Entry #0
program SPL Token
operation Approve (04)
moves funds no
in force since 15:10:49 · until 15 Nov
operation Approve (04)
moves funds no
in force since 15:10:49 · until 15 Nov
When a protocol’s admin keys sign what it never declared, its treasury is paid.
Mandate is parametric cover for Solana protocols against unauthorized use of privileged access. Attestors compare each privileged transaction with what the protocol declared in advance; the vote that completes their quorum carries the payout. On devnet, with test capital — terms below.
Insurance covers bugs in code. The largest loss of 2026 carried valid signatures — the contract did exactly what it was told.
Incident 5LEv…dcL · devnet · 6 Oct 2026
One transaction, two instructions
DECLARED · IN FORCE AT 15:12:46 UTC
SIGNED · 15:12:46 UTC
Signed
approve
1 USDC allowance to a new delegate
signed by the privileged key
signed by the privileged key
no entry for this operation
Signed
transfer
400 USDC out of the treasury
same transaction, same signature
same transaction, same signature
- 0 sthe transaction
- +7 sincident opened
- +10 sattestation 1 of 2
- +12 sattestation 2 completes the quorum and pays 9,500 USDC to the treasury
What the protocol wrote down
A declaration entry names an operation the protocol expects its own keys to perform:
- program
- which program it calls
- operation
- which instruction
- window
- from when to when — or permanent
- moves funds
- yes or no
A new entry is in force only after a delay — 30 seconds on this deployment — so a stolen key cannot declare its own theft and act on it at once.
Revoking or narrowing is immediate.
Permanent entries are allowed only for operations that move no funds and hand over no control — a pause, not a withdrawal.
Entries are written with mandate-declare and signed by the protocol’s own key, or emitted unsigned for its multisig.
What the key signed
Every instruction of a privileged transaction is checked against the entries in force at that second. One instruction without an entry is enough — the incident above carried a genuine maintenance approve and a transfer nobody declared.
Ten shapes that real compromises take on chain, staged as real transactions:
- treasury drain
- infinite mint
- authority handover
- freeze user funds
- burn user funds
- lamport drain
- multisig-executed drain
- drain behind a declared operation
- acting before the delay elapses
- acting after revocation
0 of 819
real privileged transactions on mainnet opened an incident. Upgrade authorities of eight programs taken from a recent block — none typed from memory.
10 of 10
shapes recognised on devnet, one incident each — and the eleventh run, maintenance the protocol had declared, left alone. Without it, ten of ten is also the score of a system that flags everything. 6 Oct 2026 · budget ≥ 9 of 10
The vote that pays
Three attestors watch; two must agree. The second vote is not followed by a payout — it is the payout, in the same instruction. There is no appeal window.
policy limit10,000 USDC
protocol’s own retention− 500 USDC
paid to the treasury9,500
pool capital100,100 → 90,600
The 400 USDC actually moved is not in the sum: the payout is the policy limit, not the loss. The retention is why staging an incident against yourself loses money.
10 sconfirmation to payout, p95 of 20 runs. Budget 30 s.
14.4 sslowest of ten, offending transaction to money in the treasury. Budget 180 s.
$0.006in fees to carry one incident, worst case. Budget $1.
40 %of attestors down, and the quorum still decides.
Measured on devnet, 6 October 2026.
Check it without us
Every step of the record is a transaction anyone can read. The decision replays from the public API and an RPC node alone — four devnet incidents in under three seconds each. The ten-minute bound for a person with an explorer is not measured yet.
The transaction2LG96zeU…CENmRiZrkSp8cexplorer ↗
Incident opened3pMBEGej…NguEXLfnzfAznfexplorer ↗
Attestation 13duqCJCh…zHdCU7daexplorer ↗
Attestation 2 · payout36aA2Fqf…HYXytJTEhMmhexplorer ↗
Incident pagethe record as the app shows itopen →
Replayevery account and rule the decision usedopen →
Terms of this deployment
Today
- Devnet only. No mainnet, no external audit — both come before any real money.
- All three attestors are run by us. The quorum is counted honestly; its independence is arithmetic, not real. No stake and no slashing yet.
- The capital in every pool is ours, and so are the policies.
- No real protocol is covered. The protocols are test protocols; the ten compromises are shapes, not any company’s incident.
- USDC here is a devnet test token.
- There is nothing to buy, deposit or connect.
Never
- Cover for code exploits, oracle failures or de-pegs.
- Blocking, co-signing or delaying a transaction — it watches and pays, after the fact.
- Splitting the payout among the protocol’s users. It pays one treasury and stops.
- Recovering stolen funds.
- A human appeal against the quorum.
A fixed sum pays more than a small loss and less than a catastrophic one. That is the price of not assessing damage.