ProxyWatch
Control-surface monitoring for on-chain protocols
ProxyWatch watches the upgrade and admin surface of the contracts you specify, and reports the changes it observes. Read-only. No keys. Nothing deployed into your stack. It reports control-surface changes — it does not prevent them, and it is not a guarantee of protection.
The problem
The highest-blast-radius events in a protocol are changes to who controls it:
a proxy upgrade, an AdminChanged, a new owner, a role grant. These
are the events a protocol most needs to see, and the ones most small teams
watch least.
- Audits are point-in-time. They assess the system on audit day. The control surface can change the next morning.
- Dashboards are pull-based. Someone has to look. Nobody looks at 3 a.m.
- Upgrades are quiet. A proxy's implementation can be swapped with one transaction and no visible change to users.
- Single-key admin is common. A proxy whose admin is an externally owned account has no multisig and no timelock between an attacker and the implementation.
ProxyWatch is the continuous watch on that surface: not a dashboard you check, a monitor that reports to you.
What it monitors
Upgrade surface
EIP-1967 implementation, admin, and beacon slots, read directly over public RPC and recorded as a baseline.
Privileged roles
Authority changes such as AdminChanged, OwnershipTransferred, and Upgraded.
Single-key risk
Flags any proxy whose admin is an EOA, meaning no multisig and no timelock, as a critical finding by default.
Change detection
Every control-surface mutation is recorded with its block and transaction, then compared against the previous baseline.
Output is an alert (Telegram or webhook) plus a per-protocol hygiene score and a readable digest.
How it works
-
You name the contracts that hold privileged authority.
Proxy, implementation, admin, and governance contracts, listed in a config file.
-
ProxyWatch reads the control surface over public RPC.
It resolves the upgrade slots and role holders and records a baseline. No private keys, no write access.
-
On every change it messages you.
The alert carries the severity, the diff against the baseline, and the on-chain evidence to verify it. Severity is defined, not implied: critical is an upgrade, or an admin/owner change, or an EOA holding upgrade authority; warning is any other control-surface change.
Run it as a one-off scan, a continuous watch, or behind a small status API. The source and setup notes are in products/proxywatch.
Pricing
Two ways to run it. Both are monitoring, not insurance, and neither responds on-chain on your behalf.
| Plan | Price | Scope |
|---|---|---|
| Self-serve | $499 / month | One protocol, all its contracts, Telegram or webhook alerts, and the periodic digest. |
| Managed | from $3,000 / month | Multiple protocols, response runbooks, and a named contact who works the alerts with you. |
Limits
Read this before you rely on it
- ProxyWatch is monitoring, not insurance, and not a guarantee. It detects and reports control-surface changes; it cannot prevent them.
- It does not respond on-chain. It holds no keys and has no write access, so it cannot pause, upgrade, or block anything.
- It is not an audit and not security, legal, or financial advice.
- Detection depends on the surface it is configured to watch and on public RPC availability. There is no service-level guarantee on how quickly a change is caught.