Security Methodology
How the SOC classifies posture: the severity model, on-chain evidence sources, the posture-vs-exploit distinction, and change detection.
Severity model
- SEV-1SEV-1 · Critical
Critical — missing bytecode on a critical contract, or a Safe threshold / owner-set that differs from policy.
- SEV-2SEV-2 · Major
Major — upgradeable proxy on a critical contract, a freeze/blacklist capability, an owner change, or a newly-added mint capability.
- SEV-3SEV-3 · Degraded
Degraded — mint capability (supply not fixed), or a posture issue on a non-critical contract.
- SEV-4SEV-4 · Informational
Informational — pause capability present; transfers can be halted by an admin.
Evidence sources
- Bytecode presence
eth_getCode — a critical contract with no code is a SEV-1 posture finding.
- EIP-1967 proxy slots
Reads the implementation slot (keccak256('eip1967.proxy.implementation') - 1) and admin slot to detect upgradeability and identify the upgrade authority.
- Capability selector scan
Scans the runtime (or implementation) bytecode for mint / pause / blacklist 4-byte selectors.
- Owner read
Calls owner() where present to identify the privileged account.
- Safe threshold / owners
When a Safe is configured, reads getThreshold() and getOwners() and diffs against the signing policy.
Posture risk vs. exploit
Every finding here is a posture risk: a capability that an authorized party could exercise given the contract's current on-chain state. A posture finding is not a claim that the capability has been misused, that funds are at risk, or that an exploit exists. Language is deliberately neutral and evidence-based; the SOC never accuses an operator of wrongdoing.
Example: an upgradeable proxy is reported as a posture risk because the proxy admin can change the implementation behind a fixed address. That is a trust and governance consideration — the correct response is to confirm the admin is a Safe or timelock and to monitor the implementation slot, not to assume malicious intent.
Change detection
Two layers operate independently. Posture evaluation derives findings from a contract's current state and is what this console shows live. Change detection compares a stored baseline against the current state and raises SEV-1/SEV-2 alerts on proxy upgrades (implementation changed), proxy-admin changes, owner changes, Safe threshold changes, and newly-added mint capabilities.
Change detection requires a baseline store and runs in the monitoring job rather than in the read-only API. When no baseline is available, only current posture is reported — this limitation is stated rather than hidden.