Monitoring and incident retainer
An audit is a photograph. Production is a film.
What it is
An audit tells you the code was sound at a commit. It cannot tell you that an oracle drifted this morning, that an admin key just moved, or that someone is draining a pool right now.
Monitoring watches the deployed system against rules written from your own threat model, and the retainer puts named people on call to act when a rule fires, including pausing the protocol if you have given us that authority in advance.
What we examine
- Rules written from your threat model, not a generic template.
- Admin key and privileged action alerts: every upgrade, pause, parameter change and mint.
- Fund flow anomalies: unusual withdrawals, drains, sudden concentration.
- Oracle health: staleness, deviation, and the deviation your contracts actually tolerate.
- Automated response where you authorise it: circuit breakers and pause paths triggered in seconds.
- Named responders on call, with an agreed response time in the contract.
- Incident playbooks written and rehearsed before the incident, not during it.
- Post-incident report, including what the monitoring missed and how the rules changed.
What you get
A live monitor set, tuned so alerts mean something and are not ignored by week two.
Incident playbooks naming who does what, with which key, in which order.
An agreed response time, in writing, with named responders.
Monthly summaries of what fired, what was noise, and what changed as a result.
How the engagement runs
- 01
Model
We write the threat model the monitors encode, from your architecture and admin structure.
- 02
Instrument
Monitors deployed against the live system and tuned until the noise is gone.
- 03
Rehearse
A dry run of the playbook: keys, people, steps and timings, before anything is real.
- 04
Stand by
On call with an agreed response time, monthly reporting, and rules that evolve with the product.
What we cover
Languages
- Solidity
- Vyper
- Rust
- Move
- Cairo
- Go
- TypeScript
- Huff
- Yul
Chains
- Ethereum
- Solana
- BNB Chain
- Polygon
- Avalanche
- Arbitrum
- Base
- TRON
- Optimism
- Cardano
- Polkadot
- Cosmos
- NEAR
- Aptos
- Sui
- TON
- Hedera
- Algorand
- Stellar
- Starknet
- ZKsync Era
- Linea
- Sei
- Sonic
- Scroll
- Mantle
- Injective
- Cronos
- Celo
- Gnosis
- Fantom
- Kaia
- Ronin
- Immutable
- Blast
- Berachain
- Monad
- Hyperliquid EVM
- Stacks
- Rootstock
- Kava
- Osmosis
- MultiversX
- Conflux
- Telos
- Theta
- Chiliz
- XDC Network
- Filecoin FVM
- Ontology
- WEMIX
- Fuel
- Taiko
- Polygon zkEVM
- BOB
- Fraxtal
- Mode
- ZetaChain
- Metis
- Manta Pacific
- IOTA EVM
- Neo X
- Unichain
- World Chain
- Soneium
- Abstract
- Ink
- Movement
- Plume
- Etherlink
- EOS
- Flow
- Zilliqa
- Harmony
- Moonbeam
- Astar
- Aurora
Not listed? Ask. If it runs smart contracts, we almost certainly review it.
Questions we get asked
Can you pause our protocol?
Only if you grant that power explicitly and in advance, and only within the limits you set. Most clients start with alerting only and add automated response once the rules have proved themselves.
Do you hold our keys?
No. Where automated response is authorised, it runs through a role you control and can revoke at any moment, without us.
What response time do we get?
Fixed in the retainer, with named responders. We would rather agree a time we can actually meet than advertise a number that looks good.
Do we need this if we have been audited?
The audit covers a commit. Monitoring covers everything that happens after it: parameter changes, oracle drift, key movement, and the upgrade someone ships at 2am.
Often bought with
Build, harden and maintain
Engineering that implements the security work rather than recommending it.
Web3 and protocol audit
Line-by-line review of contracts, chain layer and upgrade paths, with proof-of-concept for every finding.
Proof of reserves
Independent verification that what you hold covers what you owe, published so users can verify it themselves.
Tell us what you are building and when you launch. Fixed quote in 48 hours.
Get a fixed quote