Skip to main content
The control surface of a protocol is its code and the keys that can change it. These rules alert you the moment a monitored program or contract is upgraded, has its authority or ownership changed, or is paused — the events most associated with takeovers and rug-pulls.

Summary

RuleAccount typesStatus
Program UpgradeProgram🟢 Active
Program Authority ChangeProgram (upgradeable)🟢 Active
Proxy Upgrade MonitorUpgradeable proxy contracts🟢 Active
Proxy Admin ChangedUpgradeable proxy contracts🟢 Active
Contract Ownership TransferOwnable contracts🟢 Active
Contract Pause / UnpausePausable / token contracts🟢 Active
Program and token lifecycleProgram / token⚪ Deprecated

Rules

Detects. A monitored program’s on-chain code is upgraded.
TriggerA program is upgraded (or deployed). One rule can monitor multiple programs.
Account typesProgram
StatusActive
Detects. A program’s upgrade authority is changed or removed.
TriggerThe authority of a monitored program is reassigned to a new key or removed entirely.
Account typesProgram (upgradeable)
StatusActive
Detects. A monitored upgradeable proxy swaps its implementation to a new address.
TriggerAn ERC-1967 proxy upgrade event — the proxy points to new implementation code.
Account typesERC-1967 upgradeable proxy contracts
StatusActive
Detects. The admin that controls upgrading a proxy is changed.
TriggerAn ERC-1967 proxy admin change — whoever can upgrade the implementation is now a different account.
Account typesERC-1967 upgradeable proxy contracts
StatusActive
Detects. A contract’s owner changes, or ownership is permanently renounced.
TriggerAn OpenZeppelin Ownable ownership transfer; renunciation (transfer to the zero address) is flagged as the most serious case.
Account typesOpenZeppelin Ownable contracts
StatusActive
Detects. A contract is paused (frozen) or unpaused (re-enabled).
TriggerA pause or unpause event — supports both OpenZeppelin Pausable and stablecoin-style pause events.
Account typesOZ Pausable / token contracts
StatusActive

Deprecated

Retired from a previous runner, kept for completeness:
  • New Program Deployed — a new program is deployed.
  • Program Account Closed — a program account is closed.
  • Program Interaction — a program instruction is executed.
  • Program Error — a program error occurs.
  • SPL Token Authority Change — an SPL token authority is changed.
  • Attestation Service New Accounts — new attestation accounts are created.
Last modified on June 16, 2026