Skip to content
Quantix Security Labs

Security Monitoring

Contract monitoring follows watched contracts across 6 EVM networks: ownership, upgrade, pause, role, timelock and governance events and large transfers, read by RPC polling and Alchemy webhooks. Recorded investigations step through 83 security events across 29 protocols and 11 chains, 1 Nov 2025 to 24 Oct 2026.
Connected rules
12
Connected networks
6
Investigations
6
Recorded events
83
Recorded alerts
50
Recorded contracts
53
Open the consoleRecorded investigations
Illustration: a chain of blocks watched by sensor masts, one block raising an alert

Console

Contract activity, security events and alerts.

Contract monitoring: filter stored chain events by network, contract, severity or type, open one for its decoded arguments and explorer links, and export the result. Recorded investigations: the archived threat timeline, editable detection rules and each incident event by event.
Loading the monitoring console…

Recorded investigations

Six analysed incidents.

Each investigation links the security events it produced to a written analysis in Threat Analysis. Timings are measured from the first malicious action.
  • CriticalOpen

    2 Oct 2026 · Kestrelle Launchpad · BNB Chain

    Liquidity lock shortened and drained on a launchpad sale

    An owner-only setter moved a liquidity unlock date forward by six months; the pool was drained four minutes later.

    Events
    7
    First alert
    At first action
    Contained
    +55 min
    Open in consoleRead the analysis
  • CriticalClosed

    14 Sept 2026 · Obsidian Rollup · Ethereum

    Compromised upgrade signers schedule a malicious Portal upgrade

    Two of three upgrade-multisig keys were taken from a CI-connected signing host; the timelock gave responders 48 hours and they needed three.

    Events
    8
    First alert
    At first action
    Contained
    +1 h 6 min
    Open in consoleRead the analysis
  • CriticalMonitoring

    30 Aug 2026 · Tallowmere CDP · Solana, Ethereum, Arbitrum

    Spot-price oracle manipulation mints unbacked tUSD

    A flash-loan funded trade moved a thin pool 8.1×; the CDP valued collateral at that price and minted 6.4% of tUSD supply.

    Events
    10
    First alert
    At first action
    Contained
    +28 min
    Open in consoleRead the analysis
  • CriticalClosed

    22 Jul 2026 · Axeline Bridge · Optimism, Avalanche, Arbitrum

    Cross-chain message replayed on a second destination

    Verifier v1 digests did not commit to the destination chain, so two Avalanche deliveries were accepted again on Arbitrum.

    Events
    8
    First alert
    At first action
    Contained
    +6 min
    Open in consoleRead the analysis
  • CriticalClosed

    10 Jun 2026 · Thessaly Governance · Optimism

    Borrowed voting power proposes removing the timelock

    A one-block voting delay let borrowed tokens count; the payload would have zeroed the timelock and emptied the treasury.

    Events
    8
    First alert
    At first action
    Contained
    +9 h 34 min
    Open in consoleRead the analysis
  • HighClosed

    18 May 2026 · Larkspur Wallet SDK · Cosmos

    Look-alike dApp collects unlimited authz grants

    Thirty-seven users granted a single grantee open-ended send authority through a cloned front end; 22 balances were moved within the hour.

    Events
    6
    First alert
    At first action
    Contained
    +2 h 9 min
    Open in consoleRead the analysis

Detection rules

How an event becomes an alert.

In recorded investigations every event is evaluated by one of 19 detection rules. Threshold rules compare a measured value with the configured limit; match rules fire when a condition holds, such as an implementation hash missing from the approved-release list. Approved changes are still recorded, but raise no alert. Connected data uses rules QX-R01 to QX-R12, listed in the console’s Detection rules view and configurable per contract.
Rules and recorded events by event type
Event typeRulesEvents
Contract Activity110
Security Alert411
Suspicious Transaction Pattern46
Access Control17
Proxy Upgrade14
Whale Activity315
Governance37
Configuration Change223

Rules are written from each protocol’s threat model: who can change the system, where value moves, and which sequences tend to precede an attack. The console’s Detection rules view shows how many recorded events each rule would alert on at any threshold you choose.

R-01 rule specificationtext
rule:       R-01 upgrade to unapproved implementationwatch:      Obsidian Rollup UpgradeTimelockaddress:    0x4393cc374be13e1eaa019de71ec34857ee8bac33event:      CallScheduled(bytes32 id, uint256 index, address target,                          uint256 value, bytes data, bytes32 predecessor,                          uint256 delay)decode:     data -> ProxyAdmin.upgrade(proxy, implementation)when:       keccak256(code(implementation)) not in approved_releasesseverity:   criticalroute:      on-call engineer -> incident channel -> security councilrunbook:    1. compare bytecode with the release build            2. ask the guardian to pause withdrawal finalisation            3. convene the canceller role inside the timelock delayrationale:  an unapproved implementation can change every function            behind the proxy once the delay expires
The rule that fired in the Obsidian Rollup investigation.

Event signature from the OpenZeppelin TimelockController. Address from the Obsidian Rollup research profile.

About this data

Contract monitoring and recorded investigations.

Connected data is stored chain data

Events come from contract logs read over RPC (bounded block ranges per run) and from signed Alchemy webhooks; both paths store a log once. Events within 12–120 blocks of the head are shown as unconfirmed, and logs dropped by a reorganisation are marked removed. The console polls for new rows every 25 seconds while the tab is visible.

Investigations are archived

Recorded investigations read a fixed archive ending 24 Oct 2026, 09:00 UTC. Their addresses, transaction ids and block heights follow each chain’s format but are internal to Quantix Protocol Research, so they are never linked to a block explorer. Explorer links appear only on connected data.

Investigations replay deterministically

An investigation steps through its recorded events in order. The same incident always produces the same sequence, which makes it useful for rehearsing a response.

How Quantix designs monitoring for a protocol

Monitoring designed from your threat model.

Rules derived from your privileged roles, dependencies and value flows, replayed against history before they go live, and routed to people who can act.

Discuss monitoringOn-chain monitoring service