Skip to main content
The control surface of a protocol is its code and the keys that can change it. These rules alert you the moment a monitored program or contract is upgraded, has its authority or ownership changed, or is paused, the events most associated with takeovers and rug-pulls.

Summary

Rules

Detects. A monitored program’s onchain code is upgraded.
Detects. A program’s upgrade authority is changed or removed.
Detects. A monitored upgradeable proxy swaps its implementation to a new address.
Detects. The admin that controls upgrading a proxy is changed.
Detects. A contract’s owner changes, or ownership is permanently renounced.
Detects. A contract is paused (frozen) or unpaused (re-enabled).

Deprecated

Retired from a previous runner, kept for completeness:
  • New Program Deployed: a new program is deployed.
  • Program Account Closed: a program account is closed.
  • Program Interaction: a program instruction is executed.
  • Program Error: a program error occurs.
  • SPL Token Authority Change: an SPL token authority is changed.
  • Attestation Service New Accounts: new attestation accounts are created.
Last modified on June 17, 2026