Quick Start: Durable Nonce Monitoring

This guide walks through configuring WatchTower to monitor for durable nonce attacks targeting your Squads v4 multisig. You will set up three bots that provide near real-time alerts on nonce staging activity and multisig configuration changes.

For background on the attack pattern and what each bot detects, see Detecting Durable Nonce Attacks.

The entire process takes under five minutes.

Prerequisites

Before you begin, collect the following values. You will need them when configuring each bot.

Signer public key(s) — the Solana public key of each multisig member you want to monitor. These are individual signer keys, not the multisig address itself.

Signer 1: _______________________________________________
Signer 2: _______________________________________________

Multisig PDA — the on-chain address of your Squads v4 multisig. You can find it in the Squads UI under your multisig settings.

Multisig PDA: _______________________________________________

Go to https://pro.sec3.dev.
Click Sign up if you do not have an account, or Log in if you already have one.
You can sign up using your email or an existing GitHub / Google account.

Step 2 - Navigate to WatchTower

Once logged in, click WatchTower in the left sidebar to open the WatchTower dashboard.

Step 3 - Create a project

A project is a container for your monitored addresses and bots.

Click + New Project in the top-right corner.

Enter a project name (e.g., Multisig Security) and click Create Project.

Step 4 - Add monitored addresses

Add your signer public keys and Multisig PDA so the bots know which accounts to watch.

In the left Addresses panel, click + New.
Paste one of your signer public keys and give it a label (e.g., Signer 1).
Click Add to save the address.
Repeat for each additional signer key.
Add the Multisig PDA as a separate address (e.g., label it Multisig PDA).

Step 5 - Create Bot 1: `solana_nonce_creation`

This bot alerts when a new durable nonce account is created with one of your signer keys as the authority. It provides the earliest on-chain signal of a nonce staging attack.

Click + New Bot in the top-right corner.

Select solana_nonce_creation from the list, then click Choose Bot.

The bot configuration form will appear:

Bot name: Give it a descriptive name (e.g., nonce-creation-monitor).
Network: Select Mainnet-beta.
Target Addresses: Select each signer public key from the dropdown. Do not add the Multisig PDA here — this bot monitors individual signer keys.
Severity: Leave as Medium or adjust to your preference.
Notification: Enable at least one notification receiver by toggling the switch next to it. Supported channels include Email, SMS, Slack, Telegram, Discord, and Webhook.

Example: Setting up Telegram notifications
If you haven't added a Telegram destination yet, click the Telegram button at the bottom of the notification list, then:
Enter a label (e.g., my-telegram) and click Save Label.
Copy the magic words shown on screen.
Open Telegram, start a chat with @sec3_alert_bot (or add it to a group chat).
Paste and send the magic words. The status will change to Connected.
Toggle the switch next to your new Telegram destination to enable it for this bot.
For other notification channels (Slack, Discord, webhooks, etc.), see Alert Destinations.

Click Create Bot.

When this bot fires:

A new durable nonce account <NONCE_ADDR> was created with authority
<SIGNER_PUBKEY> (created by: <CREATOR_PUBKEY>).
This may indicate someone staging a pre-signed transaction attack.

If created by is an address you do not recognize, treat this as a potential attack and follow the steps in Recommended Actions.

Step 6 - Create Bot 2: `solana_nonce_authority_change`

This bot alerts when a nonce account's authority is transferred to or from one of your signer keys.

Click + New Bot.
Select solana_nonce_authority_change, then click Choose Bot.
Bot name: e.g., nonce-authority-change-monitor.
Network: Mainnet-beta.
Target Addresses: Select the same signer public keys as Bot 1.
Severity: Set to Critical (authority changes are high-signal events).
Notification: Enable at least one notification receiver.
Click Create Bot.

When this bot fires (inbound):

Nonce account <NONCE_ADDR> authority changed from <OTHER_KEY> to
<SIGNER_PUBKEY> (your key). Someone is transferring nonce control to
your signer — potential pre-signed transaction attack staging.

When this bot fires (outbound):

Nonce account <NONCE_ADDR> authority changed from <SIGNER_PUBKEY>
(your key) to <OTHER_KEY>. Your signer's nonce control is being
transferred away — verify this is authorized.

Step 7 - Create Bot 3: `solana_multisig_config_change`

This bot alerts on Squads v4 configuration changes: threshold modifications, member additions and removals, and timelock changes.

Important: The target for this bot is the Multisig PDA, not a signer key.

Click + New Bot.
Select solana_multisig_config_change, then click Choose Bot.
Bot name: e.g., multisig-config-change-monitor.
Network: Mainnet-beta.
Target Addresses: Select the Multisig PDA from the dropdown.
Severity: Set to Critical.
Notification: Enable at least one notification receiver.
Click Create Bot.

When this bot fires:

Squads v4 multisig activity on <MULTISIG_PDA>: <action>.
Verify this action is authorized.
TX: <signature>

Step 8 - Verify

Once all three bots are created, confirm they are active:

In your project, open the Bots tab.
All three bots should show a green status indicator (Active).

Switch to the Alerts tab. Alerts will appear here and will also be sent to your configured notification receivers.

Click on any alert to expand it and see full details, including the transaction signature and the specific addresses involved.

What's next

Read Detecting Durable Nonce Attacks for background on the attack pattern and recommended response procedures.
Configure additional Alert Destinations (Slack, Telegram, webhooks, and more) for team-wide alerting.
Review the full Bots reference for other monitoring capabilities.

PreviousMultisig Security

Last updated 4 months ago

Prerequisites

Step 1 - Sign up and log in