Sample report
Admin-plane Snapshot report
Important notice
This is not an audit. It does not review program code. It looks at who holds authority over the client's programs and funds, and at the settings and procedures around that authority, as they were at the time shown above.
This is not legal advice. It is not tax or regulatory advice. It gives no assurance that any system is secure. It does not cover events after the date of the Snapshot.
AI tools helped with analysis. A human (the author) reviewed every finding in this report. A finding that is not verified by the author is not part of a report and is removed before it is sent.
The client decides what to change and makes the changes. The author does not hold, and did not ask for, any key, seed phrase or funds. The author provides no out-of-hours cover and no incident response. For a live incident, contact SEAL 911.
1. Summary
Two programs and one multisig were reviewed. There is 1 Critical, 1 High, 1 Medium and 1 Low finding. Do first: move the upgrade authority of EXAMPLE-PROGRAM-ID-A from a single key to the multisig, and give the multisig a time lock.
| Severity | Count |
|---|---|
| Critical | 1 |
| High | 1 |
| Medium | 1 |
| Low | 1 |
| Info | 0 |
2. Scope and method
- Programs reviewed:
EXAMPLE-PROGRAM-ID-A(vault program),EXAMPLE-PROGRAM-ID-B(rewards program). - Multisigs reviewed:
EXAMPLE-MULTISIG-ID. - Method: public explorer data, the Squads app, and the client's written answers.
- Not covered: program code, off-chain systems that were not named, anything after the Snapshot date.
- Questions the client did not answer: none.
3. Authority map
| Authority address | Type | Controls | Threshold / time lock | Config authority |
|---|---|---|---|---|
EXAMPLE-WALLET-1 | Plain wallet | Upgrade authority of EXAMPLE-PROGRAM-ID-A | 1 of 1 / none | Not applicable |
EXAMPLE-VAULT-1 (vault of EXAMPLE-MULTISIG-ID) | Squads vault | Upgrade authority of EXAMPLE-PROGRAM-ID-B; treasury funds | 2 of 5 / 0 seconds | EXAMPLE-WALLET-2 |
Blast radius: if EXAMPLE-WALLET-1 is compromised, an attacker can replace the code of the vault program at once, with no second approval and no delay. If two of the five multisig members are compromised, an attacker can upgrade the rewards program and move treasury funds with no delay to react in.
4. Findings
Severity uses the scale in the checklist. All findings below are invented for this sample.
| ID | Severity | Title | Evidence | Recommendation | Verified by author |
|---|---|---|---|---|---|
| 1 | Critical | Single-key upgrade authority on the vault program | EXAMPLE-PROGRAM-ID-A, explorer program data page, SAMPLE-DATE-TIME-UTC | Move the upgrade authority to a multisig with a time lock, or make the program immutable if upgrades are no longer needed. | Yes (sample) |
| 2 | High | Multisig time lock is 0 | EXAMPLE-MULTISIG-ID, Squads settings, SAMPLE-DATE-TIME-UTC | Set a time lock the team can watch and react within. Add alerts on proposals and approvals. | Yes (sample) |
| 3 | Medium | Config authority is set to a plain wallet | EXAMPLE-MULTISIG-ID, Squads settings: config authority EXAMPLE-WALLET-2 | Make the multisig autonomous, or point the config authority at a stronger multisig. | Yes (sample) |
| 4 | Low | No written signing procedure | Client's written answer to checklist items C7 and C9 | Write a one-page signing policy and a procedure for a signer who leaves or loses a device. Try it once on a test multisig. | Yes (sample) |
Finding 1: Single-key upgrade authority on the vault program (Critical)
What we saw: the upgrade authority of EXAMPLE-PROGRAM-ID-A is EXAMPLE-WALLET-1, a plain wallet.
Why it matters: whoever holds that one key can replace the program's code immediately, and nothing delays or checks it.
Recommendation: move the authority to the multisig vault once the time lock is set (finding 2).
Finding 2: Multisig time lock is 0 (High)
What we saw: an approved proposal can be executed at once. Threshold is 2 of 5.
Why it matters: a hostile approval cannot be seen and stopped before it takes effect.
Recommendation: choose a delay the team can react within, and name who watches the alerts, including at night.
Finding 3: Config authority is set (Medium)
What we saw: EXAMPLE-WALLET-2 can change members, threshold and time lock without a vote.
Why it matters: one key can undo the multisig's protections.
Recommendation: remove the config authority, or set it to a stronger multisig.
Finding 4: No written signing procedure (Low)
What we saw: the team has no written procedure for signing, or for a signer who leaves or is suspected of compromise.
Why it matters: in a rush, people improvise. This makes the other findings more likely to be exploited.
Recommendation: write it, then try it once.
5. Recommended settings
| Setting | Current | Recommended |
|---|---|---|
| Threshold | 2 of 5 | 3 of 5, independent members, reachable in an emergency |
| Time lock | 0 seconds | A delay the team can react within (agreed with the client) |
| Config authority | EXAMPLE-WALLET-2 | None (autonomous) |
| Upgrade authority (program A) | EXAMPLE-WALLET-1 | The multisig vault |
| Alerts | None | Proposals, approvals, config changes, program upgrades, new nonce accounts |
6. Next steps
- Move the upgrade authority of program A to the multisig vault.
- Set a time lock and remove the config authority.
- Write the signing procedure. A re-check (£1,200 per quarter) can confirm the changes.