# Quick Start {% hint style="info" %} **Sec3 X-ray scanner software is a security scanner specifically designed for Solana smart contracts.** **Sec3 X-ray can detect more than 50 types of security vulnerabilities and can be integrated into the GitHub CI development process.** **Integrating Sec3 X-ray into your protocol's development process can shift security practices left, reduce costly security issues, and speed up time-to-market.** **sec3 X-ray has been adopted at leading Solana Protocols; try it out today!** {% endhint %} **Sec3 X-ray offers a number of features:** * It detects **50+ types of common security vulnerabilities** in Solana smart contracts, including both Rust-native and Anchor-based programs. See a partial list of the “[Sec3 Vulnerabilities and Exposures (SVE)](https://pro.sec3.dev/sves)”. * It is **integrated into GitHub CI** and **code scanning alerts**. * It issues a **certificate** when no vulnerabilities are found in the program * It provides a **dashboard** to navigate the reported vulnerabilities * It is **fast**: it generates a full report in a few minutes for complex programs. * It is **available 24/7** ## Getting Started ### **1. Sign up:** Go to [https://pro.sec3.dev](https://pro.sec3.dev/) ### **2. Create and run tasks**

### **3. View reports**

![](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2F5byK2CkvD7vRM8bZ55uL%2Fsec3%20-%20Security%20Auditing%20for%20Solana%20Apps%20-%20Google%20Chrome%202022_10_3%2014_23_20.png?alt=media\&token=0f3860bf-be91-464a-82b5-03e349d6fb64) ### **4. Upgrade to a paid plan** The free plan has limited features (e.g., it detects only a subset of the 50+ SVEs). To upgrade, choose a [Build or Scale plan](https://pro.sec3.dev/account#plan) and fill in payment info (either by card or US bank account)**.** ### **5. Download SARIF report** Sec3 X-ray also generates a [SARIF](https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html) report of the results, which can be downloaded from the dashboard. ![](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FdfAUIEcnKO7Ybtenywzs%2Fsec3%20-%20Security%20Auditing%20for%20Solana%20Apps%20-%20Google%20Chrome%202022_10_3%2014_21_27.png?alt=media\&token=f2222a88-8b4e-44b1-a898-79f37c6799f2) # GitHub CI Integration #### The action is located at . ### 1**. Setup integration** First, find the sec3 secret token on the dashboard under “Account -> Security” section. ![Fig 1. Find sec3 token](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FnWgpEnAS6iF248Qk80zN%2F%E6%97%A0%E6%A0%87%E9%A2%982.png?alt=media\&token=56d8f64a-3525-4d5b-9617-6601ea60568c) After acquiring the token, navigate to your GitHub repository. Click through **Settings -> Secrets and variables -> Actions -> New Repository Secret** to add a new action secret. Name the secret as **SEC3\_TOKEN** in the **Name** field, paste the token value in the **Secret** field and click **Add secret**.

#### Next, add a workflow (*.github/workflows/sec3.yml*): ```yaml name: Sec3 Pro Audit # update to match your branch names and requirements on: push: branches: main pull_request: branches: "*" jobs: audit: runs-on: ubuntu-latest steps: - name: Check-out the repository uses: actions/checkout@v2 - name: Sec3 Pro Audit continue-on-error: false # set to true if you don't want to fail jobs uses: sec3dev/pro-action@v1 with: sec3-token: ${{ secrets.SEC3_TOKEN }} ``` **Warning: DO NOT** explicitly include your token in the workflow.‍ A full sample ***sec3.yml*** file can be found [here](https://github.com/sec3dev/ci-test/blob/main/.github/workflows/sec3.yml). The following shows a snapshot of the GitHub action result: ![](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FyQRIGN7ZUoxKGS6ohLjM%2F%E6%97%A0%E6%A0%87%E9%A2%983.png?alt=media\&token=7449d223-007a-494a-9446-26e6a63606aa) The detailed audit report can be viewed by following the link (with authentication). If you would like to hide the detailed report link, add a `hide-report-link` boolean variable in the .yml file. Example: ```yaml - name: Sec3 Pro Audit continue-on-error: false # set to true if you don't want to fail jobs uses: sec3dev/pro-action@v1 with: sec3-token: ${{ secrets.SEC3_TOKEN }} hide-report-link: true ``` If you would like to scan a certain program in the repo, add a `path` variable specifying the path of an individual program. Example: ```yaml - name: Sec3 Pro Audit continue-on-error: false # set to true if you don't want to fail jobs uses: sec3dev/pro-action@v1 with: sec3-token: ${{ secrets.SEC3_TOKEN }} path: one-program ``` ### **2. Code scanning alerts integration** Sec3 X-ray also saves in the workspace a report in SARIF format, named `sec3-report.sarif`, which can be integrated with other jobs such as Code scanning alerts on GitHub:

**Note**: to enable this feature for *private repos*, GitHub requires an organization account and a [*GitHub Advanced Security*](https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository) license. The configuration has two steps: #### (1) **Set up code scanning** (follow [GitHub’s docs](https://docs.github.com/en/enterprise-server@3.4/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/setting-up-code-scanning-for-a-repository)) #### (2) add a workflow (***.github/workflows/sec3-alerts.yml***): ```yaml name: Sec3 Pro Audit # update to match your branch names and requirements on: push: branches: main pull_request: branches: "*" jobs: audit: runs-on: ubuntu-latest timeout-minutes: 15 steps: - name: Check-out the repository uses: actions/checkout@v2 - name: Sec3 Pro Audit continue-on-error: true # set to true if you don't want to fail jobs uses: sec3dev/pro-action@v1 with: sec3-token: ${{ secrets.SEC3_TOKEN }} - name: Upload Sarif Report uses: github/codeql-action/upload-sarif@v2 with: sarif_file: sec3-report.sarif ``` A full sample sec3-alerts.yml file can be found [here](https://github.com/sec3dev/ci-test/blob/main/.github/workflows/sec3-alerts.yml). ![](https://uploads-ssl.webflow.com/62825907e488804fe456dd80/628c618b64eab85e97095495_1*lXEoJqL9Zzh24jzYsI1jNw.png) The screenshot above shows a detected missing signer check issue in Code scanning alerts. ‍‍ # Team Support Build/Scale/Diamond Plan users can add team members.

Click "Account" -> "Team" -> "Add Team Member"

A team member shares the same dashboard as the team owner but cannot do the following actions: **managing the team, changing plans**, and **changing organization information**. Make sure each team member keeps their accounts safe. # Audit Certificate An “auto-audit” certificate will be generated by sec3 X-ray when no issues are found. Click “Download Certificate”, and a certificate pdf will be downloaded: ![](https://uploads-ssl.webflow.com/62825907e488804fe456dd80/628c618bdb38c10455876ed1_1*HIAQNSpblryfLUbR7EPLBw.png) The certificate code version is marked by a Git commit id ![](https://uploads-ssl.webflow.com/62825907e488804fe456dd80/628c618bfd09a1412539ffcf_1*zfzMyi7d-gXoGlhJ-qL0wA.png) # Quick Start Sec3 WatchTower Security Monitor {% hint style="info" %} **WatchTower is an in-situ security threat monitoring service for smart contracts to detect and alert security attacks in near real-time.** **WatchTower deploys "bots" to extract and analyze real time on-chain data to screen suspicious transactions that may expose security risks or prelude hacks.** **WatchTower is brought to you by Sec3, a security and research firm providing bespoke audits and cutting edge tools to Web3 projects.** {% endhint %} **WatchTower offers a number of features:** * A user interface for users to add, customize, deploy, stop bots, and examine alerts in a dashboard. * A set of built-in "bots", based on security analysis logic and domain knowledge to help detect specific signs of security risks, such as abnormal token transfers, abnormal payloads, etc. ## Getting Started ### 1. Create Project On the sidebar of the dashboard, click "**WatchTower**".

Click "**Add a new project**", and give your project a name.

Click "**Add an address**"

Then, add the address(es) of your smart contract.

### **2. Add bots** After an address is added, the address will appear on the **Projects** sidebar. To add a bot, click "**Add Bot**" in the address config menu or "**New Bot**" button on the dashboard

Next, choose a bot from the list of bots, for example, solana\_abnormal\_transfer\_sol, which is designed to watch and alert abnormal size transactions in SOL.

Next, customize the bot:

#### 1) Name the bot (mandatory) A human-friendly name for the bot. #### 2) Target Address(es) to be monitored (mandatory) This is usually the address for a smart contract or an account. #### 3) Severity level (mandatory) Each bot has a default severity level (*medium* in this case), but the user can configure a different severity level. #### 4) Alert destinations (optional) Select the ways you wish the alert to be sent. For details about setting up alert destinations, see {% content-ref url="/pages/x9CGpbiZYjKa8wj00RlX" %} [Alert Destinations](/sec3-watchtower/alert-destinations) {% endcontent-ref %} #### 5) Bot specific parameters (optional) In this case, an alert threshold for the transfer (optional, default 100 for the solana\_abnormal\_transfer\_sol bot). For the complete list of bot types and their parameters, see {% content-ref url="/pages/JSMQZtMSgpjnEqf7us9g" %} [Bots](/sec3-watchtower/bots) {% endcontent-ref %} After the setup is completed, click "**Create bot**". Now the bot is created and running! Note: If your bot continuously generates many alerts, it may be forced to stop. Too many alerts bring down the signal-to-noise ratio and make the monitoring less efficient. You will need to tune your bot parameters and try again. ### 3. View Alerts On the **Alerts** tab in the dashboard, you can view the alerts generated by the bots. The detail of the alert can be expanded by clicking the alert.

Clicking an alert will expand the alert's details.

### 4. Manage Projects & Bots To manage a project, click the [⚙️](https://prod.emojipedia.org/gear/) icon next to the project name. You can edit the project name, add address or delete the project. Managing an address is similar.

To manage a bot, navigate to the Bots panel, where you can check and change the status of the bot. Clicking a bot opens the editing box.

# Alert Destinations Sec3 WatchTower Security Monitor Alert destinations are managed at the user level. They can be managed at any bot's editing page. ## 1. Email Enter a human-friendly label and the email address. You will receive a email for verification.

## 2. SMS Enter a human-friendly label and the phone number. You will then be prompted to enter a six digit code received via a text message.

## 3. Slack Click the button to add Sec3 alert to your Slack channel.

## 4. Discord Follow the next steps to add a discord notification. * Open Discord App * Navigate to the channel which you wish to receive the alerts * Click the **⚙** next to the channel name -> Integrations -> Webhooks -> New Webhook * Copy the Webhook URL. * Go back to Sec3 WatchTower and paste the Webhook URL.

## 5. Telegram Follow the next steps to add a telegram notification. * On WatchTower New Bot modal, click the "Telegram" button. * Give it a human-friendly name as the label, and click "Save Label" * Copy the magic words. * Open Telegram App. * Start a chat with @sec3\_alert\_bot or add it to a group chat. * Paste and send the magic words. Now your telegram notification is set up.

## 6. Webhook(alpha) Sec3 provides a simple webhook for alert notification. To set it up on WatchTower, you will need to provide a URL and a secret.

For information of building the server to receive the alert, see {% content-ref url="/pages/xgr8b7KJjqAMuBYLTEKa" %} [Handle Alert via Webhook](/sec3-watchtower/handle-alert-via-webhook) {% endcontent-ref %} # Handle Alert via Webhook Sec3 provides a simple webhook for alert notification ## Alert Object WatchTower will send each alert as a JSON object to the configured webhook URL via a POST request. {% code title="Alert Object Example" %} ```json { "id": "634cf5d77b42a046f68f5a5d", "botId": "634cf5d77b42a046f68f5a5e", "botName": "MyToken 500+", "projectId": "634cf5d77b42a046f68f5a5a", "projectName": "My Token", "userId": "634cf5d77b42a046f68f5a5f", "username": "John Doe", "template": "AbnormalTransferToken", "severity": "critical", "tx": ["6CfQwX7YwvA2bFRT8wfzZEtVEUbbrjUeMzBa9AbtThioHC6xfrfxSC3nCQWB5Y3BLV9cqadf69n9ApeBYhvwzNF1"], "detail": "The smart contract is involved in a transaction transferring 923750.55 Unknown Token. The token mint is 9Mu1Kaxbe2fehdDoeTJ5oD7XFQmEiZxzspEd3TZGkavx", "target": "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA", "args": {"threshold": "500"}, "isArchived": false, "created_at": "2022-12-06T17:10:21.672Z", "link": "https://pro.sec3.dev/alert/634cf5d77b42a046f68f5a5d" } ``` {% endcode %} ## Sample webhook handler code {% tabs %} {% tab title="Go" %} ```go package main import ( "log" "net/http" "encoding/json" "fmt" "time" ) // Define the Sec3 WatchTower secret // In the actual server, the secret should be put in the environmental variables const SEC3_WATCHTOWER_SECRET = "your_secret" type Alert struct { ID string `json:"id"` BotId string `json:"botId"` UserId string `json:"userId"` ProjectId string `json:"projectId"` Username string `json:"username"` ProjectName string `json:"projectName"` BotName string `json:"botName"` Template string `json:"template"` Severity string `json:"severity"` Tx []string `json:"tx"` Detail string `json:"detail"` Targets []string `json:"targets"` Args map[string]string `json:"args"` IsArchived bool `json:"isArchived"` CreatedAt time.Time `json:"created_at"` Link string `json:"link"` } func sec3WebhookHandler(w http.ResponseWriter, r *http.Request) { // Verify the incoming request. If the secret is empty or does not match // with the one you set, return 401 status code incomingSecret := r.Header.Get("X-Sec3-Watchtower-Secret") if incomingSecret == "" || incomingSecret != SEC3_WATCHTOWER_SECRET { http.Error(w, "unauthorized", http.StatusUnauthorized) return } // Declare a new Alert struct. var alert Alert // Try to decode the request body into the struct. If there is an error, // respond to the client with the error message and a 400 status code. err = json.NewDecoder(r.Body).Decode(&alert) if err != nil { http.Error(w, err.Error(), http.StatusBadRequest) return } // Do something with the alert... fmt.Printf("Alert:\n %+v\n", alert) } func main() { http.HandleFunc("/sec3_webhook", sec3WebhookHandler) err := http.ListenAndServe(":8080", nil) if err != nil { log.Fatal(err) } } ``` {% endtab %} {% tab title="Node.js" %} ```javascript // This example uses express.js framework. See https://expressjs.com const express = require('express'); const app = express(); const port = 3000; // Define the sec3 WatchTower secret // In the actual server, the secret should be put in the environmental variables const SEC3_WATCHTOWER_SECRET = "your_secret"; // Verify the incoming request. If the secret is empty or does not match // with the one you set, return 401 status code app.use((req, res, next) => { const incomingSecret = req.header("X-Sec3-Watchtower-Secret"); if (incomingSecret != SEC3_WATCHTOWER_SECRET) { res.sendStatus(401); return; } next(); }) app.use(express.json()); app.post('/sec3_webhook', (req, res) => { const alert = req.body; // Do something with the alert... console.log(alert); res.sendStatus(200); }) app.listen(port, () => { console.log(`Example app listening on port ${port}`) }) ``` {% endtab %} {% endtabs %} # Bots A bot is a program that monitors a certain type of activity in a smart contract and sends alerts on specific signs of security risks. These bots are configurable and customizable to meet your need. Below is a list of the bots we currently support. ## Solana ### 1**.** Abnormal Transfer SOL Many hacks involve abnormally large size transactions in SOL. This bot detects abnormal transactions that transfer a large amount of SOL exceeding the preset threshold. The default Threshold of the transfer amount is 100. ### **2.** Abnormal Transfer Token Similarly, this bot monitors if large/abnormal sizes of SPL tokens have been transacted. The default alert threshold is 100. ### 3. Smart Threat Monitor The AI bot uses continuously learned invariants to detect potential attacks involving a target address, such as abnormal payloads to invoke a smart contract. ### 4. Metaplex Detect The AI bot uses continuously learned invariants to detect potential attacks involving a target address, such as abnormal payloads to invoke a smart contract. ### 5. DAO Governance The bot detects new proposals under the target DAO realm addresses. ### 6. Nonce Creation Alerts when someone creates a durable nonce account using one of your configured keys as authority. ### 7. Nonce Authority Change Alerts when a durable nonce account authority is changed to or from one of your configured keys. ### 8. Multisig Config Change Alerts when configuration changes are detected on your Squads v4 multisig — including threshold changes, member modifications, timelock updates, and config transaction proposals. ## **Ethereum** ### 1**.** Abnormal Transfer ETH This bot detects abnormal transactions that transfer a large amount of ETH exceeding the preset threshold. The default Threshold of the transfer amount is 100. ## Polygon zkEVM ### 1**.** Abnormal Transfer ETH This bot detects abnormal transactions that transfer a large amount of ETH exceeding the preset threshold. The default Threshold of the transfer amount is 100. # Multisig Security ## Detecting Durable Nonce Attacks ### Background Solana transactions normally include a recent blockhash that expires in roughly two minutes. [Durable transaction nonces](https://docs.solanalabs.com/implemented-proposals/durable-tx-nonces) replace that blockhash with a stored nonce value, allowing a signed transaction to remain valid indefinitely. This is a legitimate feature, but it creates a class of attack against multisig wallets. The attack follows a consistent pattern: 1. **Reconnaissance.** The attacker identifies the signers and approval threshold of a target multisig (e.g., a 2-of-5 Squads v4 multisig). 2. **Nonce staging and social engineering.** The attacker creates durable nonce accounts whose authority is set to one or more of the target's signers — each acting as a "parking slot" for a pre-signed transaction that never expires — while presenting seemingly legitimate transactions to the required number of signers and convincing them to sign. Because the transactions use durable nonces instead of recent blockhashes, the signatures never expire. The signers may not realize the difference. Note that nonce authority can be reassigned after you sign — a transaction that appears harmless at signing time may later be executed by a malicious party once authority has been transferred. 3. **Deferred execution.** The attacker holds the fully-signed transactions and submits them when conditions are most favorable — for example, when token balances are high or vigilance is low. Step 2 is the only step that leaves an observable on-chain footprint *before* funds are at risk. This is the detection window that matters. ### How WatchTower Detects This [WatchTower](https://pro.sec3.dev/) processes every Solana block in near real-time and inspects transactions at the instruction level. Three bots cover this attack pattern: | Bot | What it detects | | ------------------------------- | -------------------------------------------------------------------- | | `solana_nonce_creation` | New durable nonce accounts created with your signer as the authority | | `solana_nonce_authority_change` | Nonce authority transfers to or from your signer | | `solana_multisig_config_change` | Squads v4 configuration changes (threshold, membership, timelock) | > **Not monitoring yet?** [Set up these bots in under five minutes →](/sec3-watchtower/multisig-security/quick-start-durable-nonce-monitoring) The rest of this page explains how each bot works and what to do when an alert fires. #### Nonce account monitoring (primary detection window) This is where the attacker must act on-chain, and where WatchTower provides the earliest warning. **`solana_nonce_creation`** alerts when a new durable nonce account is created with one of your monitored signer keys as the authority. Each alert includes the nonce account address, the authority key, the funding account, and the transaction signature — all extracted directly from the on-chain instruction data at the time of processing. For example: > **New nonce account detected** > > * Nonce account: `3xQp...mN7f` > * Authority: `8rVk...bT2w` *(monitored signer)* > * Funded by: `9zLm...cR4k` *(unknown)* > * Transaction: `5wJd...pK9s` An unknown or unrecognized funding account is the strongest signal of a potential attack. **`solana_nonce_authority_change`** alerts when a nonce account's authority is changed to or from one of your monitored signer keys. An inbound change (authority transferred *to* your signer) indicates a variant of nonce staging. An outbound change (authority transferred *away* from your signer) may indicate that an attacker has seized control of an existing nonce account. #### Multisig configuration changes **`solana_multisig_config_change`** alerts on any Squads v4 configuration change — threshold modifications, member additions and removals, timelock changes, and other administrative actions. This bot detects the kind of preparatory change an attacker might make to weaken governance controls before executing a drain. Any removal or reduction of a timelock should be treated as a critical finding requiring immediate review. ### Recommended Actions on Alert #### Nonce creation alert 1. **Identify the creator.** Check whether the funding account belongs to a known party. If it does not, treat the alert as a potential attack. 2. **Close the nonce account.** A nonce account can be closed by withdrawing its entire balance. This invalidates any pre-signed transactions that reference it. 3. **Review recent signing requests.** Check whether any team member has been contacted with unusual signing requests, unexpected proposals, or unfamiliar transaction links. 4. **Audit governance history.** Review all multisig transactions from the past 60 days and flag any threshold changes, signer rotations, or configuration changes that were not formally authorized. Reject any open proposals that cannot be accounted for. #### Authority change alert * **Inbound (authority transferred to your signer):** Treat as nonce staging. Follow the steps above for nonce creation alerts — investigate the account's origin and close it if it was not created by a known party. * **Outbound (authority transferred away from your signer):** Investigate immediately. This may indicate that an attacker has taken control of a nonce account your signer previously held. Review recent key activity and check for signs of compromise. ### After any alert **Harden the multisig.** Ensure a minimum 24–48 hour timelock is configured on all administrative actions. Any removal or reduction of a timelock should be treated as a critical finding. Audit the current member list and verify the threshold against your documented governance policy. ## Limitations WatchTower monitors new on-chain events in near real-time. It does not retroactively scan for nonce accounts that were created before monitoring was enabled. If you are enabling these bots on an existing multisig, consider running a one-time audit to check whether nonce accounts targeting your signers already exist. Withdrawal and closure of nonce accounts are not currently monitored; detection of those events is on the roadmap. # Quick Start: Durable Nonce Monitoring This guide walks through configuring WatchTower to monitor for durable nonce attacks targeting your Squads v4 multisig. You will set up three bots that provide near real-time alerts on nonce staging activity and multisig configuration changes. For background on the attack pattern and what each bot detects, see [Detecting Durable Nonce Attacks](/sec3-watchtower/multisig-security#detecting-durable-nonce-attacks). The entire process takes under five minutes. *** ## Prerequisites Before you begin, collect the following values. You will need them when configuring each bot. **Signer public key(s)** — the Solana public key of each multisig member you want to monitor. These are individual signer keys, not the multisig address itself. ``` Signer 1: _______________________________________________ Signer 2: _______________________________________________ ``` **Multisig PDA** — the on-chain address of your Squads v4 multisig. You can find it in the Squads UI under your multisig settings. ``` Multisig PDA: _______________________________________________ ``` *** ## Step 1 - Sign up and log in 1. Go to [https://pro.sec3.dev](https://pro.sec3.dev/). 2. Click **Sign up** if you do not have an account, or **Log in** if you already have one. 3. You can sign up using your email or an existing GitHub / Google account. *** ## Step 2 - Navigate to WatchTower Once logged in, click **WatchTower** in the left sidebar to open the WatchTower dashboard. ![WatchTower sidebar](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2Fi5YYR1MyrgUL3XJBbcsB%2Fgitbook_sidebar-watchtower.png?alt=media\&token=96a825e1-bc2a-4d06-b84d-4ba91561d23e) *** ## Step 3 - Create a project A project is a container for your monitored addresses and bots. 1. Click **+ New Project** in the top-right corner. ![New Project dialog](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FU2oSky2biRu11X69Drx2%2Fimage.png?alt=media\&token=65917eca-a062-4b87-82c8-17c8a97e19d1) 2. Enter a project name (e.g., `Multisig Security`) and click **Create Project**. *** ## Step 4 - Add monitored addresses Add your signer public keys and Multisig PDA so the bots know which accounts to watch. 1. In the left **Addresses** panel, click **+ New**. 2. Paste one of your signer public keys and give it a label (e.g., `Signer 1`). 3. Click **Add** to save the address. 4. Repeat for each additional signer key. 5. Add the **Multisig PDA** as a separate address (e.g., label it `Multisig PDA`). *** ## Step 5 - Create Bot 1: `solana_nonce_creation` This bot alerts when a new durable nonce account is created with one of your signer keys as the authority. It provides the earliest on-chain signal of a nonce staging attack. 1. Click **+ New Bot** in the top-right corner. ![Bot selection panel](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FrTboUpwkKChTNai9gqlf%2Fgitbook_new-bot-selection.png?alt=media\&token=7411ccfd-92e8-4924-aacc-4e03f875c07c) 2. Select **`solana_nonce_creation`** from the list, then click **Choose Bot**. The bot configuration form will appear: ![Bot configuration form](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FYez6ieVh7u3RQlDMsJyv%2Fgitbook_bot-config-nonce-creation.png?alt=media\&token=3684e6c0-a4ed-400b-9bab-774f8344372d) 3. **Bot name**: Give it a descriptive name (e.g., `nonce-creation-monitor`). 4. **Network**: Select **Mainnet-beta**. 5. **Target Addresses**: Select each **signer public key** from the dropdown. Do not add the Multisig PDA here — this bot monitors individual signer keys. 6. **Severity**: Leave as **Medium** or adjust to your preference. 7. **Notification**: Enable at least one notification receiver by toggling the switch next to it. Supported channels include Email, SMS, Slack, Telegram, Discord, and Webhook. > **Example: Setting up Telegram notifications** > > If you haven't added a Telegram destination yet, click the **Telegram** button at the bottom of the notification list, then: > > 1. Enter a label (e.g., `my-telegram`) and click **Save Label**. > 2. Copy the **magic words** shown on screen. > 3. Open Telegram, start a chat with **@sec3\_alert\_bot** (or add it to a group chat). > 4. Paste and send the magic words. The status will change to **Connected**. > 5. Toggle the switch next to your new Telegram destination to enable it for this bot. > > For other notification channels (Slack, Discord, webhooks, etc.), see [Alert Destinations](/sec3-watchtower/alert-destinations). 8. Click **Create Bot**. **When this bot fires:** ``` A new durable nonce account was created with authority (created by: ). This may indicate someone staging a pre-signed transaction attack. ``` If `created by` is an address you do not recognize, treat this as a potential attack and follow the steps in [Recommended Actions](broken://pages/1prtkvJ2dn4VtOA4AGRn#recommended-actions-on-alert). *** ## Step 6 - Create Bot 2: `solana_nonce_authority_change` This bot alerts when a nonce account's authority is transferred to or from one of your signer keys. 1. Click **+ New Bot**. 2. Select **`solana_nonce_authority_change`**, then click **Choose Bot**. 3. **Bot name**: e.g., `nonce-authority-change-monitor`. 4. **Network**: **Mainnet-beta**. 5. **Target Addresses**: Select the same **signer public keys** as Bot 1. 6. **Severity**: Set to **Critical** (authority changes are high-signal events). 7. **Notification**: Enable at least one notification receiver. 8. Click **Create Bot**. **When this bot fires (inbound):** ``` Nonce account authority changed from to (your key). Someone is transferring nonce control to your signer — potential pre-signed transaction attack staging. ``` **When this bot fires (outbound):** ``` Nonce account authority changed from (your key) to . Your signer's nonce control is being transferred away — verify this is authorized. ``` *** ## Step 7 - Create Bot 3: `solana_multisig_config_change` This bot alerts on Squads v4 configuration changes: threshold modifications, member additions and removals, and timelock changes. > **Important:** The target for this bot is the **Multisig PDA**, not a signer key. 1. Click **+ New Bot**. 2. Select **`solana_multisig_config_change`**, then click **Choose Bot**. 3. **Bot name**: e.g., `multisig-config-change-monitor`. 4. **Network**: **Mainnet-beta**. 5. **Target Addresses**: Select the **Multisig PDA** from the dropdown. 6. **Severity**: Set to **Critical**. 7. **Notification**: Enable at least one notification receiver. 8. Click **Create Bot**. **When this bot fires:** ``` Squads v4 multisig activity on : . Verify this action is authorized. TX: ``` *** ## Step 8 - Verify Once all three bots are created, confirm they are active: 1. In your project, open the **Bots** tab. 2. All three bots should show a green status indicator (Active). ![Three bots active in Bots tab](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FgHuaUNcKKf6Y6o2T8ukQ%2Fgitbook_bots-tab-three-active.png?alt=media\&token=3e921f43-950a-43af-88dc-9600576958ca) 3. Switch to the **Alerts** tab. Alerts will appear here and will also be sent to your configured notification receivers. ![Alerts tab showing nonce alerts](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FkCvbGUfTXFYEQ182OgXj%2Fgitbook_alerts-tab-nonce.png?alt=media\&token=79828030-30be-40a1-82fd-a0d0b4728014) 4. Click on any alert to expand it and see full details, including the transaction signature and the specific addresses involved. ![Expanded alert detail](https://2586477326-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMej1XIjZMe7uRcLdQG7n%2Fuploads%2FILLznDVLMLsWGF3xJfG9%2Fgitbook_alert-detail-expanded.png?alt=media\&token=e50763ae-8333-4bce-a7d1-c5f325d2aaf9) *** ## What's next * Read [Detecting Durable Nonce Attacks](broken://pages/1prtkvJ2dn4VtOA4AGRn) for background on the attack pattern and recommended response procedures. * Configure additional [Alert Destinations](/sec3-watchtower/alert-destinations) (Slack, Telegram, webhooks, and more) for team-wide alerting. * Review the full [Bots](/sec3-watchtower/bots) reference for other monitoring capabilities.