Skip to content
Fuga Labs
Scope an engagement
Sector preset

DAO or corporate treasury

For treasuries where every drain is an authorised transaction that nobody authorised.

Scope an engagement Every sector preset
PresetonboardTreasuryDetectors in play17Boundaries declared3Refusals at onboarding0

How this sector loses money.

A treasury drain does not look like an attack, because structurally it is not one. There is no malformed transaction to catch, only an authorised one that nobody authorised. And it rarely begins with the withdrawal. It begins weeks earlier with an approve that moved no value and was reviewed by nobody.

Answered by
  • 16Deterministic rules
  • 1Invariants

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardTreasury(platform, config) 7 configured
  1. 01Every Safe, multisig and treasury-owning contract monitored as one subject
  2. 02Governor and timelock monitored alongside the wallets they control
  3. 03Declared spend caps per token per window, net of internal transfers
  4. 04Approval blast radius: unlimited approvals, fresh spenders, flagged spenders
  5. 05Signer-set structure: overlap, delegatecall shape, fresh-account handovers, nonce reuse
  6. 06Timelock hygiene: queued critical actions, delay reductions, and bypass attempts
  7. 07Governance integrity: proposal creation and voting-power anomalies
Detectors in play
  • rules.safe-structure-delegatecall
  • rules.multisig-signer-overlap
  • rules.admin-authority-change
  • rules.authority-handover-fresh-account
  • rules.approval-blast-radius
  • rules.unlimited-approval-fresh-spender
  • rules.approval-to-flagged-spender
  • rules.multi-token-sweep
  • rules.proportional-drain
  • rules.sanctioned-interaction
  • rules.ecdsa-nonce-reuse
  • invariants.event
  • rules.timelock-critical-action-queued
  • rules.timelock-delay-reduced
  • rules.timelock-bypass
  • rules.governance-proposal-created
  • rules.governance-voting-power-anomaly

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge Fuga Labs sees that a transaction carried n valid signatures. It cannot see inside the room where the humans agreed.
Closed by Closed from two directions. Ops Monitor baselines each signer on six measured features (time of day, inter-signature latency, signing velocity, submitting address, gas-price habit and target novelty), so a coerced approval breaks a pattern even when it satisfies the threshold; and a declared timelock converts detection into a window you can act inside.
The edge Fiat and exchange-held treasury balances are not chain state.
Closed by Closed by the reserve-attestation lane, which puts every declared address under continuous measurement with a proof of control. An address in a report is not an address you demonstrably control, and this is the control that tells the two apart.
The edge A spend cap is a policy number only your treasurer can state.
Closed by Closed by making the policy enforceable rather than aspirational. You declare the ceiling once; from then on it is an event invariant evaluated net of internal transfers, and the difference between a payroll run and a drain stops being a matter of opinion.

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    Every Safe, multisig and treasury-owning contract enrolled as one subject, with the governor and timelock beside them. The spend cap per token per window is a number only your treasurer can state.

  2. Step 2

    Detect

    The signal is structure and rate, because every drain here is an authorised transaction. Six measured signer features carry a baseline, so a coerced approval breaks a pattern even when it satisfies the threshold.

  3. Step 3

    Prevent

    A declared timelock is the real breaker in this sector: it turns a detection into a window you can act inside. The guardian's bounded action is an outflow cap, armed only after the shadow period.

What runs underneath.

Event invariants carry this preset: a spend cap stays a policy until something evaluates it every block, net of internal transfers.

The base under all eleven presets

Scope DAO or corporate treasury coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset