What’s covered
Multisig wallet
Each Safe or Squads address gets the standard wallet rule pack: proposals,
configuration changes, value thresholds, and balance monitoring.
Derived voters
Range reads the signer addresses from the multisig configuration and applies
voter rules to those wallets. A compromised signer key can enable a malicious
approval or execution even without direct treasury access.
Suggested wallet rules
Applied to each multisig wallet in scope.| Rule | What it monitors |
|---|---|
| Proposal Tracker | The full proposal lifecycle — new proposal creation/submission and successful execution. |
| Config Tracker | Structural changes: member/owner add and remove, threshold modifications, permission changes, modules, and guards. Can indicate compromise or unauthorised access. |
| High-Value Governance Action | An executed proposal or transaction above the high-value threshold (suggested $1k). |
| Large-Value Governance Action | An execution above the larger threshold (suggested $10k) — worth a formal acknowledgment. |
| New Contract Interaction | A monitored wallet interacts with a contract it has never transacted with before — a common phishing and malicious-approval vector. |
| Balance Drop | Balance falls below an absolute floor, or below 20% of its 30-day rolling average. |
Suggested voter rules
Derived from the multisig — applied to the signer addresses Range reads from the wallet configuration.| Rule | What it monitors |
|---|---|
| Non-Multisig Tx Monitoring | Any transaction by a monitored signer that’s unrelated to the multisig — activity outside governance may indicate key compromise. |
| Timezone Tx Monitoring | Signer transactions outside the configured core timezone or operating window. |
Suggested thresholds
| Threshold | Suggested default |
|---|---|
| High-value governance action | $1,000 |
| Large-value governance action | $10,000 |
| Balance drop | Below an absolute floor or 20% of the 30-day rolling average |
| Voter timezone window | Your defined core hours |
How an alert flows
Each alert is routed to any destination your workspace has connected — see Supported destinations. You choose where each alert goes; the rule just decides when one fires.Setting it up
Configured with you during onboarding:We configure the pack
Range sets up the standard rule pack and destination routing in your workspace.