Skip to content
ReferenceOperational sensing

Ops Monitor

Three layers in a fixed order over the operational surface: signers, governance, the served frontend, and the RPC feeds your contracts read.

The layer contract

Reflex owns every CRITICAL on plain event subscription and calldata decoding, with no model in the path. Instinct scores per-signer baselines. Cognition explains and correlates, grounded in evidence the layers beneath produced, and never sets severity. Inverting that order is the failure mode this design refuses.

Layer 1: 18 unconditional rules

Every id below is always-critical when it fires. No threshold, no model, no tuning: a Safe delegatecall is never benign, and that is a rule rather than an inference.

  • SAFE_DELEGATECALL
  • SAFE_OWNER_ADDED
  • SAFE_OWNER_REMOVED
  • SAFE_THRESHOLD_CHANGED
  • SAFE_MODULE_ENABLED
  • SAFE_MODULE_DISABLED
  • SAFE_GUARD_CHANGED
  • OWNERSHIP_TRANSFERRED
  • PROXY_UPGRADED
  • PROXY_ADMIN_CHANGED
  • BEACON_UPGRADED
  • ROLE_GRANTED
  • ROLE_REVOKED
  • ROLE_ADMIN_CHANGED
  • TIMELOCK_DELAY_CHANGED
  • TIMELOCK_DELAY_SET
  • TIMELOCK_OP_CANCELLED
  • TIMELOCK_TX_CANCELLED

Layer 2: six measured baseline features

Per-signer statistical baselines, in maths simple enough to replay line by line. A single deviating feature stays quiet; severity needs several to agree. There is no device fingerprinting in this product, and this list is the whole of it.

  • time-of-day
  • inter-signature-latency
  • signing-velocity
  • transaction-origin
  • gas-price
  • target-novelty

The served surface

Chain-agnostic, because DNS and JavaScript do not care which VM your contracts run on. This is the module that covers the CoW Swap class and the half of Bybit that made the calldata invisible.

  • DNS_RECORDS_CHANGED
  • JS_BUNDLE_CHANGED
  • NEW_TLS_CERTIFICATE

RPC quorum

N independent providers are asked for the same block hash and the same key state reads, and divergence or staleness is an alert. The analysis is a pure function over provider readings, so it is tested without a network. This is the KelpDAO vector: the attacker changed what the contract was told.

  • eth_call
  • eth_getBalance
  • eth_getStorageAt

Governance semantics

Every proposal is decoded to its calls and simulated on a forked node before the vote closes, then classified by what it EXECUTES rather than what its title claims.

  • proxy-upgrade
  • proxy-admin-change
  • ownership-transfer
  • role-grant
  • timelock-delay-change
  • collateral-or-market-registration

Where the boundary sits.

In the same type as everything above it, and paired with the control that covers it. This is the part your auditor reads first.

The edge The live indexer is EVM-only.
Closed by viem and 0x addresses. Solana is selectable and validated and gets domain and frontend monitoring today, but contract-level sensing there is Live Detection's Solana lane rather than this module. The distinction decides who catches what.

Put Ops Monitor on your perimeter.

Engine-level detail and the full catalogue are provisioned with your engagement, alongside the console your team works in.