Documentation
What Overwatch watches, exactly how a grade is computed, and how depositors, builders and protocols use it. Every claim here is checkable against the code and the chain.
What Overwatch is
Overwatch is an early-warning system for people with deposits in Solana DeFi. It watches the control plane of a protocol: who is allowed to change the code and the settings that decide what happens to your funds.
On Solana, "who controls this protocol" is stored as bytes at known offsets in public accounts. Anyone can read it. Before the April 2026 Drift loss (about $285M in twelve minutes), the warning signs sat onchain for days. Nobody was reading them on the depositor's behalf. Overwatch does.
It watches authority: upgrade authorityWhat does this mean?The key that can replace a program's code. Whoever holds it can change the rules, including how your deposit can be withdrawn., multisigWhat does this mean?A wallet that needs several people to approve a transaction, for example 3 of 5. Safer than one key, if enough different people must sign. thresholdWhat does this mean?How many signers of a multisig must approve a change., timelockWhat does this mean?A mandatory waiting period between approving a change and it taking effect. It gives depositors time to withdraw if something bad is approved., the signer set, durable nonceWhat does this mean?A Solana feature that lets a transaction be signed now and submitted any time later. Normal transactions expire in about a minute. The Drift attacker collected pre-signed durable-nonce transactions from signers days in advance. accounts, Token-2022 extensions and oracleWhat does this mean?The price feed a protocol uses to value collateral. A stale or manipulated oracle can let attackers borrow against fake value. dependencies. It does not watch prices, TVL, solvency, bad debt, depegs or exploits in progress.
How it works
- 01Read
For every protocol on the watch list, read the accounts that decide who can change it: the ProgramData header (upgrade authority at bytes 13–44), the Squads v4 multisig behind it, its signers, and any durable nonce accounts those signers control.
- 02Diff
Compare each new snapshot with the previous one. Every difference becomes a typed event, such as TIMELOCK_REMOVED or SIGNER_NONCE_ACCOUNT_CREATED, with a plain-English explanation.
- 03Score
Start at 100, subtract the deductions below, clamp to 0–100 and map to a grade. The rules are code in the repo: packages/core/src/scoring.ts and rules.ts, with unit tests for every rule.
- 04Publish
Write the score, grade and a flags bitmap to a RiskRecord account in the onchain registry, so any Solana program can read it.
- 05Alert
Send the event to Telegram, signed webhooks or email, and stream it over Server-Sent Events.
Watched accounts are subscribed over websocket, so most changes appear seconds after they confirm. Signers' durable nonce accounts are found by an hourly scan, and a full reconcile runs every five minutes.
Scoring and grades
Every grade is a deterministic function of facts shown on the protocol page, and each fact links to its raw account. Start at 100, subtract, clamp to 0–100. Threshold and timelock deductions use the weakest relevant multisig, not the sum.
| Upgrade authority is a single key | −60 |
| Controlled multisig (Squads configAuthority set) | −20 |
| Threshold ≤ 2 | −20 |
| Otherwise, threshold / voting members < 50% | −10 |
| Timelock = 0 | −25 |
| Timelock < 24h | −15 |
| Timelock < 48h | −5 |
| Each signer holding an active durable nonce account | −10 (max −30) |
| A pending proposal would weaken controls | −10 |
| Any HIGH/CRITICAL weakening event in the last 30 days | −10 |
| Collateral with PermanentDelegate, or a deprecated oracle | −10 each (max −20) |
| Control we could not map (unmapped PDA, unknown, Realms/Squads v3 not yet decoded) | −15 |
| Immutable program | no upgrade deductions |
| A | ≥ 85 | Strong |
| B | ≥ 70 | Good |
| C | ≥ 55 | Caution |
| D | ≥ 40 | Weak |
| F | < 40 | Dangerous |
Colour is always paired with the letter and a word, so a grade never relies on colour alone. TVL comes from DefiLlama for display only and never affects a grade.
Events and severity
The rules engine diffs each new snapshot against the previous one and emits typed events with a plain-English explanation.
| TIMELOCK_REMOVED | CRITICAL |
| TIMELOCK_REDUCED | HIGH |
| THRESHOLD_LOWERED | HIGH · CRITICAL if new threshold ≤ 2 |
| UPGRADE_AUTHORITY_CHANGED | CRITICAL |
| AUTHORITY_BECAME_SINGLE_KEY | CRITICAL |
| SIGNER_NONCE_ACCOUNT_CREATED | HIGH · CRITICAL if ≥ threshold signers are exposed |
| SIGNER_DURABLE_NONCE_TX | HIGH |
| CONFIG_AUTHORITY_SET | HIGH |
| MEMBERS_CHANGED | MEDIUM · HIGH with a threshold change within 7 days |
| PROPOSAL_WEAKENS_CONTROLS | HIGH |
| PROGRAM_UPGRADED | MEDIUM |
| COLLATERAL_RISKY_EXTENSION | HIGH |
| ORACLE_DEPRECATED | HIGH |
| ADMIN_PARAM_CHANGED | MEDIUM/HIGH per adapter |
| Any strengthening change | INFO (green) |
The Drift pattern. Any weakening event within 14 days of a signer creating a durable nonce account, or the reverse, escalates to CRITICAL regardless of the individual deductions. Pre-signed nonce transactions never expire, which is how the Drift attacker held admin power in reserve.
Flags and red
Each score is published with a u64 flags bitmap. A protocol is red when flags & RED_MASK != 0, where RED_MASK = 0xc11: a single key, a signer with a durable nonce, no timelock combined with a threshold of two or fewer, or a recent CRITICAL weakening. Red is the signal a vault acts on.
| bit 0 | SINGLE_KEY | RED_MASK |
| bit 1 | NO_TIMELOCK | |
| bit 2 | LOW_THRESHOLD | |
| bit 3 | CONTROLLED_MULTISIG | |
| bit 4 | SIGNER_NONCE | RED_MASK |
| bit 5 | PENDING_WEAKENING | |
| bit 6 | RECENT_WEAKENING | |
| bit 7 | RISKY_COLLATERAL | |
| bit 8 | DEPRECATED_ORACLE | |
| bit 9 | UNVERIFIED | |
| bit 10 | NO_TIMELOCK_LOW_THRESHOLD | RED_MASK |
| bit 11 | RECENT_CRITICAL | RED_MASK |
Data sources
- Program and ProgramData accounts (BPF upgradeable loader): the 36-byte program account and the 45-byte ProgramData header, fetched with dataSlice. Layouts are verified against real mainnet fixtures.
- Squads v4 multisigs, decoded with @sqds/multisig. Each multisig is mapped from the authority's transaction history, then verified by deriving vault PDAs 0–7 until one equals the onchain upgrade authority.
- Durable nonce accounts: 80-byte System Program accounts whose authority (offset 8) is a watched signer, found by a getProgramAccounts scan, realtime subscriptions where the RPC allows it, and the signer log stream.
- Token-2022 extensions, parsed from the mint TLV (PermanentDelegate, TransferHook, DefaultAccountState, Pausable).
- Oracle owner programs: Pyth Solana Receiver, Pyth Push Oracle, Pyth Oracle (legacy), Switchboard v2 (deprecated), Switchboard On-Demand (deprecated), Chainlink OCR2 Store.
Use it as a depositor
- Open the control map and find the protocols holding your deposits. Sort by grade, or filter by category.
- Open a protocol to see who can move your money: the upgrade authority, the multisig, its signers, the timelock, every deduction and its change history.
- Set up alerts. On Telegram, send /watch drift, /list or /status kamino-lend to the bot. Email and webhooks are on the same page. Pick a minimum severity so you only hear about what matters.
- When an alert arrives it says what changed, why it matters and what you can do, with a link to the transaction. Deciding whether to withdraw is yours.
Use it as a builder
The API is JSON over HTTPS. Every response is { version, data }, and anonymous use is limited to 30 requests a minute.
- GET /api/v1/protocols and /protocols/:slug for grades, flags and the full control snapshot.
- GET /api/v1/events?severity=high for the event log, and /api/v1/stream for live Server-Sent Events.
- POST /api/v1/subscriptions/webhook to register a webhook. Each delivery carries x-overwatch-signature = hex(HMAC-SHA256(secret, rawBody)); verify it with verifyWebhook from @overwatch/sdk. Failed deliveries retry with backoff, up to 6 attempts.
Use it onchain
Each protocol's score lives in a RiskRecord PDA at ["risk", sha256(slug)] under the registry program. A program checks the owner and the PDA, then tests flags & RED_MASK != 0.
The vault program in this repository (programs/overwatch_vault) shows the pattern. It allocates deposits to a strategy and exposes check_and_exit, which anyone can call. If the registry says the protocol is red, the vault pulls the funds back. The vault only ever reads the registry; it never trusts a signature from Overwatch, and check_and_exit has no admin gate by design.
The registry rejects any update whose event slot is older than the one it holds, so history cannot be rewritten backwards. Publishers are a whitelist of up to five keys chosen by a Squads multisig admin.
If you run a protocol
Every deduction is public and has a fix: add or lengthen a timelock, raise the multisig threshold, retire a single-key authority, and keep signers away from durable nonce accounts. The grade updates on the next snapshot after the change confirms.
A protocol can never pay for a score. Sponsorship can only buy a listing and registered change windows, and sponsors are published.
Verify everything yourself
Every alert and every score carries the raw account address and the slot it was read at. You can fetch the same account at the same slot and recompute the result with the rules in packages/core. There is no appeal to authority: if Overwatch is wrong, the chain shows it.
Limitations
- Overwatch reads authority, not code. It does not audit programs or track solvency, prices, bad debt or exploits in progress.
- It warns after a change lands onchain and cannot undo an executed action. Detection lag is the poll interval plus confirmation; nonce accounts are scanned hourly.
- Protocols off the watch list are invisible to it. Key hygiene and social engineering happen off-chain, where it cannot see.
- Some programs are controlled by addresses we have not attributed yet. They are labelled "unmapped" and lose 15 points, because unknown is not safe.
- Realms DAO and Squads v3 governance parameters are not decoded yet (Squads v3 has limited support).
- Admin-config adapters (withdraw limits, listing authority) are mapped for only a few protocols so far.
- The Drift case study is a backtest: current rules applied to a timeline reconstructed from public incident reports. It is not a live catch.
- The onchain registry trusts its publisher keys (up to 5, chosen by a Squads multisig admin). Overwatch watches its own registry too.
Where it fits
The Solana Foundation's STRIDE program funds threat monitoring for protocols over $10M in TVL, and the protocol is the customer. SIRN responds after funds move. Overwatch is the complement: it covers the long tail below the TVL gate, it answers to depositors rather than the protocol, and it warns before funds move rather than responding after.
Status of this deployment
This site reads a live database of mainnet authority, scores and change history. If the database is unreachable, pages show the mainnet snapshot from October 11, 2026 and say so. The onchain registry and vault programs run on devnet.