeping the safer existing window. Logged for completeness only.
SetFee (V1 Vault)ProtocolParameterChangeWARNINGChanges the vault's performance fee, capped at 50% and charged only on yield — it never touches deposited principal. A routine economic knob, surfaced for visibility rather than paged.
SetFeeRecipient (V1 Vault)ProtocolParameterChangeWARNINGChanges where the vault's performance fee is sent. Revenue routing only, with no effect on deposits or solvency, so it is recorded but not paged.
SetSkimRecipient (V1 Vault)ProtocolParameterChangeINFOSets the address allowed to sweep stray tokens accidentally sent to the vault — dust only, with no effect on user funds. Logged for completeness.
SubmitCap (V1 Vault)ProtocolParameterChangeWARNINGProposes raising a market's supply cap — the main lever that increases the vault's exposure to a given lending market. The increase is timelocked and guardian-vetoable, so the proposal is surfaced for review but does not page.
SetCap (V1 Vault)ProtocolParameterChangeINFOFinalizes a supply cap or lowers one. A decrease reduces risk, and any increase was already surfaced when proposed (above), so this is logged for completeness.
RevokePendingCap (V1 Vault)ProtocolParameterChangeINFOCancels a pending supply-cap increase before it takes effect — a de-risking reversal, logged for completeness.
SubmitMarketRemoval (V1 Vault)ProtocolParameterChangeWARNINGProposes removing a lending market from the vault — a timelocked de-risking step, typically to wind down exposure to a market. Surfaced for review; not paged.
RevokePendingMarketRemoval (V1 Vault)ProtocolParameterChangeINFOCancels a pending market removal before it takes effect. A reversal, logged for completeness.
SetOwner (V2 Vault)AdminChangeERRORChanges the owner of a V2 vault, effective immediately (no two-step handover). The owner is that vault's root authority, so a change pages.
SetCurator (V2 Vault)RoleChangeWARNINGChanges a V2 vault's curator, the risk-policy role. Its actions are timelocked and a sentinel can veto them, so a change is surfaced for review but does not page.
SetIsSentinel (V2 Vault, revoke)RoleChangeERRORRemoves a sentinel — the V2 safety role that can veto risky pending changes. Losing a safety role weakens the vault's defenses, so a revocation pages.
SetIsSentinel (V2 Vault, grant)RoleChangeWARNINGAdds a sentinel (safety-veto) role. Strengthening safety is not dangerous, so it is surfaced for visibility, not paged.
SetIsAllocator (V2 Vault, grant)RoleChangeWARNINGGrants an allocator — the role that routes vault funds between adapters, within the vault's caps. Bounded authority, surfaced for visibility, not paged.
SetIsAllocator (V2 Vault, revoke)RoleChangeINFORemoves an allocator. Reducing privilege is safe, so it is logged for completeness.
Submit (V2 Vault, timelock decrease)TimelockChangeERRORThe V2 governance queue takes actions keyed by function selector; this submission requests shortening a timelock, weakening the window holders rely on to react to risky changes. It pages as the earliest signal.
Submit (V2 Vault, other actions)TimelockChangeWARNINGA timelocked action is queued in the V2 governance queue. Most queued actions are routine, so they are surfaced for review but do not page (the dangerous timelock-decrease case is the ERROR above).
Accept (V2 Vault)TimelockChangeWARNINGA previously queued V2 action clears its timelock and executes. High-volume routine governance flow; the risky specifics were already flagged when submitted, so acceptance is surfaced but not paged.
Revoke (V2 Vault)TimelockChangeINFOCancels a queued V2 action before it executes — a reversal, logged for completeness.
IncreaseTimelock (V2 Vault)TimelockChangeINFOLengthens the timelock on a V2 action selector — the safe direction, giving holders more time to react. Logged for visibility, not paged.
DecreaseTimelock (V2 Vault)TimelockChangeERRORShortens the timelock on a V2 action selector, weakening the safety window holders rely on. This is the dangerous direction — it has occurred, once dropping a selector's window to zero — so it pages.
Abdicate (V2 Vault)TimelockChangeERRORThe owner permanently gives up the ability to ever change a given action selector. It is irreversible, so even though it usually locks in a safer state, it pages so the renunciation can be confirmed as intended.
SetPerformanceFee (V2 Vault)ProtocolParameterChangeWARNINGChanges a V2 vault's performance fee, a bounded charge on yield that never touches deposited principal. A routine economic knob, surfaced for visibility, not paged.
SetManagementFee (V2 Vault)ProtocolParameterChangeWARNINGChanges a V2 vault's management fee, a bounded charge that never touches deposited principal. Surfaced for visibility, not paged.
SetPerformanceFeeRecipient (V2 Vault)ProtocolParameterChangeINFOChanges where a V2 vault's performance fee is sent — revenue routing only, with no effect on deposits or solvency. Logged for completeness.
SetManagementFeeRecipient (V2 Vault)ProtocolParameterChangeINFOChanges where a V2 vault's management fee is sent — revenue routing only. Logged for completeness.
AddAdapter (V2 Vault)ProtocolParameterChangeWARNINGAdds an adapter — a venue the vault can route funds into. New adapters are timelocked and constrained to a whitelisted registry, so an addition is surfaced for review but does not page.
RemoveAdapter (V2 Vault)ProtocolParameterChangeINFORemoves an adapter (only possible once its allocation is zero) — a de-risking step that takes a venue off the menu. Logged for completeness.
IncreaseAbsoluteCap (V2 Vault)ProtocolParameterChangeWARNINGRaises the absolute cap on how much the vault can allocate to an adapter — the main lever that increases exposure to a venue. Cap changes are timelocked, so the increase is surfaced for review but does not page.
DecreaseAbsoluteCap (V2 Vault)ProtocolParameterChangeINFOLowers an adapter's absolute allocation cap — a de-risking move that takes effect immediately. Logged for completeness.
IncreaseRelativeCap (V2 Vault)ProtocolParameterChangeWARNINGRaises the relative (percentage-of-vault) cap on an adapter, increasing how much of the vault may sit in that venue. Surfaced for review; not paged.
DecreaseRelativeCap (V2 Vault)ProtocolParameterChangeINFOLowers an adapter's relative cap — a de-risking move, logged for completeness.
SetReceiveSharesGate (V2 Vault)ProtocolParameterChangeWARNINGSets the gate controlling who may receive vault shares — a deposit-side restriction (e.g. an allowlist for new entrants). It cannot trap existing holders, so it is surfaced for visibility, not paged.
SetSendSharesGate (V2 Vault, gate set)ProtocolParameterChangeERRORSets a non-zero gate controlling who may send (transfer or redeem) vault shares — this can stop holders from exiting, so setting one pages.
SetSendSharesGate (V2 Vault, cleared)ProtocolParameterChangeINFOClears the send-shares gate back to open, removing the exit restriction. Logged for completeness.
SetReceiveAssetsGate (V2 Vault, gate set)ProtocolParameterChangeERRORSets a non-zero gate controlling who may receive assets when redeeming — this can block withdrawal payouts, so setting one pages.
SetReceiveAssetsGate (V2 Vault, cleared)ProtocolParameterChangeINFOClears the receive-assets gate, removing the payout restriction. Logged for completeness.
SetSendAssetsGate (V2 Vault)ProtocolParameterChangeWARNINGSets the gate controlling who may send assets into the vault — a deposit-side restriction that cannot trap existing holders. Surfaced for visibility, not paged.
SetMaxRate (V2 Vault)ProtocolParameterChangeWARNINGChanges the vault's maximum interest-accrual rate, a bounded accounting cap on how fast value can be booked. It cannot move funds, so it is surfaced for visibility, not paged.
SetForceDeallocatePenalty (V2 Vault)ProtocolParameterChangeWARNINGChanges the penalty (capped at 2%) that a user self-pays when forcing liquidity out of an adapter to exit. Bounded, and the fee accrues to the vault, so a change is surfaced for visibility, not paged.
SetAdapterRegistry (V2 Vault)ProtocolParameterChangeWARNINGSwaps the registry that whitelists which adapters the vault may use — a change to a core guardrail. It is double-timelocked, so it is surfaced for review but does not page.
SetLiquidityAdapterAndData (V2 Vault)ProtocolParameterChangeWARNINGSets which adapter serves as the vault's liquidity source, plus its routing data — high-volume allocator flow within existing caps. Surfaced for visibility, not paged.
ForceDeallocate (V2 Vault, ≥10% TVL)ProtocolParameterChangeWARNINGAnyone can call this to pull liquidity back into the vault's cash buffer and withdraw immediately, self-paying a capped (≤2%) fee that benefits other holders — normal behavior, not an attack. An unusually large pull (≥10% of the vault) raises a non-paging WARNING as a liquidity-stress signal.
ForceDeallocate (V2 Vault, <10% TVL)ProtocolParameterChangeINFOA routine permissionless force-deallocation: a user pulls liquidity into the buffer to withdraw, self-paying a capped (≤2%) fee that accrues to the vault. Logged for visibility; never pages.

Ondo (ondo)

  • Chain(s): Ethereum
  • Products: usdy, ousg (Blocklist and Safe multisig events are protocol-wide)
  • Contracts monitored:
    • USDY Token — 0x96f6ef951840721adbf46ac996b59e0235cb985c
    • USDY Manager — 0x25a103a1d6aec5967c1a4fe2039cdc514886b97e
    • USDY Oracle — 0xa0219aa5b31e65bc920b5b6dfb8edf0988121de0
    • OUSG Token — 0x1b19c19393e2d034d8ff31ff34c81252fcbbee92
    • OUSG InstantManager — 0x93358db73b6cd4b98d89c8f5f230e81a95c2643a
    • Blocklist — 0xd8c8174691d936e2c80114ec449037b13421b0a8
    • ProxyAdmin Owner Multisig — 0x1a694a09494e214a3be3652e4b343b7b81a73ad7
    • Management Multisig — 0xaed4caf2e535d964165b4392342f71bac77e8367
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (USDY)ContractUpgradeERRORUSDY proxy upgraded to new implementation
AdminChanged (USDY)AdminChangeERRORUSDY proxy admin changed
RoleGranted (USDY)RoleChangeWARNINGUSDY role granted
RoleRevoked (USDY)RoleChangeWARNINGUSDY role revoked
RoleAdminChanged (USDY)RoleChangeERRORUSDY role admin changed
AllowlistSet (USDY)ProtocolParameterChangeWARNINGUSDY allowlist contract changed
BlocklistSet (USDY)ProtocolParameterChangeWARNINGUSDY blocklist contract changed
SanctionsListSet (USDY)ProtocolParameterChangeWARNINGUSDY sanctions list contract changed
Paused (USDY)EmergencyActionCRITICALUSDY token paused
Unpaused (USDY)EmergencyActionCRITICALUSDY token unpaused
RoleGranted (USDY Manager)RoleChangeWARNINGUSDY Manager role granted
RoleRevoked (USDY Manager)RoleChangeWARNINGUSDY Manager role revoked
RoleAdminChanged (USDY Manager)RoleChangeERRORUSDY Manager role admin changed
MintFeeSetProtocolParameterChangeWARNINGUSDY mint fee changed
RedemptionFeeSetProtocolParameterChangeWARNINGUSDY redemption fee changed
MinimumDepositAmountSetProtocolParameterChangeINFOUSDY minimum deposit amount changed
MinimumRedemptionAmountSetProtocolParameterChangeINFOUSDY minimum redemption amount changed
OffChainRedemptionMinimumSetProtocolParameterChangeINFOUSDY off-chain redemption minimum changed
AssetSenderSetAdminChangeWARNINGUSDY Manager asset sender changed
FeeRecipientSetAdminChangeWARNINGUSDY Manager fee recipient changed
NewPricerSetAdminChangeWARNINGUSDY Manager pricer changed
BlocklistSet (USDY Manager)ProtocolParameterChangeWARNINGUSDY Manager blocklist contract changed
SanctionsListSet (USDY Manager)ProtocolParameterChangeWARNINGUSDY Manager sanctions list changed
SubscriptionPausedEmergencyActionWARNINGUSDY subscriptions (minting) paused
SubscriptionUnpausedEmergencyActionWARNINGUSDY subscriptions (minting) unpaused
RedemptionPausedEmergencyActionWARNINGUSDY redemptions paused
RedemptionUnpausedEmergencyActionWARNINGUSDY redemptions unpaused
OffChainRedemptionPausedEmergencyActionWARNINGUSDY off-chain redemptions paused
OffChainRedemptionUnpausedEmergencyActionWARNINGUSDY off-chain redemptions unpaused
RangeSet (USDY Oracle)ProtocolParameterChangeWARNINGUSDY oracle range set (new interest rate range)
RangeOverriden (USDY Oracle)ProtocolParameterChangeERRORUSDY oracle range overridden
RoleGranted (USDY Oracle)RoleChangeWARNINGUSDY Oracle role granted
RoleRevoked (USDY Oracle)RoleChangeWARNINGUSDY Oracle role revoked
RoleAdminChanged (USDY Oracle)RoleChangeERRORUSDY Oracle role admin changed
Paused (USDY Oracle)EmergencyActionWARNINGUSDY oracle paused
Unpaused (USDY Oracle)EmergencyActionWARNINGUSDY oracle unpaused
Upgraded (OUSG)ContractUpgradeERROROUSG proxy upgraded to new implementation
AdminChanged (OUSG)AdminChangeERROROUSG proxy admin changed
RoleGranted (OUSG)RoleChangeWARNINGOUSG role granted
RoleRevoked (OUSG)RoleChangeWARNINGOUSG role revoked
RoleAdminChanged (OUSG)RoleChangeERROROUSG role admin changed
KYCRegistrySetProtocolParameterChangeWARNINGOUSG KYC registry contract changed
KYCRequirementGroupSetProtocolParameterChangeWARNINGOUSG KYC requirement group changed
Paused (OUSG)EmergencyActionCRITICALOUSG token paused
Unpaused (OUSG)EmergencyActionCRITICALOUSG token unpaused
RoleGranted (OUSG InstantManager)RoleChangeWARNINGOUSG InstantManager role granted
RoleRevoked (OUSG InstantManager)RoleChangeWARNINGOUSG InstantManager role revoked
RoleAdminChanged (OUSG InstantManager)RoleChangeERROROUSG InstantManager role admin changed
MinimumDepositAmountSet (OUSG IM)ProtocolParameterChangeINFOOUSG InstantManager minimum deposit amount changed
MinimumRedemptionAmountSet (OUSG IM)ProtocolParameterChangeINFOOUSG InstantManager minimum redemption amount changed
MinimumRwaPriceSetProtocolParameterChangeWARNINGOUSG InstantManager minimum RWA price changed
OndoOracleSetContractUpgradeERROROUSG InstantManager oracle contract changed
OndoComplianceSetProtocolParameterChangeWARNINGOUSG InstantManager compliance contract changed
OndoIDRegistrySetProtocolParameterChangeWARNINGOUSG InstantManager ID registry changed
OndoRateLimiterSetProtocolParameterChangeWARNINGOUSG InstantManager rate limiter changed
OndoRedemptionFeesSetProtocolParameterChangeWARNINGOUSG InstantManager redemption fees contract changed
OndoSubscriptionFeesSetProtocolParameterChangeWARNINGOUSG InstantManager subscription fees contract changed
OndoTokenRouterSetContractUpgradeERROROUSG InstantManager token router changed
AcceptedRedemptionTokenSetProtocolParameterChangeWARNINGOUSG InstantManager redemption token added/removed
AcceptedSubscriptionTokenSetProtocolParameterChangeWARNINGOUSG InstantManager subscription token added/removed
AdminSubscriptionCheckerSetProtocolParameterChangeWARNINGOUSG InstantManager admin subscription checker changed
SubscribePausedEmergencyActionWARNINGOUSG instant subscriptions (minting) paused
SubscribeUnpausedEmergencyActionWARNINGOUSG instant subscriptions (minting) unpaused
RedeemPausedEmergencyActionWARNINGOUSG instant redemptions paused
RedeemUnpausedEmergencyActionWARNINGOUSG instant redemptions unpaused
OwnershipTransferred (Blocklist)AdminChangeERRORBlocklist ownership transferred
OwnershipTransferStarted (Blocklist)AdminChangeWARNINGBlocklist ownership transfer started
AddedOwner (Safe)MultisigChangeWARNINGOwner added to multisig
RemovedOwner (Safe)MultisigChangeWARNINGOwner removed from multisig
ChangedThreshold (Safe)MultisigChangeWARNINGMultisig threshold changed
EnabledModule (Safe)MultisigChangeWARNINGModule enabled on multisig
DisabledModule (Safe)MultisigChangeWARNINGModule disabled on multisig
ChangedGuard (Safe)MultisigChangeWARNINGGuard changed on multisig
ChangedFallbackHandler (Safe)MultisigChangeWARNINGFallback handler changed on multisig

Puffer (puffer)

  • Chain(s): Ethereum
  • Products: pufeth (governance/multisig/timelock incidents are protocol-wide)
  • Contracts monitored:
    • PufferVault (pufETH) — 0xD9A442856C234a39a81a089C06451EBAa4306a72
    • PufferWithdrawalManager — 0xDdA0483184E75a5579ef9635ED14BacCf9d50283
    • Timelock — 0x3C28B7c7Ba1A1f55c9Ce66b263B33B204f2126eA
    • AccessManager — 0x8c1686069474410E6243425f4a10177a94EBEE11
    • PufferOracle — 0x0BE2aE0edbeBb517541DF217EF0074FC9a9e994f
    • CommunityMultisig — 0x446d4d6b26815f9bA78B5D454E303315D586Cb2a
    • OperationsMultisig — 0xC0896ab1A8cae8c2C1d27d011eb955Cca955580d
    • PauserMultisig — 0x1ba8e3aA853F73ae8093E26B7B8F2520c3620Df4
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (Vault)ContractUpgradeERRORPufferVault (pufETH) proxy upgraded
AuthorityUpdated (Vault)AdminChangeCRITICALPufferVault authority (AccessManager) swapped — access-control takeover vector on the fund-bearing vault
ExitFeeBasisPointsSetProtocolParameterChangeWARNINGExit fee changed (basis points)
TreasuryExitFeeBasisPointsSetProtocolParameterChangeWARNINGTreasury exit fee changed (basis points)
UpdatedTotalRewardsAmountProtocolParameterChangeINFOTotal rewards updated (affects exchange rate)
DelayChanged (Timelock, decreased)TimelockChangeERRORTimelock delay decreased
DelayChanged (Timelock, increased)TimelockChangeWARNINGTimelock delay increased
TransactionQueuedTimelockChangeINFOTimelock transaction queued
TransactionExecutedTimelockChangeINFOTimelock transaction executed
TransactionCanceledTimelockChangeINFOTimelock transaction cancelled
PauserChanged (Timelock)AdminChangeERRORTimelock pauser changed
RoleGranted (AccessManager, ADMIN_ROLE)RoleChangeCRITICALRoot admin role granted — protocol root of trust
RoleGranted (AccessManager, powerful role)RoleChangeERRORPowerful protocol role granted (Puffer DAO, Puffer Protocol, Vault Withdrawer, pufETH Burner), or an unknown/unlabeled role (fail-loud)
RoleGranted (AccessManager, operational role)RoleChangeWARNINGOperational role granted (Operations Multisig/Paymaster, Withdrawal Finalizer, Revenue Depositor, VT_PRICER)
RoleRevoked (AccessManager, ADMIN_ROLE)RoleChangeERRORRoot admin role revoked
RoleRevoked (AccessManager, other role)RoleChangeWARNINGNon-root role revoked (risk-reducing)
RoleAdminChangedRoleChangeCRITICALAccessManager role-admin rewired — meta-authority over the permission system
RoleGuardianChangedRoleChangeWARNINGAccessManager role guardian changed
RoleLabelRoleChangeINFOAccessManager role labeled
RoleGrantDelayChangedTimelockChangeWARNINGAccessManager grant delay changed
TargetClosed (pufETH vault, closed)EmergencyActionCRITICALpufETH vault closed — live product pause, funds locked
TargetClosed (other target, closed)EmergencyActionERRORNon-core AccessManager target closed (paused)
TargetClosed (reopened)EmergencyActionWARNINGAccessManager target reopened (unpaused)
TargetAdminDelayUpdated (decreased)TimelockChangeERRORPer-target admin delay decreased — shrinks the observation window for admin ops
TargetAdminDelayUpdated (increased)TimelockChangeWARNINGPer-target admin delay increased (hardening)
TargetFunctionRoleUpdated (core target → PUBLIC_ROLE)RoleChangeERRORCore contract function opened to anyone (PUBLIC_ROLE)
TargetFunctionRoleUpdated (other)RoleChangeWARNINGAccessManager function-selector role updated
OperationScheduledTimelockChangeINFOAccessManager operation scheduled
OperationExecutedTimelockChangeINFOAccessManager operation executed
OperationCanceledTimelockChangeINFOAccessManager operation cancelled
AuthorityUpdated (Oracle)AdminChangeERRORPufferOracle authority updated
TotalNumberOfValidatorsUpdatedProtocolParameterChangeINFOTotal number of validators updated
ValidatorTicketMintPriceUpdated (dropped to zero)ProtocolParameterChangeERRORValidator ticket mint price dropped to zero — oracle-fault canary
ValidatorTicketMintPriceUpdated (non-zero move)ProtocolParameterChangeINFOValidator ticket mint price changed (off the pufETH-backing path — no peg/solvency signal)
AddedOwner (Safe)MultisigChangeERRORMultisig owner added
RemovedOwner (Safe)MultisigChangeERRORMultisig owner removed
ChangedThreshold (Safe)MultisigChangeCRITICALMultisig signing threshold changed
EnabledModule (Safe)MultisigChangeCRITICALMultisig module enabled — can bypass the owner-threshold check
DisabledModule (Safe)MultisigChangeERRORMultisig module disabled
ChangedGuard (Safe)MultisigChangeERRORMultisig guard changed
ChangedFallbackHandler (Safe)MultisigChangeERRORMultisig fallback handler changed
MaxWithdrawalAmountChangedProtocolParameterChangeWARNINGMax 2-step withdrawal amount changed
Upgraded (WithdrawalManager)ContractUpgradeERRORPufferWithdrawalManager proxy upgraded
AuthorityUpdated (WithdrawalManager)AdminChangeERRORPufferWithdrawalManager authority updated

Rocket Pool (rocketpool)

  • Chain(s): Ethereum
  • Products: reth
  • Contracts monitored:
    • rETH Token — 0xae78736cd615f374d3085123a210448e74fc6393
    • RocketStorage — 0x1d8f8f00cfa6758d7be78336684788fb0ee0fa46
    • RocketDAONodeTrustedUpgrade — 0x952999ec97248547d810fd6464fdb78855b022ab
    • RocketDAOProposal — 0x37714d3a9d3b3091220d68184e3afec4ec911368
    • RocketDAOProtocol — 0x0429cdd8ceace24d4dc2b97ce22a780a407df0e1
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
GuardianChangedAdminChangeERRORProtocol guardian (most privileged admin) changed
ContractUpgradedContractUpgradeERRORExisting protocol contract replaced
ContractAddedContractUpgradeWARNINGNew contract registered
ABIUpgradedContractUpgradeINFOABI upgraded
ABIAddedContractUpgradeINFONew ABI registered
ProposalExecutedProtocolParameterChangeWARNINGoDAO proposal executed (changes take effect)
ProposalAddedProtocolParameterChangeINFOoDAO proposal submitted
ProposalCancelledProtocolParameterChangeINFOoDAO proposal cancelled
BootstrapSettingUint (call)ProtocolParameterChangeWARNINGGuardian-only bootstrap uint setting changed
BootstrapSettingBool (call)ProtocolParameterChangeWARNINGGuardian-only bootstrap bool setting changed
BootstrapSettingAddress (call)ProtocolParameterChangeWARNINGGuardian-only bootstrap address setting changed
BootstrapDisable (call)AdminChangeERRORBootstrap mode disabled (governance transition)

Sky (sky)

  • Chain(s): Ethereum
  • Products: susds
  • Contracts monitored:
    • sUSDS Vault — 0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD
    • USDS Token — 0xdC035D45d973E3EC169d2276DDab16f1e407384F
    • GSM (MCD Pause) — 0xbE286431454714F511008713973d3B053A2d38f3
    • ESM (Emergency Shutdown Module) — 0x09e05fF6142F2f9de8B6B65855A1d56B6cfE4c58
    • End (Global Settlement) — 0x0e2e8f1D1326A4B9633D96222Ce399c708B19c28
    • Protego (Emergency Spells) — 0x5C9c3cb0490938c9234ABddeD37a191576ED8624
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
File (sUSDS Vault)ProtocolParameterChangeINFOsUSDS parameter changed (e.g. SSR)
Upgraded (sUSDS Vault)ContractUpgradeERRORsUSDS vault contract upgraded
Rely (sUSDS Vault)AdminChangeWARNINGsUSDS ward added
Deny (sUSDS Vault)AdminChangeWARNINGsUSDS ward removed
Rely (USDS Token)AdminChangeWARNINGUSDS ward added
Deny (USDS Token)AdminChangeWARNINGUSDS ward removed
Upgraded (USDS Token)ContractUpgradeERRORUSDS token contract upgraded
LogSetOwner (GSM)AdminChangeERRORGSM owner changed
LogSetAuthority (GSM)AdminChangeERRORGSM authority changed
setDelay call (GSM)TimelockChangeWARNINGGSM delay (timelock) changed
plot call (GSM)TimelockChangeWARNINGGovernance spell scheduled
exec call (GSM)TimelockChangeWARNINGGovernance spell executed
drop call (GSM)TimelockChangeWARNINGGovernance spell dropped
Fire (ESM)EmergencyActionCRITICALEmergency shutdown triggered
Join (ESM)EmergencyActionWARNINGMKR/SKY burned toward shutdown threshold
Rely (ESM)AdminChangeWARNINGESM ward added
Deny (ESM)AdminChangeWARNINGESM ward removed
Cage (End, no args)EmergencyActionCRITICALGlobal settlement initiated
Cage (End, collateral)EmergencyActionERRORCollateral type caged
Rely (End)AdminChangeWARNINGEnd ward added
Deny (End)AdminChangeWARNINGEnd ward removed
Thaw (End)EmergencyActionERRORGlobal settlement debt finalized
Deploy (Protego)EmergencyActionWARNINGEmergency drop spell deployed
Drop (Protego)EmergencyActionERRORGovernance plan dropped via Protego

Spark (spark)

  • Chain(s): Ethereum
  • Products: the 4 rated Spark products — spweth (SparkLend WETH market), wsteth (SparkLend wstETH market), spusdc and spusdt (ERC4626 savings vaults). Per-asset SparkLend events only escalate above INFO for the rated reserves (WETH, wstETH); changes on other reserves are tracked on the dashboard. Most governance/infra events are protocol-wide (product: "")
  • Contracts monitored:
    • Pool — 0xc13e21b648a5ee794902342038ff3adab66be987
    • PoolConfigurator — 0x542dba469bde58faee189ffb60c6b49ce60e0738
    • PoolAddressesProvider — 0x02c3ea4e34c0cbd694d2adfa2c690eecbc1793ee
    • ACLManager — 0xda135cd78a086025bcdc87b038a1c462032b510c
    • GovernanceExecutor — 0x3300f198988e4c9c63f75df86de36421f06af8c4
    • ALMFreezerMultisig — 0x90d8c80c028b4c09c0d8dcaab9bbb057f0513431
    • SparkFoundationMultisig — 0x92e4629a4510af5819d7d1601464c233599ff5ec
    • SparkLendFreezerMultisig — 0x44effc473e81632b12486866aa1678edbb7beec3
    • ALMProxy — 0x1601843c5e9bc251a3272907010afa41fa18347e
    • Oracle — 0x8105f69d9c41644c6a0803fda7d03aa70996cfd9
    • Treasury — 0xb137e7d16564c81ae2b0c8ee6b55de81dd46ece5
    • spUSDC Vault — 0x28b3a8fb53b741a8fd78c0fb9a6b2393d896a43d
    • spUSDT Vault — 0xe2e7a17dff93280dec073c995595155283e3c372
    • spWETH (aToken) — 0x59cd1c87501baa753d0b5b5ab5d8416a45cd71db
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
RoleGranted (ACLManager — DEFAULT_ADMIN)RoleChangeCRITICALA new address gains the root access-control key that administers every other ACL role — effectively whole-protocol control. Highest-trust change; pages at top urgency.
RoleGranted (ACLManager — POOL_ADMIN / EMERGENCY_ADMIN / ASSET_LISTING_ADMIN)RoleChangeERRORA new address gains a powerful privileged role: pool administration (including upgrading the aTokens that hold supplier funds), the ability to pause/freeze reserves, or authority to list new assets. Each can materially affect funds or availability, so it pages.
RoleGranted (ACLManager — RISK_ADMIN / BRIDGE)RoleChangeWARNINGA new address gains a bounded operational role — tuning risk parameters within limits, or bridge minting capped by configuration. Expected governance activity; recorded but not paged.
RoleGranted (ACLManager — FLASH_BORROWER)RoleChangeINFOA new address gains the flash-borrower role (fee-exempt flashloans). Low-power; dashboard-only.
RoleRevoked (ACLManager — DEFAULT_ADMIN / EMERGENCY_ADMIN / POOL_ADMIN)RoleChangeERRORA powerful role is removed from an address (e.g. de-authorizing an old admin during a governance migration). Pages to confirm against a known governance action.
RoleRevoked (ACLManager — other roles)RoleChangeWARNINGA bounded/operational role is removed. Privilege reduction is low-risk; recorded but not paged.
RoleAdminChanged (ACLManager)RoleChangeCRITICALChanges which role administers another ACL role — re-pointing this can hand control of an entire privilege branch (e.g. making a new role the admin of POOL_ADMIN). Restructures the permission hierarchy itself; pages at top urgency. Never fired on Spark.
Rely (GovernanceExecutor)AdminChangeERRORSky/Maker rely(usr) — authorizes a new address (wards[usr]=1) to call every auth-gated function on the governance executor that runs passed spells, i.e. grants governance-execution authority. Pages to confirm against governance. A tier below Aave's executor ownership transfer (CRITICAL) since it adds a ward rather than transferring sole ownership. 4 on-chain (deploy-time wiring of the Sky stack).
Deny (GovernanceExecutor)AdminChangeWARNINGSky/Maker deny(usr) — clears a ward (wards[usr]=0), removing that address's authority on the governance executor. The inverse of Rely; removing authority is risk-reducing, so recorded but not paged. 1 on-chain (deploy-time cleanup).
ACLAdminUpdated (PoolAddressesProvider)AdminChangeERRORChanges the registered ACL admin — the account treated as the access-control superuser (holds DEFAULT_ADMIN_ROLE on the ACLManager). Pages to confirm against governance. Matches Aave. 3 on-chain (early governance setup).
ACLManagerUpdated (PoolAddressesProvider)ContractUpgradeCRITICALPoints the protocol at a new ACLManager contract. Since the ACLManager is the registry of every role, this swaps the entire permission system at once (a malicious one could grant any role to anyone). Matches Aave. 1 on-chain (deploy).
PoolUpdated (PoolAddressesProvider)ContractUpgradeERRORRegistry-side announcement that the main Pool implementation was upgraded. The Pool holds all core lending logic (supply/borrow/withdraw/repay/liquidate, interest accrual), so it changes core behavior. Twins with the Pool proxy's own Upgraded. Matches Aave. 4 on-chain (SparkLend version upgrades).
PoolConfiguratorUpdated (PoolAddressesProvider)ContractUpgradeERRORUpgrades the implementation behind the PoolConfigurator proxy — the contract governance uses to set every per-reserve risk parameter (caps, collateral config, freeze/pause, fees, token upgrades). A tier below the ACLManager/Oracle swaps (it cannot itself move funds or forge prices). Matches Aave. 1 on-chain (deploy).
PriceOracleUpdated (PoolAddressesProvider)ContractUpgradeCRITICALPoints the protocol at a new price oracle contract. The oracle values all collateral and debt, so a malicious one can mark collateral to zero (liquidate everyone) or inflate it (drain the pool) — drives the market to insolvency. Matches Aave. Distinct from per-asset AssetSourceUpdated on the oracle. 1 on-chain (deploy).
PriceOracleSentinelUpdated (PoolAddressesProvider)ContractUpgradeERRORSets/replaces the PriceOracleSentinel, which gates borrows/liquidations during sequencer or oracle downtime (a grace-period so users aren't liquidated on stale prices). A bad one could allow liquidations on stale prices. A tier below the oracle itself (it gates timing, not prices). Matches Aave. 0 on-chain (trip-wire).
PoolDataProviderUpdated (PoolAddressesProvider)ContractUpgradeWARNINGSwaps the PoolDataProvider — a read-only aggregator UIs/integrators use to fetch reserve data. No fund-moving or risk logic, so recorded but not paged. Matches Aave. 1 on-chain (deploy).
OwnershipTransferred (AddressesProvider)AdminChangeCRITICALTransfers ownership of the PoolAddressesProvider — the root key that can swap the Pool, PoolConfigurator, ACLManager, and Oracle. This is SparkLend's root upgrade authority, so an ownership move is top-urgency. Matches Aave. 4 on-chain (early handoffs into the Sky governance pipeline).
ProxyCreated (PoolAddressesProvider)ContractUpgradeINFODeploys a new proxy for a registry id — first-time setup of a core contract (Pool, PoolConfigurator) at launch. Subsequent implementation changes are caught by the Updated events above. Matches Aave. 2 on-chain (deploy).
AddressSetAsProxy (PoolAddressesProvider)ContractUpgradeERRORSets/updates the implementation for a registry id via the provider's own managed proxy — a registry-driven upgrade of a core contract (same risk class as PoolUpdated/PoolConfiguratorUpdated). Matches Aave. 0 on-chain (trip-wire).
AddressSet (PoolAddressesProvider)ContractUpgradeERRORRegisters or changes a core address stored under a registry id (non-proxy variant — points an id directly at an address). A structural change to the protocol's wiring. Matches Aave. 0 on-chain (trip-wire).
ReserveFactorChangedProtocolParameterChangeINFO (WARNING if >50%)Sets a reserve's reserve factor — the % of borrow interest skimmed to the treasury vs. paid to suppliers. Purely an economic split; routine within the 5–50% band (INFO), only an abnormal >50% setting warns. Rated reserves carry their product key. Matches Aave. 32 on-chain (all routine).
FlashloanPremiumTotalUpdatedProtocolParameterChangeINFO (WARNING if >100bps)Sets the total flash-loan fee (bps). Historically 5–9 bps; only an anomalous >1% setting (misconfig/tampering) warns. Market-wide. Matches Aave. 3 on-chain (all routine).
FlashloanPremiumToProtocolUpdatedProtocolParameterChangeINFOSets the share of the flash-loan fee routed to the treasury (vs. suppliers) — a pure internal fee-split, no solvency/access impact. Matches Aave. 0 on-chain.
BridgeProtocolFeeUpdatedProtocolParameterChangeINFOSets the fee on bridged/'portal' unbacked liquidity (Aave cross-chain feature; unused on Spark). Matches Aave. 0 on-chain.
LiquidationProtocolFeeChangedProtocolParameterChangeINFO (WARNING if >30%)Sets the protocol's cut of the liquidation bonus for a reserve. Too high erodes liquidator incentive → stalled liquidations → bad-debt risk (gradual, so WARNING not ERROR above the band). Historical 0–20%. Rated reserves carry their product key. Matches Aave. 16 on-chain (all routine).
ATokenUpgradedContractUpgradeERRORUpgrades a reserve's aToken (deposit receipt that custodies supplier funds) implementation — fund-bearing code. Matches Aave. 0 on-chain.
StableDebtTokenUpgradedContractUpgradeERRORUpgrades a reserve's stable-debt-token (fixed-rate borrow positions) implementation. Spark v3.0.2 still ships stable-rate debt (no Aave-v3.2 analog). 0 on-chain.
VariableDebtTokenUpgradedContractUpgradeERRORUpgrades a reserve's variable-debt-token (variable-rate borrow positions) implementation. Matches Aave. 0 on-chain.
ReserveInterestRateStrategyChangedProtocolParameterChangeINFOPoints a reserve at a new interest-rate-strategy contract (the utilization→APR curve). Only changes rates going forward — cannot touch principal or collateral config — so dashboard-only. Rated reserves carry their product key. Matches Aave. 56 on-chain (frequent rate tuning).
ReservePaused (rated asset — paused)EmergencyActionCRITICALA rated reserve (WETH/wstETH) is paused — ALL actions blocked (supply/borrow/withdraw/repay/liquidate), so funds go dark. Top-urgency. Matches Aave. 0 on-chain.
ReservePaused (rated asset — unpaused)EmergencyActionWARNINGA rated reserve is unpaused (recovery). Matches Aave.
ReservePaused (non-rated asset)EmergencyActionINFOPause/unpause on a non-rated reserve — dashboard-only.
ReserveFrozen (rated asset — frozen)EmergencyActionERRORA rated reserve (WETH/wstETH) is frozen — blocks new supply/borrow but exit still allowed (one tier below pause). A de-risking signal worth confirming. Matches Aave. 0 on-chain (rated).
ReserveFrozen (rated asset — unfrozen)EmergencyActionWARNINGA rated reserve is unfrozen (recovery). Matches Aave.
ReserveFrozen (non-rated asset)EmergencyActionINFOFreeze/unfreeze on a non-rated reserve — routine risk-management, dashboard-only. 13 on-chain (all non-rated).
CollateralConfigurationChanged (rated asset — LT drop ≥500bps or LTV→0)ProtocolParameterChangeERRORA rated reserve's (WETH/wstETH) solvency config is tightened dangerously — liquidation threshold cut ≥5% or LTV set to 0. Lowering the threshold can make existing positions instantly liquidatable. Stateful (compares to prior on-chain config). Matches Aave/HyperLend. 0 on-chain (rated configs only ever loosened).
CollateralConfigurationChanged (rated asset — other)ProtocolParameterChangeWARNINGOther collateral-config change on a rated reserve (e.g. LTV/threshold raised). Recorded for visibility.
CollateralConfigurationChanged (non-rated asset)ProtocolParameterChangeINFOCollateral config change on a non-rated reserve — dashboard-only. 50 total on-chain.
BorrowCapChangedProtocolParameterChangeINFO (WARNING if a rated asset's cap is disabled →1)Sets the max total borrowable for a reserve (0=unlimited). Touches only new borrowing. A reduction to 1 (effectively disabled) on a rated asset is a wind-down canary → WARNING. Matches Aave. 498 on-chain — incl. one real signal: wstETH 17444→1 (block 23218585).
SupplyCapChangedProtocolParameterChangeINFO (WARNING if a rated asset's cap is disabled →1)Sets the max total suppliable for a reserve (0=unlimited). Same wind-down-canary logic. Matches Aave. 867 on-chain (all routine).
DebtCeilingChangedProtocolParameterChangeINFO (WARNING if a rated asset crosses the isolation boundary)Sets the isolation-mode debt ceiling (USD) for an isolated-collateral reserve. WARNING when a rated asset enters/exits isolation mode; else INFO. Matches Aave. 12 on-chain (none on rated).
SiloedBorrowingChangedProtocolParameterChangeWARNING (rated asset toggle) / INFO (non-rated)Toggles siloed borrowing — a siloed asset can only be borrowed alone. A real toggle on a rated reserve is a risk-posture change (WARNING); non-rated toggles and listing-time no-ops are INFO. Matches Aave. 15 on-chain.
EModeCategoryAddedProtocolParameterChangeERROR (rated-holding category, LT drop ≥500bps) / WARNING (rated-holding, other change) / INFODefines/updates an efficiency-mode category's LTV & liquidation threshold. For a position in the category, the category LT — not the per-asset LT — is binding, so a ≥500bps drop on a category that holds a rated asset (WETH/wstETH both sit in cat 1 "ETH", LT 93%) can make e-mode positions instantly liquidatable → ERROR. Stateful (compares to prior category LT). 4 on-chain (cat-1 LT only ever raised → 0 ERROR historically; clean trip-wire).
EModeAssetCategoryChangedProtocolParameterChangeERROR (rated asset removed, newCategory 0) / WARNING (rated added/moved) / INFO (non-rated)Assigns an asset to an e-mode category (or removes it). Removing a rated asset from e-mode collapses its effective LT from the category (93%) to its base value → mass-liquidation risk → ERROR. Adding/moving is governance-normal leverage → WARNING. 2 on-chain on rated assets (WETH & wstETH → cat 1 at launch).
Upgraded (Pool proxy)ContractUpgradeERRORERC1967 implementation swap on the main Pool proxy — the contract holding all core lending logic. Twins with PoolUpdated (registry-side). Matches Aave/HyperLend. 3 on-chain (SparkLend version upgrades).
Upgraded (spUSDC Vault proxy)ContractUpgradeERRORERC1967 implementation swap on the spUSDC savings-vault proxy — fund-bearing code on a rated product. Consistent with every fund-bearing proxy upgrade (Pool, aTokens, Treasury). 1 on-chain (setup).
RoleGranted (spUSDC Vault)RoleChangeCRITICAL (DEFAULT_ADMIN) / WARNING (SETTER, TAKER)Grants a vault role. DEFAULT_ADMIN controls the rated vault → CRITICAL; SETTER_ROLE (sets VSR/caps) and TAKER_ROLE (takes surplus) are bounded operational roles → WARNING. 5 on-chain (DEFAULT_ADMIN ×1, SETTER ×3, TAKER ×1).
RoleRevoked (spUSDC Vault)RoleChangeERROR (DEFAULT_ADMIN) / WARNING (others)Removes a vault role. Losing the admin key is notable (ERROR); other revokes are privilege reductions (WARNING). 2 on-chain.
RoleAdminChanged (spUSDC Vault)RoleChangeCRITICALChanges which role administers another vault role — restructures the vault's permission tree (consistent with the ACLManager decision). 0 on-chain (trip-wire).
DepositCapSet (spUSDC)ProtocolParameterChangeINFO (WARNING if cap →0)Sets the vault's max total deposits (0 = disabled here). Routine raises are INFO; a reduction to 0 (deposits disabled = wind-down) warns. 5 on-chain (all increases).
VsrSet (spUSDC)ProtocolParameterChangeINFOSets the Vault Savings Rate (depositor yield). Bounded on-chain by VsrBounds and economic-only, so dashboard-only regardless of value. On-chain range ~2.5–4.9% APY.
VsrBoundsSet (spUSDC)ProtocolParameterChangeINFO (WARNING if max bound raised)Sets the min/max the VSR may take — the governance guard-rail. Widening the max bound (what would enable an abnormal rate) warns; tightening is INFO. 1 on-chain (setup, max set to ~10% APY).
Upgraded (spUSDC Vault impl, UUPS)ContractUpgradeERRORUUPS self-upgrade of the spUSDC vault implementation (impl upgrades itself) — fund-bearing on a rated product. 1 on-chain.
Upgraded (spUSDT Vault proxy)ContractUpgradeERRORERC1967 implementation swap on the spUSDT savings-vault proxy — fund-bearing code on a rated product. Mirrors spUSDC. 1 on-chain.
RoleGranted (spUSDT Vault)RoleChangeCRITICAL (DEFAULT_ADMIN) / WARNING (SETTER, TAKER)Grants a vault role. DEFAULT_ADMIN controls the rated vault → CRITICAL; SETTER/TAKER → WARNING. Mirrors spUSDC. 5 on-chain.
RoleRevoked (spUSDT Vault)RoleChangeERROR (DEFAULT_ADMIN) / WARNING (others)Removes a vault role. Admin-key loss → ERROR; others → WARNING. Mirrors spUSDC. 2 on-chain.
RoleAdminChanged (spUSDT Vault)RoleChangeCRITICALChanges which role administers another vault role — restructures the permission tree. Mirrors spUSDC. 0 on-chain (trip-wire).
DepositCapSet (spUSDT)ProtocolParameterChangeINFO (WARNING if cap →0)Sets the vault's max total deposits (0 = disabled). Routine raises INFO; reduction to 0 (wind-down) warns. 5 on-chain (all increases).
VsrSet (spUSDT)ProtocolParameterChangeINFOSets the Vault Savings Rate. Bounded on-chain + economic-only → dashboard regardless. Fired 816× (automated) — confirms INFO. Range ~2.4–4.9% APY.
VsrBoundsSet (spUSDT)ProtocolParameterChangeINFO (WARNING if max bound raised)Sets the VSR guard-rail bounds. Widening the max bound warns; tightening INFO. 1 on-chain (setup).
Upgraded (spUSDT Vault impl, UUPS)ContractUpgradeERRORUUPS self-upgrade of the spUSDT vault implementation — fund-bearing. Mirrors spUSDC. 1 on-chain.
RoleGranted (ALMProxy)RoleChangeCRITICAL (DEFAULT_ADMIN) / WARNING (CONTROLLER, FREEZER) / INFO (RELAYER)Grants a role on the ALM (Spark Liquidity Layer) proxy that routes protocol liquidity. DEFAULT_ADMIN controls the router → CRITICAL; CONTROLLER routes liquidity but is rotated routinely (11× on-chain) → WARNING (not a page); FREEZER → WARNING; RELAYER (operational executor) → INFO. Not a rated product. 12 on-chain (DEFAULT_ADMIN ×1, CONTROLLER ×11).
RoleRevoked (ALMProxy)RoleChangeERROR (DEFAULT_ADMIN) / WARNING (others)Removes an ALM role. Admin-key loss → ERROR; others → WARNING. 10 on-chain.
RoleAdminChanged (ALMProxy)RoleChangeCRITICALChanges which role administers another ALM role — restructures the permission tree (consistent with all RoleAdminChanged). 0 on-chain (trip-wire).
AssetSourceUpdated (rated asset)ContractUpgradeERRORReplaces the price-feed source (e.g. Chainlink aggregator) for a rated asset (WETH/wstETH). A manipulation vector — a malicious feed can misprice the asset and trigger bad liquidations. A tier below the whole-oracle swap (CRITICAL). 7 on-chain on rated assets (legitimate feed migrations).
AssetSourceUpdated (non-rated asset)ContractUpgradeINFOPrice-feed source change on a non-rated reserve — dashboard-only. 33 total on-chain.
BaseCurrencySet (Oracle)ProtocolParameterChangeWARNINGSets the oracle's base/quote currency and its unit (e.g. USD, 8-decimal) — the denomination all prices are reported in. One-time foundational config. 1 on-chain (deploy).
FallbackOracleUpdated (Oracle)ContractUpgradeWARNINGSets/replaces the fallback oracle, queried only when a primary feed returns no/zero price — dormant while feeds are healthy. A tier below the live-path oracle events (it activates only during a primary-feed outage). 1 on-chain (deploy).
AdminChanged (Treasury)AdminChangeCRITICALChanges the proxy admin of the Treasury — the account allowed to upgrade its implementation. A malicious upgrade could drain protocol reserves, so it pages at top tier (consistent with how every upgrade-to-drain proxy-admin key is treated). 1 on-chain (early governance handoff).
Upgraded (Treasury)ContractUpgradeERRORERC1967 implementation swap on the Treasury proxy (the act event 56's admin can perform). Kept at ERROR for consistency with all other proxy Upgraded events — CRITICAL is reserved for the control/key moves (the AdminChanged that grants upgrade rights). 0 on-chain (never upgraded).
AddedOwner (Safe)MultisigChangeERRORA signer is added to a Spark admin Safe (ALMFreezer / Foundation / SparkLendFreezer) — changes the multisig's trust set. Pages to confirm against governance. Matches HyperLend/Moonwell. 10 on-chain across safes.
RemovedOwner (Safe)MultisigChangeERRORA signer is removed from a Spark admin Safe. Matches HyperLend/Moonwell. 6 on-chain.
ChangedThreshold (Safe)MultisigChangeCRITICALChanges M in the M-of-N requirement. Lowering it can hand fewer parties unilateral control. Matches HyperLend/Moonwell. 4 on-chain.
EnabledModule (Safe)MultisigChangeCRITICALEnables a module that executes through the Safe bypassing owner signatures entirely — the most dangerous Safe change. Matches HyperLend/Moonwell. 0 on-chain (trip-wire).
DisabledModule (Safe)MultisigChangeERRORDisables a previously-enabled module. Execution-surface change. Matches HyperLend/Moonwell. 0 on-chain.
ChangedGuard (Safe)MultisigChangeERRORSets/removes the transaction guard that gates every Safe txn (a malicious guard can freeze the Safe). Matches HyperLend/Moonwell. 0 on-chain.
ChangedFallbackHandler (Safe)MultisigChangeERRORSets the fallback handler (callable surface, e.g. EIP-1271 signature validation). Matches HyperLend/Moonwell. 0 on-chain.
Upgraded (spWETH aToken proxy)ContractUpgradeERRORERC1967 implementation swap on the spWETH aToken proxy — the SparkLend WETH-market deposit receipt (rated product spweth). Fund-bearing code. 0 on-chain.
Initialized (spWETH aToken impl)ContractUpgradeINFOOne-time aToken initializer (sets underlying, pool, treasury, incentives controller, decimals, name/symbol). Setup metadata, not a risk event.

Stader (stader)

  • Chain(s): Ethereum
  • Products: ethx (ProxyAdmin, Timelock, and Safe multisig events are protocol-wide)
  • Contracts monitored:
    • ETHx Token — 0xa35b1b31ce002fbf2058d22f30f95d405200a15b
    • StakingPoolManager — 0xcf5ea1b38380f6af39068375516daf40ed70d299
    • UserWithdrawalManager — 0x9f0491b32dbce587c50c4c43ab303b06478193a7
    • Stader Oracle — 0xf64bae65f6f2a5277571143a24faafdfc0c2a737
    • StaderConfig — 0x4abef2263d5a5ed582fc9a9789a41d85b68d69db
    • PermissionlessPool — 0xd1a72bd052e0d65b7c26d3dd97a98b74acbbb6c5
    • PermissionedPool — 0x09134c643a6b95d342bdaf081fa473338f066572
    • SDCollateral — 0x7af4730cc8ebad1a050dcad5c03c33d2793ee91f
    • CommunityMultisig (6-of-9) — 0x45b977cecb9dfaa17dfcba88826ef684b8489ff6
    • ManagerMultisig (3-of-5) — 0xaafb31780e4b9c95bc920e388f4925a874cd07af
    • ProxyAdmin — 0x67b12264ca3e0037fc7e22f2457b42643a04c86e
    • Timelock (7-day) — 0x1112d5c55670cb5144bf36114c20a122908068b9
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (each of 8 proxies)ContractUpgradeERRORProxy implementation upgraded
AdminChanged (each of 8 proxies)AdminChangeERRORProxy admin changed
OwnershipTransferred (ProxyAdmin)AdminChangeERRORProxyAdmin ownership transferred (controls upgrade authority for all proxies)
MinDelayChange (Timelock, decreased)TimelockChangeERRORTimelock min delay decreased
MinDelayChange (Timelock, increased)TimelockChangeWARNINGTimelock min delay increased
CallScheduled (Timelock)TimelockChangeWARNINGTimelock call scheduled
CallExecuted (Timelock)TimelockChangeINFOTimelock call executed
Cancelled (Timelock)TimelockChangeINFOTimelock call cancelled
RoleGranted (Timelock)RoleChangeWARNINGTimelock role granted
RoleRevoked (Timelock)RoleChangeWARNINGTimelock role revoked
RoleAdminChanged (Timelock)RoleChangeERRORTimelock role admin changed
AddedOwner (Safe)MultisigChangeWARNINGMultisig owner added
RemovedOwner (Safe)MultisigChangeWARNINGMultisig owner removed
ChangedThreshold (Safe)MultisigChangeWARNINGMultisig threshold changed
EnabledModule (Safe)MultisigChangeWARNINGMultisig module enabled
DisabledModule (Safe)MultisigChangeWARNINGMultisig module disabled
ChangedGuard (Safe)MultisigChangeWARNINGMultisig guard changed
ChangedFallbackHandler (Safe)MultisigChangeWARNINGMultisig fallback handler changed
RoleGranted (StaderConfig)RoleChangeWARNINGStaderConfig role granted
RoleRevoked (StaderConfig)RoleChangeWARNINGStaderConfig role revoked
RoleAdminChanged (StaderConfig)RoleChangeERRORStaderConfig role admin changed
SetAccountAdminChangeWARNINGStaderConfig account address rotated
SetContractContractUpgradeERRORStaderConfig contract address rotated (upgrade-by-pointer)
SetTokenContractUpgradeERRORStaderConfig token address rotated
SetConstantProtocolParameterChangeWARNINGStaderConfig constant updated
SetVariableProtocolParameterChangeWARNINGStaderConfig variable updated
RoleGranted (ETHx)RoleChangeWARNINGETHx role granted
RoleRevoked (ETHx)RoleChangeWARNINGETHx role revoked
RoleAdminChanged (ETHx)RoleChangeERRORETHx role admin changed
Paused (ETHx)EmergencyActionCRITICALETHx token paused (mints/burns/transfers halted)
Unpaused (ETHx)EmergencyActionWARNINGETHx token unpaused
RoleGranted (StakingPoolManager)RoleChangeWARNINGStakingPoolManager role granted
RoleRevoked (StakingPoolManager)RoleChangeWARNINGStakingPoolManager role revoked
RoleAdminChanged (StakingPoolManager)RoleChangeERRORStakingPoolManager role admin changed
Paused (StakingPoolManager)EmergencyActionCRITICALStakingPoolManager paused (deposits halted)
Unpaused (StakingPoolManager)EmergencyActionWARNINGStakingPoolManager unpaused
UpdatedExcessETHDepositCoolDownProtocolParameterChangeINFOStakingPoolManager excess ETH deposit cooldown updated
UpdatedStaderConfig (StakingPoolManager)ContractUpgradeERRORStakingPoolManager StaderConfig pointer rotated
RoleGranted (UserWithdrawalManager)RoleChangeWARNINGUserWithdrawalManager role granted
RoleRevoked (UserWithdrawalManager)RoleChangeWARNINGUserWithdrawalManager role revoked
RoleAdminChanged (UserWithdrawalManager)RoleChangeERRORUserWithdrawalManager role admin changed
Paused (UserWithdrawalManager)EmergencyActionCRITICALUserWithdrawalManager paused (withdrawal requests halted)
Unpaused (UserWithdrawalManager)EmergencyActionWARNINGUserWithdrawalManager unpaused
UpdatedFinalizationBatchLimitProtocolParameterChangeINFOWithdrawal finalization batch limit updated
UpdatedStaderConfig (UserWithdrawalManager)ContractUpgradeERRORUserWithdrawalManager StaderConfig pointer rotated
TrustedNodeAddedMultisigChangeWARNINGOracle TrustedNode added (Oracle multisig membership change)
TrustedNodeRemovedMultisigChangeWARNINGOracle TrustedNode removed (Oracle multisig membership change)
TrustedNodeChangeCoolingPeriodUpdatedProtocolParameterChangeINFOOracle TrustedNode change cooling period updated
SafeModeEnabledEmergencyActionCRITICALOracle Safe Mode enabled (withdrawals disabled)
SafeModeDisabledEmergencyActionWARNINGOracle Safe Mode disabled
Paused (Oracle)EmergencyActionCRITICALOracle paused
Unpaused (Oracle)EmergencyActionWARNINGOracle unpaused
UpdatedERChangeLimitProtocolParameterChangeWARNINGOracle exchange-rate change limit updated
UpdateFrequencyUpdatedProtocolParameterChangeINFOOracle update frequency changed
ERDataSourceToggledProtocolParameterChangeWARNINGOracle exchange-rate data source toggled (PoR-based)
ERInspectionModeActivatedEmergencyActionWARNINGOracle ER inspection mode activated
RoleGranted (Oracle)RoleChangeWARNINGOracle role granted
RoleRevoked (Oracle)RoleChangeWARNINGOracle role revoked
RoleAdminChanged (Oracle)RoleChangeERROROracle role admin changed
UpdatedStaderConfig (Oracle)ContractUpgradeERROROracle StaderConfig pointer rotated
RoleGranted (PermissionlessPool)RoleChangeWARNINGPermissionlessPool role granted
RoleRevoked (PermissionlessPool)RoleChangeWARNINGPermissionlessPool role revoked
RoleAdminChanged (PermissionlessPool)RoleChangeERRORPermissionlessPool role admin changed
UpdatedCommissionFees (PermissionlessPool)ProtocolParameterChangeWARNINGPermissionless pool commission fees updated
UpdatedStaderConfig (PermissionlessPool)ContractUpgradeERRORPermissionlessPool StaderConfig pointer rotated
RoleGranted (PermissionedPool)RoleChangeWARNINGPermissionedPool role granted
RoleRevoked (PermissionedPool)RoleChangeWARNINGPermissionedPool role revoked
RoleAdminChanged (PermissionedPool)RoleChangeERRORPermissionedPool role admin changed
UpdatedCommissionFees (PermissionedPool)ProtocolParameterChangeWARNINGPermissioned pool commission fees updated
UpdatedStaderConfig (PermissionedPool)ContractUpgradeERRORPermissionedPool StaderConfig pointer rotated
RoleGranted (SDCollateral)RoleChangeWARNINGSDCollateral role granted
RoleRevoked (SDCollateral)RoleChangeWARNINGSDCollateral role revoked
RoleAdminChanged (SDCollateral)RoleChangeERRORSDCollateral role admin changed
UpdatedPoolThresholdProtocolParameterChangeWARNINGSDCollateral pool threshold updated
SDSlashedEmergencyActionWARNINGSD operator collateral slashed
UpdatedStaderConfig (SDCollateral)ContractUpgradeERRORSDCollateral StaderConfig pointer rotated

StakeWise (stakewise)

  • Chain(s): Ethereum
  • Products: oseth, plus protocol-wide for Keeper/VaultsRegistry/Multisig governance contracts
  • Contracts monitored:
    • OsToken (osETH) — 0xf1C9acDc66974dFB6dEcB12aA385b9cD01190E38
    • OsTokenVaultController — 0x2A261e60FB14586B474C208b1B7AC6D0f5000306
    • Keeper — 0x6B5815467da09DaA7DC83Db21c9239d98Bb487b5
    • VaultsRegistry — 0x3a0008a588772446f6e656133C2D5029CC4FC20E
    • OsTokenConfig — 0x287d1e2A8dE183A8bf8f2b09Fa1340fBd766eb59
    • OsTokenVaultEscrow — 0x09e84205DF7c68907e619D07aFD90143c5763605
    • OsTokenRedeemer — 0xdF3123dD182b8d3e0266a2DC37eEb8366d149B5A
    • StakeWise Multisig (4-of-7) — 0x144a98cb1cdbb23610501fe6108858d9b7d24934
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
OwnershipTransferred (OsToken)AdminChangeERRORosETH ownership transferred
OwnershipTransferStarted (OsToken)AdminChangeWARNINGosETH ownership transfer started
ControllerUpdated (OsToken)RoleChangeWARNINGosETH controller enabled/disabled (mint/burn authority)
OwnershipTransferred (OsTokenVaultController)AdminChangeERROROsTokenVaultController ownership transferred
OwnershipTransferStarted (OsTokenVaultController)AdminChangeWARNINGOsTokenVaultController ownership transfer started
FeePercentUpdated (OsTokenVaultController)ProtocolParameterChangeWARNINGosETH fee percent updated
CapacityUpdated (OsTokenVaultController)ProtocolParameterChangeWARNINGosETH minting capacity updated
TreasuryUpdated (OsTokenVaultController)ProtocolParameterChangeWARNINGosETH treasury address updated
KeeperUpdated (OsTokenVaultController)ContractUpgradeERRORKeeper address updated (critical infrastructure)
OwnershipTransferred (Keeper)AdminChangeERRORKeeper ownership transferred
OwnershipTransferStarted (Keeper)AdminChangeWARNINGKeeper ownership transfer started
OracleAdded (Keeper)RoleChangeWARNINGKeeper oracle added
OracleRemoved (Keeper)RoleChangeWARNINGKeeper oracle removed
RewardsMinOraclesUpdated (Keeper)ProtocolParameterChangeWARNINGRewards min oracles updated
ValidatorsMinOraclesUpdated (Keeper)ProtocolParameterChangeWARNINGValidators min oracles updated
ConfigUpdated (Keeper)ProtocolParameterChangeINFOKeeper config updated (IPFS hash)
OwnershipTransferred (VaultsRegistry)AdminChangeERRORVaultsRegistry ownership transferred
OwnershipTransferStarted (VaultsRegistry)AdminChangeWARNINGVaultsRegistry ownership transfer started
VaultImplAdded (VaultsRegistry)ContractUpgradeWARNINGVault implementation added
VaultImplRemoved (VaultsRegistry)ContractUpgradeWARNINGVault implementation removed
FactoryAdded (VaultsRegistry)ContractUpgradeWARNINGVault factory added
FactoryRemoved (VaultsRegistry)ContractUpgradeWARNINGVault factory removed
VaultAdded (VaultsRegistry)ContractUpgradeINFONew vault registered
OwnershipTransferred (OsTokenConfig)AdminChangeERROROsTokenConfig ownership transferred
OwnershipTransferStarted (OsTokenConfig)AdminChangeWARNINGOsTokenConfig ownership transfer started
OsTokenConfigUpdated (OsTokenConfig)ProtocolParameterChangeWARNINGLTV/liquidation threshold/bonus parameters updated
RedeemerUpdated (OsTokenConfig)RoleChangeWARNINGRedeemer updated
OwnershipTransferred (OsTokenVaultEscrow)AdminChangeERROROsTokenVaultEscrow ownership transferred
OwnershipTransferStarted (OsTokenVaultEscrow)AdminChangeWARNINGOsTokenVaultEscrow ownership transfer started
AuthenticatorUpdated (OsTokenVaultEscrow)RoleChangeWARNINGEscrow authenticator updated
LiqConfigUpdated (OsTokenVaultEscrow)ProtocolParameterChangeWARNINGEscrow liquidation config updated
OwnershipTransferred (OsTokenRedeemer)AdminChangeERROROsTokenRedeemer ownership transferred
OwnershipTransferStarted (OsTokenRedeemer)AdminChangeWARNINGOsTokenRedeemer ownership transfer started
PositionsManagerUpdated (OsTokenRedeemer)RoleChangeWARNINGPositions manager updated
AddedOwner (Multisig)MultisigChangeWARNINGMultisig owner added
RemovedOwner (Multisig)MultisigChangeWARNINGMultisig owner removed
ChangedThreshold (Multisig)MultisigChangeWARNINGMultisig threshold changed
EnabledModule (Multisig)MultisigChangeWARNINGMultisig module enabled
DisabledModule (Multisig)MultisigChangeWARNINGMultisig module disabled
ChangedGuard (Multisig)MultisigChangeWARNINGMultisig guard changed
ChangedFallbackHandler (Multisig)MultisigChangeWARNINGMultisig fallback handler changed

USD.ai (usdai)

  • Chain(s): Arbitrum One
  • Products: susdai, usdai. sUSDai is the yield-bearing ERC-7540 vault and carries the credit exposure — it is the senior-tranche lender on the loan book. Governance, oracle, timelock, ProxyAdmin, Safe and bridge events are protocol-wide and apply to both products
  • Contracts monitored: 28. The V2 lending stack replaced V1 on 2026-06-26; both generations are monitored, V1 so its remaining positions and history stay visible
    • Products — sUSDai Vault 0x0b2b2b2076d95dda7817e785989fe353fe955ef9, USDai Token 0x0a1a1a107e45b7ced86833863f482bc5f4ed82ef
    • Lending stack (V2, live) — LoanRouter V2 0x1c2ed170de32846316784c4fd58a5e3c7563e12f, DepositTimelock V2 0x1d710cc0c435ba6e27abc82a51dfbca17c41fe3c, EscrowTimelock V2 0x1e710cc0b64e1d7572d35e43ad261587789b6438
    • Lending stack (V1, superseded) — LoanRouter V1 0x0c2ed170f2bb1df1a44292ad621b577b3c9597d1, DepositTimelock V1 0x0d710cc05f34d2ead9fba3c78d53d76a0623c9f8
    • Yield — BaseYieldEscrow 0x9ddfd49ac4689cf894203794d792dcb38e4b1a9e
    • Pricing — Price Oracle 0xd40a5298c6fced81eb5da8bb1f9328b16f741ebc
    • Governance — Chip Governor 0x0ddc1dd03c58e425f96567679b52f349db847b26, CHIP Token 0x0c1c1c109fe34733fca54b82d7b46b75cfb71f6e, Governance Timelock 0x0eec1ee03add82342a6ac68a9c5cf62cb2398221, Upgrade Timelock 0x0eea1ee08611ff4a4e83bfe3916712751995639b
    • Cross-chain — BridgeAdapter (LayerZero OFT) 0xffb20098fd7b8e84762eea4609f299d101427f24 (immutable, not a proxy)
    • Nine ProxyAdmins — sUSDai 0x0b3296b6f50611b28d466a6d5a49754dad4d8d9f, USDai 0x2ddf39c731377adcfa7f2a056ac60a8a81aadc3c, CHIP 0xaa93f045b057ac64f79ae3f7d115cd3880e854d9, LoanRouter V1 0xf53ae82727d40fefbf6088212e1fd7354a63b212, LoanRouter V2 0x506e15026a449103ca35616712c3434b2834ce35, DepositTimelock V1 0x86d266c383437e496c2972a02e379d7457688f15, DepositTimelock V2 0xfb7f94c6c3a3513d4da19a35d4711500bea19cbd, EscrowTimelock V2 0x8701a738af540d6115ea7262098c66fb8ce8f54f, BaseYieldEscrow 0xbbc62c75b72b233aa8d878adc4530bc495d055a3. The owner of each decides whether an upgrade is delayed at all — three (sUSDai, USDai, CHIP) are owned by the Upgrade Timelock; the six on the lending stack are owned directly by a 3-of-3 Safe with no delay
    • Five Safes — STRATEGY_ADMIN (3-of-4) 0xe7e53f940f8242fec57cbe88054463d4944b3670, DEFAULT_ADMIN (3-of-3) 0x5f0bc72fb5952b2f3f2e11404398ed507b25841f, upgrade-executor (3-of-3) 0x783b08aa21de056717173f72e04be0e91328a07b, PAUSE_ADMIN (2-of-3) 0x3a32e198cafeb0fcd061ac0c9d8a2256bccab872, ORIGINATOR (3-of-4) 0x844bb7b6223f6af028189bb34d6341a5733d6286
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
Upgraded (any of the nine proxies)ContractUpgradeERRORThe implementation behind a proxy is replaced while funds and storage stay in the unchanged proxy. Every upgrade pages so it can be matched to a known change. The alert also reports the previous implementation and the upgrade path — both read from chain state at the block of the upgrade itself, not at alert time, because six of the nine ProxyAdmins are owned directly by a Safe with no delay, and ownership has moved twice. A backfilled 2025 upgrade must not be described using today's ownership.
Initialized (version 1)ContractUpgradeINFOAn upgradeable contract cannot use a constructor, so OpenZeppelin replaces it with a one-shot initialize(). Version 1 is that first call, emitted inside the contract's own deployment transaction, when there is no prior state, no users and no funds. It means "this contract now exists" and is recorded for completeness only.
Initialized (version > 1)ContractUpgradeERRORA reinitializer — an upgrade shipped code that rewrote live storage on a contract that already holds state and user funds. Unlike an implementation swap this is not undoable by a further upgrade, because rolling back the code does not roll back the storage. Three have occurred; one of them ran with no accompanying Upgraded in the same transaction, i.e. live storage mutated outside an upgrade window, which is exactly why this is separated from the genesis case rather than blended with it.
AdminChanged (any proxy)AdminChangeERRORThe ProxyAdmin registered against a proxy is replaced — a change to who may upgrade this contract at all. A root-of-trust change, so it always pages.
OwnershipTransferred (any of the nine ProxyAdmins)AdminChangeCRITICALOwnership of a ProxyAdmin moves. Its owner is the single key that can replace the implementation of the contract behind it — for the sUSDai and USDai ProxyAdmins that means the code custodying every depositor's funds. Legitimate transfers happen only during a governance migration, so any other occurrence is a top-urgency, funds-at-risk event.
OwnershipTransferred (BridgeAdapter)AdminChangeCRITICALOwnership of the LayerZero OFT adapter moves. The owner sets which remote chains and addresses are trusted peers, so control of it is control of cross-chain USDai minting. The adapter is immutable — it has no ProxyAdmin — making ownership its only lever, and therefore total.
RoleGranted / RoleRevoked (DEFAULT_ADMIN_ROLE or BLACKLIST_ADMIN_ROLE)RoleChangeERRORThe two sweeping roles. DEFAULT_ADMIN_ROLE is the root key that administers every other role on that contract. BLACKLIST_ADMIN_ROLE gates setBlacklist on the USDai token and has never been held by anyone — so a grant is the only advance warning that USDai has gained a working censorship power. Escalation keys off the role, never off which contract emitted it.
RoleGranted / RoleRevoked (any other role)RoleChangeWARNINGA bounded operational role changes hands — strategy administration, pausing, liquidation, origination, deposit or escrow administration, or a timelock proposer/executor/canceller. Expected governance activity, recorded for visibility without paging. Seventeen role names are decoded; two hashes on this stack have never resolved to a preimage and are reported as raw bytes32 rather than labelled speculatively.
RoleAdminChanged (any AccessControl contract)RoleChangeERRORThe rule for who may grant or revoke a role is rewired — a structural change to the access-control graph rather than to who holds a role. A privilege-escalation vector and not part of normal operations, so it always pages.
Paused (sUSDai, USDai, either LoanRouter)EmergencyActionCRITICALAn emergency halt. On the vault it stops deposits and redemption-queue processing, so holders cannot exit; on the token it stops transfers; on a router it stops new origination. Whether protective incident response or hostile, it pages immediately.
Unpaused (sUSDai, USDai, either LoanRouter)EmergencyActionCRITICALThe protocol is taken out of pause. Held at the same tier as the pause deliberately: on this stack an unpause is the moment user funds become movable again, and confirming who performed it matters as much as the halt itself.
BlacklistUpdated (USDai)EmergencyActionERRORAn address is frozen or unfrozen on the USDai token. A notBlacklisted modifier reverts for frozen addresses and sUSDai gates withdraw, redeem and setOperator on it too, so a frozen holder cannot exit. Flat rather than conditional because the payload is an address and a boolean — the significance of the target is not knowable from it. Structurally incomplete as a signal: isBlacklisted() also falls through to native USDC's isBlacklisted() and USD₮0's isBlocked(), so USDai inherits Circle's and Tether's lists and those changes emit nothing here. sUSDai itself is hardcoded exempt and can never be frozen.
HookFailed (either LoanRouter)EmergencyActionCRITICALThe router called sUSDai's loan-accounting hook, the call reverted, and the router swallowed the error and continued. Cash moved while the vault's view of its own loan state may not have updated — a silent accounting divergence between the two contracts that no other event reports.
TransferFailed (either LoanRouter)EmergencyActionCRITICALA transfer to its intended recipient failed and the funds were sent somewhere else instead. Money reaching an address other than the one the protocol selected is a direct funds-at-risk condition.
ERC20Rescued (LoanRouter V2)EmergencyActionERRORAn admin sweeps an arbitrary ERC-20 balance out of the router to a chosen address. Intended for tokens sent by mistake, but it is a discretionary withdrawal path from a contract that handles loan cash, so every use pages for confirmation that it moved only stranded tokens.
LoanLiquidated (either LoanRouter)EmergencyActionCRITICALCollateral has been seized and the outcome is not yet known — the time-sensitive moment in a default. The recovery figures arrive later in separate events.
LoanBreached (LoanRouter V2)EmergencyActionERRORA loan is declared in breach of its terms by a LIQUIDATOR_ROLE holder — the step before liquidation. An early warning on the vault's credit exposure.
LoanCollateralLiquidated (V1) / LiquidationProceedsDeposited (V2)EmergencyActionERRORProceeds from liquidated collateral arrive, reporting the gross recovery, the liquidation fee and any surplus. Deliberately one tier below LoanLiquidated, which already paged on the same default — paging twice on one event was rejected. The payload carries what was recovered but not what was owed, so a shortfall cannot be computed on chain and no conditional is possible.
LenderLiquidationRepaid (either LoanRouter)EmergencyActionERRORWhat one tranche actually got back after a liquidation. Since sUSDai is the senior-tranche lender, this is the vault's realised recovery. Flat for the same reason: the amount owed is absent from the payload.
LoanMigratedOut (V1) / LoanMigrated (V2)ProtocolParameterChangeERRORA loan moves between router generations — the most directly readable signal that the lending stack itself has changed. The router address is an immutable constructor parameter, so a router swap otherwise surfaces only as an ordinary Upgraded on sUSDai and cannot be identified without decoding constructor arguments off chain. This event says it outright. All 17 occurrences fell inside one week during the June 2026 V1→V2 migration.
LoanOriginated (either LoanRouter)ProtocolParameterChangeINFOA new loan is written. The alert decodes the borrower, the currency, the collateral count and each tranche's principal and annualised rate, and reports the vault's own exposure aggregated across whichever tranches it holds. Routine business activity, so it is tracked rather than paged.
LoanRepaid (either LoanRouter, loan closure only)ProtocolParameterChangeINFOA loan is fully repaid and closed. The handler fires only on closure, not on each instalment — instalments are roughly 36× more frequent and carry no distinct risk signal.
LoanRefinanced (LoanRouter V2, both signatures)ProtocolParameterChangeWARNINGExisting loan terms are replaced — rate, duration, tranches or collateral can all change, and cash may move in either direction. It rewrites an existing credit position rather than creating a new one, so it is surfaced for review without paging. Two signatures are monitored because a July 2026 upgrade changed the event's shape.
LenderPositionMinted / LenderPositionsBurned (either LoanRouter)ProtocolParameterChangeINFOThe ERC-721 position tokens representing a lender's claim on a tranche are issued or retired. Bookkeeping that accompanies origination and closure, both of which carry their own entries.
FeePaid (LoanRouter V2)ProtocolParameterChangeINFOA fee is actually paid, naming which kind (origination, repayment, exit, liquidation or refinance) and the recipient. A record of money moving under existing rules rather than a change to them, so it is tracked rather than paged.
LiquidationFeeRateSet (LoanRouter V1)ProtocolParameterChangeWARNINGThe liquidation fee rate changes — the share of liquidation proceeds the protocol keeps before the remainder reaches lenders. Unlike the fee payment above this is a rule change, and it affects what the vault recovers on every future default, so it is surfaced for review. It does not page: the rate is bounded and cannot reach funds directly.
FeeRecipientSet (LoanRouter V1)ProtocolParameterChangeERRORThe address that receives protocol fees is changed. Fee redirection is a value-diversion lever, and V2 has no equivalent setter event at all, so this is the only place a recipient change is observable on either router.
BaseYieldRateTiersSet (USDai)ProtocolParameterChangeERRORThis event sets what USDai holders earn. Accrual is principal × rate × elapsed time and the rate is an administratively chosen number, not a pass-through of the backing assets' actual performance — the spread between them is protocol margin or subsidy. The alert renders each tier's annualised rate rather than just counting tiers, because the base yield has already been cut from 4.5% to 2.0% and restored roughly a day later, and a tier count alone cannot distinguish that from a no-op reordering. It has fired three times in six months, so it cannot spam.
Withdrawn (BaseYieldEscrow)ProtocolParameterChangeERRORFunds leave the reservoir that pays holder yield — the adverse direction, and it has never happened. Worth understanding alongside how the reservoir is filled: setRateTiers sets accrual independently of funding, so if top-ups stop or fall short the accrual keeps running and the escrow drains.
Deposited / Harvested (BaseYieldEscrow)ProtocolParameterChangeINFOThe reservoir is topped up by the STRATEGY_ADMIN Safe, or drawn down by the USDai token to pay accrued yield. Notable as a structural fact rather than a per-event risk: deposits are round numbers chosen by hand while harvests are exact and rate-driven, i.e. the base yield is manually funded, and two independent quantities are kept in line by discretionary transfers.
BaseYieldDeposited / BaseYieldHarvested / AdminFeeWithdrawn (sUSDai)ProtocolParameterChangeINFOYield credited to the vault, drawn from it, or the admin fee taken from it. The alert reports the admin fee as a share of the gross amount. Base yield arrives in discrete lumps rather than continuously, so the vault's exchange rate steps up in jumps at these moments.
Harvested / BaseTokenConverted (USDai)ProtocolParameterChangeINFOYield pulled into the token to accrue to holders, or a backing asset converted between forms. Routine operational activity.
SupplyCapSet (USDai)ProtocolParameterChangeWARNINGThe ceiling on total USDai supply changes. It limits new minting only and never affects existing holders, so it is surfaced without paging.
TokenPriceFeedAdded / TokenPriceFeedRemoved (Price Oracle)ProtocolParameterChangeERRORThe feed mapping that converts a deposit into a mint amount is edited. Whoever controls it controls the mint rate — repoint USDC's feed at $2 and every depositor mints double. A single call takes arrays and can rewrite several feeds at once. Also worth knowing what this oracle does not cover: price(wM) reverts and wM is unsupported, despite wM being roughly 73% of USDai's deposits — so the dominant backing asset is not priced by this contract at all.
CallScheduled (either Timelock)TimelockChangeERRORA privileged call is queued behind a delay. This is the only pre-warning in the system — it arrives while there is still time to inspect the call and act before it executes.
CallExecuted (either Timelock)TimelockChangeERRORA queued call runs. It pages independently of the target's own events because a timelock can act on contracts whose events are not monitored, making this the backstop for anything the per-contract handlers would miss.
Cancelled (either Timelock)TimelockChangeWARNINGA queued operation is withdrawn before execution — a veto. Recorded for the audit trail; the interesting case is a cancellation that reveals an abandoned plan, which the scheduled call already reported.
MinDelayChange (either Timelock, delay decreased)TimelockChangeERRORThe enforced waiting period is shortened, directly weakening the guarantee that a change can be reviewed before it takes effect. The conditional is exact — both the old and new durations are in the payload.
MinDelayChange (either Timelock, delay increased)TimelockChangeWARNINGThe waiting period is lengthened, strengthening the guarantee. Recorded without paging. Note the Upgrade Timelock's delay has already moved twice (from none, to 24 hours, to 48 hours), which is why no alert on this protocol states a delay as a fixed value — the delay in force is read from chain at the block of each event.
TimelockChange (Chip Governor)TimelockChangeERRORThe governor is repointed at a different timelock. This bypasses the delay itself rather than transferring a role, so it pages.
ProposalGuardianSet (Chip Governor)AdminChangeERRORSets the account that can cancel proposals outside the normal rules. It is currently unset, so a first assignment creates a veto power that did not previously exist.
ProposalQueued / ProposalExecuted (Chip Governor)ProtocolParameterChangeERRORA governance proposal reaches the timelock, or executes. The Chip Governor has never been used — zero proposals, zero votes, and every one of its six on-chain events to date is configuration from a single block. A first proposal is therefore a genuinely novel event on this protocol.
ProposalCreated (Chip Governor)ProtocolParameterChangeWARNINGA proposal is filed. Surfaced early so the queued and executed stages are not the first anyone hears of it.
VotingDelaySet / VotingPeriodSet / ProposalThresholdSet / QuorumNumeratorUpdatedProtocolParameterChangeWARNINGThe rules of governance itself — how long before voting opens, how long it runs, how much voting power is needed to propose, and what quorum applies. Bounded parameters, but they determine who can pass a proposal, so each is surfaced.
LateQuorumVoteExtensionSet / ProposalCanceled / ProposalExtendedProtocolParameterChangeINFOLower-impact governance mechanics: the late-quorum extension window, a withdrawn proposal, and a vote extended because quorum arrived late. Recorded for completeness.
DelegateVotesChanged (CHIP, crossing the proposal threshold)ProtocolParameterChangeWARNINGA delegate's voting power crosses the threshold needed to file a proposal, in either direction. Deliberately edge-triggered on the crossing rather than level-triggered on the value: the event re-fires on every transfer in or out of a delegating holder, so a level test would re-alert indefinitely once any delegate sat above the line. This is the tripwire for governance becoming usable at all — total delegated voting power is currently a tiny fraction of the threshold.
DelegateChanged (CHIP)ProtocolParameterChangeINFOA holder points their voting power at a different delegate. Ordinary token activity; the threshold crossing above is the signal that matters.
ChangedThreshold (any Safe)MultisigChangeCRITICALThe number of signatures a Safe requires changes. Lowering it directly weakens every privilege that Safe holds — and these Safes hold root administration, pausing, origination and direct ownership of six ProxyAdmins.
EnabledModule (any Safe)MultisigChangeCRITICALA module is enabled on a Safe. A module can execute transactions on the Safe's behalf without collecting any signatures, so enabling one creates a parallel authority path that bypasses the threshold entirely.
ChangedMasterCopy (any Safe)MultisigChangeCRITICALThe Safe's own implementation is swapped — the multisig equivalent of a proxy upgrade, replacing the code that enforces signature checking. Emitted by Safe 1.1.1 and seen once per Safe at creation.
AddedOwner / RemovedOwner / DisabledModule / ChangedGuard / ChangedFallbackHandlerMultisigChangeERRORSigner membership changes, or a module, guard or fallback handler is altered. Each changes who or what can act through the Safe, or removes a check on it, so each pages one tier below the threshold and module-enable cases.
ExecutionFromModuleSuccess / ExecutionFromModuleFailure (any Safe)MultisigChangeERRORA transaction is executed through the module path rather than by collecting signatures. Zodiac Delay modules are enabled on three of the five Safes, but not one transaction has ever been routed through a module and every module's queue is empty — so a first occurrence means a dormant bypass has been activated.
ExecutionFailure (any Safe)MultisigChangeWARNINGA Safe transaction was authorised by its signers but reverted on execution. Usually operational, but a failed privileged action is worth seeing.
SafeSetup (any Safe)MultisigChangeINFOA Safe's creation, carrying its initial owner set and threshold. This is the only place a Safe's starting threshold is emitted — ChangedThreshold never fires for it — which is why one Safe's 2-of-3 configuration was previously invisible to monitoring.
SwapAdapterAdded / SwapAdapterRemoved (DepositTimelock V1)ProtocolParameterChangeWARNINGThe set of whitelisted swap adapters changes. An adapter sits in the path deposits take, so which contracts are trusted there is a meaningful configuration change.
PeerSet (BridgeAdapter)ProtocolParameterChangeERRORSets which remote chain and address are trusted as the counterpart for cross-chain USDai. A wrong or hostile peer is a direct path to unbacked minting, so every change pages.
RateLimitsChanged / MsgInspectorSet / PreCrimeSet (BridgeAdapter)ProtocolParameterChangeWARNINGThe bridge's throughput caps and its optional message-inspection and pre-crime hooks change. These are the containment controls around cross-chain flow — relaxing them widens the blast radius of a bridge failure without being an exploit itself.
EnforcedOptionSet (BridgeAdapter)ProtocolParameterChangeINFOLayerZero execution options (gas limits and similar) for a destination are set. Message-delivery plumbing with no bearing on custody or authority.
RedemptionsServiced (sUSDai)ProtocolParameterChangeINFOThe STRATEGY_ADMIN role services the redemption queue. Holders cannot force their own exit, so this is the mechanism by which withdrawals actually complete; the per-request timing is tracked as a metric rather than paged.
LoanTimelockDeposited / LoanDepositTimelockDeposited / LoanEscrowTimelockDeposited / LoanEscrowTimelockWithdrawn / LoanRepaymentDeposited / PoolDeposited (sUSDai)ProtocolParameterChangeINFOVault capital being committed to, or returned from, the deposit and escrow timelocks on its way into and out of the loan book. Where a rate is present the alert reports it annualised. Routine capital movement.
LoanTimelockCancelled / LoanDepositTimelockCancelled / LoanEscrowTimelockCancelled (sUSDai)ProtocolParameterChangeWARNINGA queued deployment of vault capital is cancelled before it lands. The cancellation is the more informative half of the pair — it means an intended allocation was called off.
Migrated (sUSDai, USDai)ProtocolParameterChangeWARNINGAn admin-gated settings migration runs on the vault or the token. It rewrites configuration outside the normal parameter setters, so each occurrence is surfaced for review.

Valantis — stHYPE (valantis)

  • Chain(s): HyperEVM
  • Products: sthype
  • Contracts monitored:
    • Overseer — 0xB96f07367e69e86d6e9C3F29215885104813eeAE
    • stHYPE Token — 0xffaa4a3d97fe9107cef8a3f48c069f577ff76cc1
    • wstHYPE Token — 0x94e8396e0869c9F2200760aF0621aFd240E1CF38
  • Events monitored:
On-chain triggerIncident typeSeverityWhat it means
ProtocolFeeSet (Overseer)ProtocolParameterChangeINFOProtocol fee changed
RoleGranted (Overseer)RoleChangeWARNINGRole granted
RoleRevoked (Overseer)RoleChangeWARNINGRole revoked
RoleAdminChanged (Overseer)RoleChangeERRORRole admin changed
DefaultAdminTransferScheduled (Overseer)AdminChangeWARNINGAdmin transfer scheduled
DefaultAdminTransferCanceled (Overseer)AdminChangeINFOAdmin transfer canceled
DefaultAdminDelayChangeScheduled (Overseer)TimelockChangeWARNINGAdmin delay change scheduled
DefaultAdminDelayChangeCanceled (Overseer)TimelockChangeINFOAdmin delay change cancelled
AprThresholdSet (Overseer)ProtocolParameterChangeINFOAPR threshold set
SlashThresholdSet (Overseer)ProtocolParameterChangeINFOSlash threshold set
SyncIntervalSet (Overseer)ProtocolParameterChangeINFOSync interval set
Upgraded (stHYPE Token)ContractUpgradeERRORstHYPE token contract upgraded
AdminChanged (stHYPE Token)AdminChangeERRORstHYPE token proxy admin changed
RoleGranted (stHYPE Token)RoleChangeWARNINGToken role granted
RoleRevoked (stHYPE Token)RoleChangeWARNINGToken role revoked
RoleAdminChanged (stHYPE Token)RoleChangeERRORToken role admin changed
DefaultAdminTransferScheduled (stHYPE Token)AdminChangeWARNINGToken admin transfer scheduled
DefaultAdminTransferCanceled (stHYPE Token)AdminChangeINFOToken admin transfer canceled
DefaultAdminDelayChangeScheduled (stHYPE Token)TimelockChangeWARNINGToken admin delay change scheduled
DefaultAdminDelayChangeCanceled (stHYPE Token)TimelockChangeINFOAdmin delay change cancelled
Upgraded (wstHYPE Token)ContractUpgradeERRORwstHYPE token contract upgraded
AdminChanged (wstHYPE Token)AdminChangeERRORwstHYPE token proxy admin changed
RoleGranted (wstHYPE Token)RoleChangeWARNINGwstHYPE role granted
RoleRevoked (wstHYPE Token)RoleChangeWARNINGwstHYPE role revoked
RoleAdminChanged (wstHYPE Token)RoleChangeERRORwstHYPE role admin changed
DefaultAdminTransferScheduled (wstHYPE Token)AdminChangeWARNINGwstHYPE admin transfer scheduled
DefaultAdminTransferCanceled (wstHYPE Token)AdminChangeINFOwstHYPE admin transfer canceled
DefaultAdminDelayChangeScheduled (wstHYPE Token)TimelockChangeWARNINGwstHYPE admin delay change scheduled
DefaultAdminDelayChangeCanceled (wstHYPE Token)TimelockChangeINFOwstHYPE admin delay change cancelled

Overview

Introduction to the Staking Rewards Ratings API - a REST-based API for accessing DeFi and Infrastructure ratings data.

List DeFi Chains GET

Returns the list of blockchains available in DeFi ratings. Use the returned `slug` values as the `chain` filter parameter in `GET /ratings/defi` and `GET /ratings/defi/{provider-slug}`.

On this page

Incident typesSeverity levelsCoverage summaryAave (aave)BlackRock (blackrock)Coinbase (coinbase)Compound (compound)Ethena (ethena)EtherFi (etherfi)HyperLend (hyperlend)Kelp (kelp)Lido — earnETH (lido-finance)Lido — earnUSD (lido-finance)Lido — stETH (lido)Lido — strETH (lido)Lombard (lombard)Looping Collective — lcBTC (looping-collective)Maple (maple)Moonwell Flagship ETH (moonwell)Morpho (morpho)Ondo (ondo)Puffer (puffer)Rocket Pool (rocketpool)Sky (sky)Spark (spark)Stader (stader)StakeWise (stakewise)USD.ai (usdai)Valantis — stHYPE (valantis)