What it watched
CAPTUREEvery custody vault of the exchange plus the TradeVault, RebateVault and FAF token vault, and a balance sweep of every token account owned by the program's vault authority, so any account that moved was promoted to full per-transaction tracking automatically. Capture was push-triggered by a WebSocket subscription on each vault with a baseline poll. Each transfer was decoded from the transaction's pre and post token balances to the exact integer and valued in USD at the on-chain oracle mark observed at capture, with Pyth Lazer as an independent price witness and the on-chain census as an independent solvency witness. No external trading API and no synthetic data anywhere.
Final guard thresholds
AS CONFIGURED, 3 AUG 2026Every detector was labelled either a proof, verified on-chain before it could fire, or a risk limit, a heads-up when a configured threshold was crossed. Only proofs could trigger the automated containment layer; risk limits only ever notified a person.
The record
FROM THE COMMIT HISTORY AND ALERT LOG- 15 Jul 2026Why it was built. A compromised oracle signer at another perps venue posted a fake BTC price and roughly $18M left its vaults in minutes.
- 19–20 JulBuilt and made public. Per-vault flow conservation proof (baseline plus the sum of observed deltas must equal the live balance, raw integer, every cycle), then a six-lens hardening pass: security, numeric, honesty, XSS, performance, resilience. Independent verification suite re-fetched sampled events from the chain and passed 22 of 22.
- 21 Jul$97,988 over-withdrawal. A wallet deposited $1 and withdrew $97,988 through the rollup-to-mainnet settlement path. The transfer was in the monitor's feed, and balance conservation stayed exact, because the money really moved: movement is not entitlement. The protocol team closed the path and reimbursed users.
- 22 JulEntitlement guard and anomaly alarms. Added the 50× entitlement fingerprint, a reconciliation-anomaly alarm for phantom positions, automatic verification of program upgrades, a self-healing cycle watchdog, and proven-only alarms routed to a private channel.
- 23 JulThree-layer defense. Proof-gated containment that traces a wallet's entire collateral history before responding; an independent solvency recompute as the monitor's own second witness; settlement-signer and solvency-buffer watches; the real 3-of-7 upgrade multisig under watch.
- 3 AugA false positive, found and fixed. An "unbacked outflow" alarm turned out to be the exchange's two-leg withdrawal across two clocks: rollup accounting updates instantly, the base-chain transfer settles later. The detector now compares settled levels, not per-poll deltas.
- Sep 2026Flash Trade wind-down. Positions force-closed on 2 September, withdrawals on 15 September.
- 6 Oct 2026Final read and archive. The governance watch recorded the protocol's trading, liquidity and staking permission flags switched off, and the program holds no market accounts. The monitor was taken out of live service and this record published.
How to trust it
VERIFICATIONThe dashboard never showed a confident green while blind: if a cycle stalled, the daemon was unreachable or the window was still backfilling it said STALE, ARMING or RECONNECTING. A "drain" alarm needed two independent witnesses to agree. Alarms were proven on-chain before they fired and went to a private channel, so a public page could not be used to manufacture panic. The raw accounting was exact to the integer and every figure traced to a confirmed transaction signature. The code, tests and verification suite are public at github.com/Abdr007/flash-flow-sentinel.