× 
Operational
Operational security covers the people and devices that run the protocol. These controls assume the program is sound and ask what an attacker can reach anyway, whether a laptop, a Discord account, or a signer who does not check what they sign.
Team laptops and phones hold sessions, credentials, and signing keys. Attackers who cannot break the program instead target the device of someone who can change it.
Endpoint detection and response (EDR) is deployed across all team devices.
Mobile device management (MDM) is deployed across all team devices.
Timely OS patching, disk encryption, and other critical OS security controls are enforced.
Offboarding includes a device audit, and remote wipe capability is in place.
Endpoint compliance is enforced, not assumed.
Multisig thresholds only count independent verifications. When every signer approves whatever the same interface displays, compromising that interface defeats a 4-of-7 as easily as a single key.
Signers use hardware wallets on dedicated devices.
Transactions are verified out-of-band before signing, for example in a separate channel that confirms transaction details or in an alternative Squads UI.
Signing procedures are documented and state what signers must verify.
Signer availability and backup procedures are in place.
Permissions granted for a role tend to outlive the role. People join, move teams, and leave faster than access gets cleaned up. Enforced checklists and periodic reviews keep access matched to current need.
All internal systems sit behind SSO with hardware 2FA.
Access is provisioned following least privilege.
Onboarding, offboarding, and eviction checklists are in place and enforced.
Access reviews are conducted periodically to catch stale permissions.
A hijacked official account reaches users with the protocol’s credibility intact. One malicious link posted from it can drain the wallets of everyone who trusts the source. These controls keep account access narrow, audited, and recoverable.
All protocol-controlled channels are secured with hardware 2FA where possible.
Bot permissions and webhook access on Discord, Telegram, and similar platforms are audited and restricted.
Admin access is restricted.
Admin access is logged.
Shared credentials are avoided.
Recovery procedures for a compromised channel are documented.
Treasury controls apply separation of duties to the protocol’s own funds. Defined limits, logged movements, and regular reconciliation make an error or an unauthorized transfer visible before it compounds.
Operational and reserve funds are held in multisig wallets with appropriate thresholds.
Spending limits are defined.
Approval workflows for spending are defined.
Fund movements are logged.
Fund movements are reconciled.
No single individual can move protocol funds.
The inventory records every system, who owns it, and what sensitive data it holds. Systems missing from the inventory are missing from patching, access reviews, and offboarding as well.
All systems are inventoried, each with a named owner.
Sensitive data in each system is understood, cataloged, and documented.
The inventory is kept current through onboarding and offboarding processes.
The inventory is kept current through periodic review.