Solana governance layer. Tracks 50+ protocols. Live dashboard. GovWatch. Blast Radius. Charts. Telegram Bot. Data sourced onchain, protocol docs and disclosures
- Tweets 24
- Following 9
- Followers 62
- Likes 359
Good stuff. If you want a public, cross-protocol view to complement this, solgov tracks the governance of 50+ solana protocols in real time. Multisig and timelock changes, program upgrades and queued proposals before they execute. Open API, no setup needed from teams
The @SolanaFndn just open-sourced Microscope, a free monitoring & alerting tool for Solana programs.
We've tested it out. Its skills map alerts to our STRIDE security framework so the responding team has context to start from during an incident.
github.com/solana-foundation…
1
1
157
New on the API - full history governance activity per multisig, live program deploys and authorities, and queued proposals checked on-chain to see if they can still execute. The tg bot posts public alerts, and anyone can /track any squads v4 multisig for private DM alerts
SolGov: live Solana governance API (OpenAPI 3.1)
via @devrelsxyz and @SolGov_ devrels.xyz/articles/solgov-…
2
3
224
SolGov retweeted
It detects/monitors proposals across protocols on solana. As zinn said, the framework was already running on those, so adding DAOs is straightforward. I put up a DAO page today so you can see it for yourself, it's also wired into the TG bot. Open to suggestions on which other DAOs people want to see on solgov
1
2
135
SolGov retweeted
The Bonk situation could have been prevented.
By using a tool such as @SolGov_, users would've been notified of the vote and it never would have passed.
Another tool, @Pegana_xyz could have signalled the sUSD depeg.
Both of these should be in everybody's toolbox.
3
3
35
1,204
SolGov retweeted
Recently Listed:
🔒 Track protocol security @SolGov_
📊 Earning yield, simplified @cashflow_fi
🛠️ Tools for traders & devs @dflow
🗣 Governance, evolved @MetaDAOProject
← This & more, @Solana Index link in Bio
2
5
12
625
SolGov retweeted
Activity feed live on @SolGov_
TG bot subscriptions available for push alerts
Dug into the BonkDAO treasury drain for 20M+
Config made it a sitting duck, SPL governance did exactly what the passed vote told it to through a single malicious governance proposal
Quorum - 1% of supply
Timelock - 0
Proposal creation threshold - 100M BONK
Voting power - liquid BONK, not staked or locked
Direct treasury transfer execution via Realms
Proposer/executor - 8xxRdtzsw1CJWfEahViqNjZwh5dYJAdSbBctWwcbycVo
Voter - CyEE7oHVDaFJ5xZLbXY3h2Z2uk1VwhTkdy72kPUEtypQ
Timeline (UTC)
June 30 08:25 - proposer creates BIP #76, inserts 4 instructions (2x metadata as cover, create recipient account & the SPL token transfer) signs off and voting opens
July 4-5 - voter acquires 882.3B BONK from exchanges. 530,397,045,677.94 from Binance and 351,888,204,104.41 from a second CEX hot wallet (reportedly Bybit)
July 5 04:46 - voter locks 882,285,249,588.801 BONK into governance
July 5 06:56 - voter casts the deciding yes 882.38B over the community's 710.85M no. About 1240x the real voters
July 6 08:25:39 - voting closes
July 6 08:26:03-08:26:28 - proposer finalises the vote and executes all 4 instructions. Drain completes at 08:26:28, 49 seconds after close
July 6 08:45 - voter pulls the vote and withdraws their 882,285,249,588.801 BONK
Proposal was live for 6 days without any intervention
The drain was a single token transfer. Once the vote passed, Realms governance sent 4,426,104,450,305.966 BONK from the treasury (F8FqZuUKfoy58aHLW6bfeEhfW9sTtJyqFTqnxVmGZ6dU) to the attacker (9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ). Total fee = 0.000105 SOL to move over $20M
TLDR
Fronted $4M of BONK (882.3B), a fraction over the 1% quorum
Fully refundable - withdrawn 19 minutes after the drain
Profit - effectively the entire treasury (20M+).
Net cost - gas (0.000105 SOL)
What would have prevented it
A new proposal alert. A proposal carrying a treasury transfer sat live for 6 days. One alert the moment it was created catches it
An execution timelock (1-3 days) as a failsafe, so a malicious proposal can't fire the second voting ends (basically instant execution like Drift)
A higher quorum + vote escrow (staked/locked, not liquid), so voting power can't be rented for a day and handed back
solgov flags exactly this type of setup in real time via the telegram bot with push alerts and a live activity feed on the website. You'd think with there being 600M+ in hacks since April there would be more urgency to tighten things up. Need to start taking this stuff more seriously as it's just embarrassing at this point
1
1
9
994
SolGov retweeted
Dug into the BonkDAO treasury drain for 20M+
Config made it a sitting duck, SPL governance did exactly what the passed vote told it to through a single malicious governance proposal
Quorum - 1% of supply
Timelock - 0
Proposal creation threshold - 100M BONK
Voting power - liquid BONK, not staked or locked
Direct treasury transfer execution via Realms
Proposer/executor - 8xxRdtzsw1CJWfEahViqNjZwh5dYJAdSbBctWwcbycVo
Voter - CyEE7oHVDaFJ5xZLbXY3h2Z2uk1VwhTkdy72kPUEtypQ
Timeline (UTC)
June 30 08:25 - proposer creates BIP #76, inserts 4 instructions (2x metadata as cover, create recipient account & the SPL token transfer) signs off and voting opens
July 4-5 - voter acquires 882.3B BONK from exchanges. 530,397,045,677.94 from Binance and 351,888,204,104.41 from a second CEX hot wallet (reportedly Bybit)
July 5 04:46 - voter locks 882,285,249,588.801 BONK into governance
July 5 06:56 - voter casts the deciding yes 882.38B over the community's 710.85M no. About 1240x the real voters
July 6 08:25:39 - voting closes
July 6 08:26:03-08:26:28 - proposer finalises the vote and executes all 4 instructions. Drain completes at 08:26:28, 49 seconds after close
July 6 08:45 - voter pulls the vote and withdraws their 882,285,249,588.801 BONK
Proposal was live for 6 days without any intervention
The drain was a single token transfer. Once the vote passed, Realms governance sent 4,426,104,450,305.966 BONK from the treasury (F8FqZuUKfoy58aHLW6bfeEhfW9sTtJyqFTqnxVmGZ6dU) to the attacker (9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ). Total fee = 0.000105 SOL to move over $20M
TLDR
Fronted $4M of BONK (882.3B), a fraction over the 1% quorum
Fully refundable - withdrawn 19 minutes after the drain
Profit - effectively the entire treasury (20M+).
Net cost - gas (0.000105 SOL)
What would have prevented it
A new proposal alert. A proposal carrying a treasury transfer sat live for 6 days. One alert the moment it was created catches it
An execution timelock (1-3 days) as a failsafe, so a malicious proposal can't fire the second voting ends (basically instant execution like Drift)
A higher quorum + vote escrow (staked/locked, not liquid), so voting power can't be rented for a day and handed back
solgov flags exactly this type of setup in real time via the telegram bot with push alerts and a live activity feed on the website. You'd think with there being 600M+ in hacks since April there would be more urgency to tighten things up. Need to start taking this stuff more seriously as it's just embarrassing at this point
23
14
120
41,793
SolGov retweeted
Orca multisig threshold raised from 3 to 5 (5/9)
Governance changes since April 1 on-chain:
- 24 hour governance timelock added
- threshold raised
- signer rotation & role separation (6 of the old signers had full perms, no single signer can now propose, vote and execute)
Why those changes are important:
-a decent timelock would have halted the instant execution of the Drift exploit
-higher threshold = more signers that need to be compromised
-role separation complements the higher threshold, now needs 5 voters plus a separate 1 propose/execute, not just any 5 full signers
What else is positive:
-orca's multisig is autonomous. No configAuthority is set, so the threshold, timelock and members can't be changed outside the full 5/9 vote. No single key can override the above
2
2
544
SolGov retweeted
SolGov deserves 1000x the visibility it currently gets, great stuff on writing this up!
1
2
4
199
SolGov retweeted
Awesome stuff here. I really love the idea of independent third parties documenting security practices in a transparent way that everyone can understand.
DeFi protocols shouldn't be a "trust me bro" black box.
Update on solgov, now has a split view for protocols running more than one multisig as per feedback from @redacted_noah
Quick view tool tip on the main dashboard then further detail in the dropdown. Pre-empted some potential Drift changes Noah mentioned from last week. Blanks are ready to fill in when its ready to update
Added Kamino example to demonstate how it looks when this is filled out. Done the same for a few other protocols running multiple multisigs
2
5
27
3,209
SolGov retweeted
The solgov bot has a broadcast feed covering over 50 protocols on solana. You can also subscribe to individual protocols for direct alerts like this. Open to more ideas and what other protocols you'd want alerts for/who you'd like to see listed on solgov
3
7
494
I ask everyone that you check out SolGov today. Support @Trader_CSK in his efforts in making this space safer.
The latest protocol hacks, drains, scams, etc have been absolute bullshit, and more people should know what kind of security protocols they deposit into have.
Protocol health & security is one of the most important topics today. You should feel safe depositing your funds - verify it with SolGov.
@SolGov_ is now live on Soladex!
🔗 Link to review article below ⤵
3
3
8
563
SolGov retweeted
Protocol health & security is one of the most important topics today. You should feel safe depositing your funds - verify it with SolGov.
@SolGov_ is now live on Soladex!
🔗 Link to review article below ⤵
4
4
13
1,547
SolGov retweeted
Had a quick look into the Humanity ($H) exploit today. Was running a 3/6 multisig, threshold was met as all keys lived on the same device. Had no timelock either.
solgov tracks the Solana equivalent (program upgrade authority, timelock & multisig changes) and I've also added a Token Custody section today. This shows top holders, custody type and wallets that are potentially linked (first funder)
Another example of how a timelock could have helped in this situation. solgov provides alerts within TG for governance changes on chain. All of this can be seen on the activity feed on the website
The alert function could have highlighted the authority update equivalent. Team could have had chance to react by receiving a notification of weird activity, then they reject the transaction. Users are also made aware of the situation so they have time to react as well
I'm aware there's talk about whether this hack was an inside job. Main actionable point I took from this was trying to add more preventative and safety measures on solgov for Solana protocols and users
Welcome any feedback or new information as the Humanity exploit continues to surface
1
7
443
SolGov retweeted
If you want to track the Drift security overhaul. Check SolGov for updates. You can also subscribe to Drift TG alerts via the SolGov bot. On chain case study is located in the Blast Radius section if the team wants to cross reference data with their own findings
Today we are sharing an update on Drift recovery and relaunch
drift.trade/updates/drift-re…
1
2
6
727
SolGov retweeted
If you've used @SolGov_ and have any feedback I'd greatly appreciate it. Added the link to the @colosseum submission below
2
2
10
498
SolGov retweeted
Another timelock added
BulkSOL Rate Markets are LIVE on Exponent v2!
Trade the variable yield or lock in a fixed rate, with limited-time rewards for placing YT Limit Orders
Access the BulkSOL rate market on Exponent: app.exponent.finance/en/mark…
1
1
6
646
