× 
Operational
Operational security covers the people and devices that run the protocol. These controls assume the program is sound and ask what an attacker can reach anyway, whether a laptop, a Discord account, or a signer who does not check what they sign.
Team laptops and phones hold sessions, credentials, and signing keys. Attackers who cannot break the program instead target the device of someone who can change it.
Endpoint detection and response (EDR) is deployed across all team devices.
Mobile device management (MDM) is deployed across all team devices.
Timely OS patching, disk encryption, and other critical OS security controls are enforced.
Offboarding includes a device audit, and remote wipe capability is in place.
Endpoint compliance is enforced, not assumed.
Multisig thresholds only count independent verifications. When every signer approves whatever the same interface displays, compromising that interface defeats a 4-of-7 as easily as a single key.
Signers use hardware wallets on dedicated devices.
Transactions are verified out-of-band before signing, for example in a separate channel that confirms transaction details or in an alternative Squads UI.
Signing procedures are documented and state what signers must verify.
Signer availability and backup procedures are in place.
Permissions granted for a role tend to outlive the role. People join, move teams, and leave faster than access gets cleaned up. Enforced checklists and periodic reviews keep access matched to current need.
A hijacked official account reaches users with the protocol’s credibility intact. One malicious link posted from it can drain the wallets of everyone who trusts the source. These controls keep account access narrow, audited, and recoverable.
All protocol-controlled channels are secured with hardware 2FA where possible.
Bot permissions and webhook access on Discord, Telegram, and similar platforms are audited and restricted.
Admin access is restricted.
Admin access is logged.
Shared credentials are avoided.
Recovery procedures for a compromised channel are documented.
Treasury controls apply separation of duties to the protocol’s own funds. Defined limits, logged movements, and regular reconciliation make an error or an unauthorized transfer visible before it compounds.
Operational and reserve funds are held in multisig wallets with appropriate thresholds.
Spending limits are defined.
Approval workflows for spending are defined.
Fund movements are logged.
Fund movements are reconciled.
No single individual can move protocol funds.
The inventory records every system, who owns it, and what sensitive data it holds. Systems missing from the inventory are missing from patching, access reviews, and offboarding as well.
Validators, relayers, keepers, and fee payers sign with keys that live on operational hosts. Rewards and fees build up in the accounts those keys control. An attacker who compromises a host takes whatever balance sits there. Scheduled sweeps to custody cap that balance. Some accounts, such as vote and stake accounts, name a separate withdraw authority. Keeping that authority off every host protects the full balance of those accounts.
Every account controlled by an operationally hot key is inventoried with a defined maximum balance. This includes validator identity and vote accounts, relayers, keepers, and fee payers.
Rewards and accrued balances are swept on an enforced schedule with a defined maximum interval. No operational host key controls the destination. Onward movement from the destination requires multi-party authorization, such as a multisig, an HSM with policy enforcement, or a custodial account with enforced withdrawal approval and an address allowlist.
Hot account balances and sweep completion are monitored, with alerts when a balance exceeds its defined maximum or a scheduled sweep does not land.
Where an account names a withdraw authority separate from its operating key, that authority is held in multisig, HSM, or hardware-wallet custody. It is not present on any operational host, including sweep automation.