Vault watcher

Monitoring critical spl-token accounts in real time

Table of contents

1. Introduction
2. Usage
3. Configuration
4. Configuration examples
5. Grafana

Introduction

This security utility can be deployed as a container on a server to enable the monitoring of mission-critical spl-token accounts. Thanks to compatibility with Slack notifications, it constitutes the basis for a simple early warning system able to detect suspicious variations in account balances. As such, it can help help detect critical bugs in production systems, as well as intentional attacks resulting from contract exploits, key theft, rogue agents/teams, etc.

Usage

Although the vault-watcher service can be used directly as a binary with a custom postgres instance, we recommend using docker-compose.

git clone [email protected]:Bonfida/vault-watcher.git
cd vault-watcher
cp _accounts.json accounts.json
cp _config.json config.json
cp _.env .env

The accounts.json and config.json should then be edited to configure the service. Optionally, the .env file can be edited as well. Once this is done, we start the docker containers.

sudo docker-compose build
sudo docker-compose up

The Postgres database can be directly accessed. In addition, a grafana instance with a simple provisioned dashboard can be found running at http://localhost:3000 by default.

Configuration

config.json

accounts.json

An array of accounts objects containing

.env

The .env file is used to define additional configuration through environment variables.

Configuration examples

For example, if your endpoint is https://solana-api.projectserum.com and you want to poll data every 5s:

{
  "refreshPeriod": 5000,
  "endpoint": "https://solana-api.projectserum.com"
}

For example if you want to monitor 2Av1qmnqjLcnA9cpNduUL9BQcitobBq1Fiu7ZA4t45a6 and allow a max variation of 1,000 tokens every 5s:

{
  "address": "2Av1qmnqjLcnA9cpNduUL9BQcitobBq1Fiu7ZA4t45a6",
  "maxChange": 1000,
  "maxChangePeriod": 5000,
  "name": "My token account"
}

Grafana

Historical balances can be monitored using Grafana through port 3000