Would Sentinel have caught the Arkadiko drain?
A governance proposal on Stacks installed a contract that could mint USDA and empty the vault pool. We replayed Sentinel over the chain's own blocks to see what it would have sent, and when.
RRyan Waits
A governance proposal on Stacks installed a contract that could mint USDA and empty the vault pool. We replayed Sentinel over the chain's own blocks to see what it would have sent, and when.
On 22 Oct, between 16:06 and 16:09 UTC, 1.65 sBTC and 2,065,481 stSTX left Arkadiko's vault pool for one address, and 999,999,999 USDA was minted from nothing, the first of six mints. The contract that did it had been installed by a governance vote that closed 98 seconds before the first outflow.
The vote itself had been sitting onchain since 17 Oct. Sentinel reads the same blocks anyone can, so the question is simple to test: point it at the contracts, replay the blocks, and look at what it would have sent.
Three moments matter. An outside address published a contract and, 25 minutes later, proposed giving it mint rights. The same address voted the proposal through alone. Closing the vote installed the contract, and its first calls emptied the pool.
An outsider published a new contract, then 25 minutes later asked Arkadiko's governance to give it mint rights. Their address deploys none of Arkadiko's contracts.
(list (tuple … (can-mint true) (name "vaults-operations") (qualified-name SP1V1BN4…0G34.arkadiko-vaults-operations-v2-1)))The proposal's last argument. arkadiko-governance-v4-3 propose, block 9,237,061, tx 0xe8178f7d…fef63.
The proposer voted it through alone. Closing the vote installed the new contract, 98 seconds before the money moved.
(if (and (>= sum-of-votes participation-threshold) …) (try! (execute-proposal proposal-id)) … (try! (contract-call? .arkadiko-dao set-contract-address name address qualified-name can-mint can-burn))arkadiko-governance-v4-3, lines 358–359 and 425, as deployed.
The sBTC and stSTX left the pool for one address within four minutes, and 999,999,999 USDA was minted from nothing, the first of six mints.
(define-public (settle-fee-budget (amount uint) (payout principal)) … (try! (contract-call? 'SP2C2…arkadiko-dao mint-token 'SP2C2….usda-token amount payout))arkadiko-vaults-operations-v2-1, lines 69–75. No caller check: anyone could call it once the contract held mint rights.
A watch on Arkadiko's governance contract flags the proposal on 17 Oct, because it names a contract published minutes earlier by an address that deploys none of Arkadiko's contracts. It flags again at the close, a call that changes who controls the protocol. Money out sees the drain in the blocks it happens in.
The Proposals watch flags it at the proposal. Control changes flags it again at the close. Money out sees the drain in the blocks it happens in.
when call SP2C2…arkadiko-governance-v4-3 @control Last 90 days: 4 events, 4 would have alertedSentinel's own 90-day preview in prod, and the Proposals rule replayed in prod over both proposals: AIP 32 paged, AIP 30 stayed quiet.
Nine of the ten proposals on this governance contract came from the protocol's own deployer. This one didn't, and its proposer bought DIKO 3 minutes before voting alone.
arkadiko-governance-v4-3 propose: 10 calls, 2 senders since block 0 arkadiko-swap-v2-1 swap-x-for-y by SP1V1B…0G34: wstx → diko, 15:03:46Every propose call on the governance contract since block 0, by sender, and the proposer's swap before the vote, read from secondlayer's Index.
One line turns on the governance contract. Had it been on, Sentinel would have flagged the proposal on 17 Oct, four days and nineteen hours before the first sBTC left the pool, and the vote closing two minutes before.
If you hold the protocol's tokens rather than run it, the same kind of line watches for --over 20% of the vault leaving at once, or a minter --new-minter has never seen. Both would have fired in the minutes of the drain itself.
Each moment, and what Sentinel sends for it with the governance contract and the vault pool on with their defaults, and the new-minter watch on USDA. Times are UTC.
Sentinel watches Stacks contracts and alerts your team by email, Slack or webhook. It never acts onchain.
Preview a watch on any contract. Free, and nothing is saved.
The lines: show and when call … @admin. The full walkthrough is Monitor a Stacks contract.