Smart Contract Monitoring: 40 Detectors for DeFi Teams
Quick answer. Monitor every privileged change, from owners and roles to upgrades, multisig and timelock settings, plus oracle health, outflows, solvency, governance queues and offchain systems like DNS, frontends and keepers. Reconcile events against live state, and route each alert by severity to a named responder.
Video transcript
What should a DeFi protocol monitor after launch? Every privileged change, oracle health, outflows, governance queues and offchain systems, each routed by severity to a named responder.
Our checklist has forty detectors in three tiers. P zero means funds or control are at risk now. P one needs a person within minutes, P two a same-day ticket.
Start with powers that move funds or replace code: ownership, roles, proxy upgrades, and Safe owners and thresholds. Read proxy slots every block, so a silent change still fires.
For oracles, Chainlink lists circuit breakers, kill switches and alerts on feed deviations. Set each staleness threshold from the feed's own heartbeat, not a global default.
Events alone can mislead. Guardian's public reports show a liquidation event logging zero collateral, events that could never fire, and paths with no event. So reconcile balances against live state.
A timelock only warns if someone reads the queue, so decode every scheduled call. Offchain, watch DNS, frontend scripts and keeper heartbeats. A drain does not need a contract bug.
Give every detector a written spec: a baseline, a tuned threshold, a named owner, a paging channel with a backup, and a runbook. Test pause paths on a fork.
Read the full checklist to copy all forty detectors. Guardian's Managed Security monitors contracts every block, Sentry watches domains, DNS and cloud, and engineers handle response.
Why a Detector List
This is a copyable detector list for a live DeFi protocol: 40 checks, each with a fire condition and a tier.
Our onchain monitoring guide explains what monitoring is and how to build or buy it.
P0 means funds or control are at risk now. P1 needs a person within minutes, P2 a same-day ticket.
Admin, Role and Upgrade Events
These detectors watch powers that move funds or replace code. Most fire on a standard event, then confirm with a state read.
OpenZeppelin documents OwnershipTransferred, RoleGranted, RoleRevoked and RoleAdminChanged for its access contracts. Its default-admin rules add events for scheduled admin transfers and delay changes. OpenZeppelin
ERC-1967 proxies emit Upgraded, BeaconUpgraded and AdminChanged, and keep the implementation, beacon and admin addresses in fixed storage slots. Ethereum EIPs
Read those slots every block, so a change without an event still fires detector 6.
Safe owners, thresholds, modules and guards decide who can act through a multisig. Safe emits events when owners or the threshold change. Safe
Safe multisig monitoring covers delegatecalls, the queue and the nonce.
Guardian's Glider review documented a zero-second default-admin delay (Info, I-03, pending). That leaves little review time, so detector 4 should read the pending admin and delay directly. Guardian
| No. | Detector | Fire when | Tier |
|---|---|---|---|
| 1 | Ownership transfer | OwnershipTransferred or OwnershipTransferStarted outside an approved change | P0 |
| 2 | Role grant or revoke | RoleGranted or RoleRevoked on any privileged role | P0 |
| 3 | Role admin change | RoleAdminChanged on any role | P0 |
| 4 | Default admin transfer | Admin transfer or delay change scheduled, or admin renounced | P0 |
| 5 | Proxy upgrade | Upgraded, BeaconUpgraded or AdminChanged emitted | P0 |
| 6 | Slot drift | Implementation, beacon or admin slot differs from baseline | P0 |
| 7 | Safe owner change | Owner added, removed or swapped | P0 |
| 8 | Safe threshold drop | Threshold lowered, or below policy for the owner count | P0 |
| 9 | Safe module or guard | Any module enabled or guard changed | P0 |
| 10 | Pause change | Paused or unpaused outside a scheduled drill | P0 |
| 11 | Mint or cap breach | Supply or mint rate exceeds its set cap | P0 |
| 12 | Unexpected caller | Successful privileged call from an address off the allowlist | P0 |
Oracle and Price Signals
Chainlink lists safeguards its users run: circuit breakers, waiting for a fresh input, a manual kill switch and alerts on feed deviations. Chainlink
For single-source feeds, it says to detect stale, delayed, missing or unexpected values and compare against independent references.
Set each staleness threshold from the feed's own heartbeat, not a global default. Compare against a second source an attacker cannot move in one block.
Chainlink's L2 sequencer uptime feeds flag downtime and support a grace period before liquidations resume. Chainlink is no longer expanding them to new networks, though existing feeds stay supported. Chainlink Documentation
| No. | Detector | Fire when | Tier |
|---|---|---|---|
| 13 | Oracle source change | Feed, adapter or aggregator address changes | P0 |
| 14 | Stale price | Last update older than the feed's heartbeat plus margin | P0 |
| 15 | Price deviation | Gap to an independent reference exceeds its bound, or moves fast | P0 |
| 16 | Invalid answer | Zero, negative, out of bounds or wrongly scaled | P1 |
| 17 | Sequencer down | L2 sequencer reported down, or restarted within a grace period | P1 |
Liquidity and Outflow Anomalies
Outflow detectors need a baseline per contract: normal daily volume, withdrawal size and holder mix. Without one, thresholds are guesses.
Events alone can mislead here. Guardian's public reports show three ways.
In RAAC's core contracts, a liquidation event reported zero ERC-20 collateral after the collateral was transferred (Low, L-08, resolved). No direct fund loss was shown, but an event-driven monitor would log the wrong amount. Guardian
In Ethereal's protocol review, PnL-mismatch events could never fire, because the tolerance sat below the emission threshold (Low, L-05, resolved). Drift monitoring built on them stays silent.
In GMX's incentives contracts, some state-changing paths emitted no protocol event (Info, I-01, acknowledged). Only state reads or token-transfer reconciliation would see them.
Detector 21 reconciles token balances against internal accounting every block. It catches what events misreport or skip.
| No. | Detector | Fire when | Tier |
|---|---|---|---|
| 18 | Treasury outflow | Treasury or vault transfer above a set size or rate | P0 |
| 19 | Abnormal withdrawals | Withdrawals far above baseline per block or hour | P1 |
| 20 | TVL drop | TVL falls past a set percentage within a window | P1 |
| 21 | Balance reconciliation | Token balances diverge from reserves, liabilities or internal accounting | P1 |
| 22 | Utilization near cap | Utilization or a borrow cap passes a warning level | P2 |
| 23 | Health factors | Large positions approach their liquidation threshold | P1 |
| 24 | Liquidation spike | Liquidation count or size far above baseline | P1 |
| 25 | Bad debt | Debt exceeds collateral value on any position or market | P1 |
| 26 | Concentration | One address holds outsized supply, debt or liquidity | P2 |
| 27 | Flash loan volume | Flash-loan-funded calls into your contracts above baseline | P2 |
| 28 | Bridge mismatch | Message, nonce or minted amount differs from the source chain | P1 |
Governance and Timelock Events
A timelock only warns if someone reads the queue. Decode each scheduled call and post its target, function and countdown.
OpenZeppelin's TimelockController emits CallScheduled, CallExecuted, Cancelled and MinDelayChange. AccessManager uses OperationScheduled, OperationExecuted, OperationCanceled and TargetAdminDelayUpdated. OpenZeppelin
In TimelockController, a delay change must itself be scheduled and executed, so detector 30 sees it first.
Read proposals that grant roles or swap oracles before the votes land.
| No. | Detector | Fire when | Tier |
|---|---|---|---|
| 29 | Delay reduced | Timelock or admin delay lowered | P0 |
| 30 | Call scheduled | Operation queued; alert with decoded calldata | P1 |
| 31 | Call executed | Any CallExecuted whose id was never decoded and approved, or run by an unexpected executor | P1 |
| 32 | Call cancelled | Operation cancelled; record who and why | P1 |
| 33 | Proposal created | New proposal touching roles, upgrades, oracles or treasury | P1 |
| 34 | Votes and quorum | Sudden voting power, delegation swing or unusually early quorum | P1 |
| 35 | Queue anomaly | Execution without a passed proposal, or out of order | P1 |
Offchain Signals: DNS, Frontend, Keepers
A drain does not need a contract bug. A hijacked domain or tampered script can ask users to sign for an attacker.
Keepers and relayers fail quietly. A missed liquidation run first shows as a heartbeat gap.
Our DeFi DNS hijack prevention checklist covers registrar locks, certificate alerts and the first hour of a hijack.
| No. | Detector | Fire when | Tier |
|---|---|---|---|
| 36 | Keeper or relayer heartbeat | Expected job or message missing past its interval | P1 |
| 37 | Monitor lag or reorg | Monitor, RPC or indexer behind head, or reorg past confirmation depth | P1 |
| 38 | DNS and TLS | Nameserver, registrar, lock, record or unexpected certificate change | P1 |
| 39 | Frontend integrity | Bundle hash, CSP, third-party script or dependency changes | P1 |
| 40 | CI/CD and cloud | Branch protection, deploy artifact, IAM, KMS or secret store changes | P2 |
Prioritizing and Routing Alerts
Route by consequence, not by data source. The table sets each tier's first move.
Give every detector a written spec with the seven fields below before it goes live.
Record baselines independently of the monitor. Test pause and escalation paths on a fork after every upgrade or signer change.
OpenZeppelin Monitor, an open-source option, matches contract functions, events and transactions with expressions, schedules and notifications. OpenZeppelin
A P0 alert helps only if the pause works. Our DeFi incident response plan guide covers pause authority, signers and drills.
- Baseline: the recorded state or normal range to compare against.
- Threshold: the value that fires it, tuned on past data.
- Owner and tier: a named person, and P0, P1 or P2.
- Channel: where it pages, plus a backup on a different vendor.
- Suppression: approved changes and maintenance windows, with the approver logged.
- Evidence: transactions, blocks and decoded calldata, kept for review.
- Runbook: the first three actions, and who may take them.
| Tier | Detectors | First move | Who acts |
|---|---|---|---|
| P0 | 17 | Pre-authorized pause or containment, then page | On-call engineer and signers |
| P1 | 19 | Page a person around the clock | On-call engineer |
| P2 | 4 | Open a ticket and investigate the same day | Owning team |
Frequently Asked Questions
Does ADGM's draft DeFi guidance require protocols to run these detectors?
No. ADGM FSRA Consultation Paper No. 5 of 2026 is a proposal for Authorised Persons and Recognised Bodies engaging with DeFi, not for protocols. Comments close on 30 November 2026, and the text may change after that. ADGM FSRA
Is OpenZeppelin Monitor enough to run this list?
It covers event and function detectors. Its docs call main-branch pages unreleased and point production users to v1.3.x, so check features and chains against your version. They describe matching functions, events and transactions, not reading storage, so slot drift and balance reconciliation need a separate reader. OpenZeppelin
Do immutable contracts need these detectors?
Fewer of them. Proxy upgrade detectors may not apply, but oracle, outflow, solvency, keeper and offchain detectors still do, because prices, users, dependencies and frontends keep changing after deployment.
Related reading
- smart contract audit vs continuous monitoring
- onchain monitoring vendor scorecard
- what is web3 mdr
- best smart contract monitoring tools
- how to track crypto hacks in real time
Sources
- OpenZeppelin: Access Control API
- Ethereum EIPs: ERC-1967: Proxy Storage Slots
- OpenZeppelin: OpenZeppelin Monitor
- Chainlink: Selecting Quality Data Feeds
- Safe: How Safe Smart Accounts work
- ADGM FSRA: ADGM FSRA Invites Industry Feedback on Proposed DeFi Risk Management Guidance
- Guardian: RAAC Core Contracts, L-08
- Guardian: Ethereal Protocol Review, L-05
- Guardian: GMX Incentives Contracts, I-01
- Guardian: Glider Protocol Review, I-03
- Guardian: What Is Onchain Monitoring? A Guide for Security Teams
- Guardian: Managed Security
- Chainlink Documentation: L2 Sequencer Uptime Feeds
- OpenZeppelin: Governance API: TimelockController
Need These Detectors Watched Around the Clock?
Guardian's Managed Security monitors contracts every block for privileged calls, upgrades, multisig transactions and large fund movements. Sentry watches domains, DNS and cloud, and engineers handle response.