DeFi & Blockchain Protocol Security

Protocol risk is system risk. DeFi failures are often cross-component: contract logic, oracle assumptions, bridge trust, and governance timing. This workflow keeps agent actions narrow and auditable while humans own final protocol decisions. Rechecked August 21, 2026: do not treat leftover advisory version text as a protocol upgrade target.

What this workflow covers

  • Upgrade diff review for proxy and immutable deployments.
  • Oracle and scope guardrails for manipulation-resistant execution.
  • Bridge and multisig emergency runbooks for containment.

Workflow at a glance

DeFi & Blockchain Protocol Security workflow

Turn one smart-contract, bridge, oracle, governance, or multisig finding into a simulation-backed remediation and controlled release decision.

core-remediation

  1. Signal

    Normalize protocol finding

    Capture the contract, chain, deployed version, affected invariant, privilege boundary, and value at risk.

  2. Scope

    Trace protocol dependencies

    Map proxies, bridges, oracles, governance, multisigs, timelocks, integrations, and upgrade authority.

  3. Decision

    Select a remediation path

    Choose a contract fix, parameter guard, pause control, oracle hardening, or governance action.

  4. Action

    Simulate adversarial behavior

    Run unit, fork, fuzz, and invariant tests without touching production keys or live state.

  5. Proof

    Package governed release

    Record residual risk, timelock and signer requirements, monitoring, rollback limits, and evidence.

Decision gate

Does the remedy preserve required invariants and fit the approved upgrade and governance path?

Proceed

Advance a simulation-backed proposal to multisig and governance review.

Hold or stop

Stop when live emergency action, key use, economic redesign, or cross-protocol coordination is required.

Evidence to retain

  • invariant and threat model
  • fork/fuzz/simulation results
  • governance and signer plan

Expected outputs

  • protocol remediation proposal
  • governed rollout packet
  • incident triage note

Eligibility profile

A finding is eligible when:

  • The impacted contracts/configs are known and versioned.
  • A fork-test or simulation harness can validate behavior.
  • Emergency actions are pre-approved in runbook policy.
  • Agent changes are reviewable as code/config, not ad-hoc operator chat.

Recipe catalog

Guardrails

  • Chain-specific simulation required before merge.
  • Invariant tests for solvency, collateralization, and pause logic.
  • Timelock and signer-threshold constraints cannot be weakened by agent.
  • Any unverifiable assumption triggers TRIAGE.md and stop.

Not in scope

  • Autonomous governance voting with production keys.
  • New protocol feature design.
  • Economic parameter tuning without risk committee sign-off.

See also