ChainIncident Command Detecção, Contenção e Evidência On-chain

O que está incluído

• Critical asset registry network, contract, proxy, admin, wallet, oracle, bridge and dependency
• Contract implementation/ABI/release reference
• Privileged function and authorized executor
• Economic/technical invariant owner and detection method
• Baseline block/range and expected event/state pattern
• Signal transfer, approval, role change, upgrade, pause, oracle deviation, reserve/supply delta, flash-loan pattern, bridge anomaly or key-use event
• Off-chain signal CI deploy, secret alert, custody login, support report or provider outage
• Rule/static threshold/sequence/graph/invariant detector version
• Model/anomaly score only as triage signal
• No automatic criminal/fraud attribution
• Indexer/provider/block/finality and raw event hash
• Mempool/pre-confirmation signal only when provider and policy support it
• Alert dedup/correlation into incident candidate
• Known maintenance/test/treasury activity allowlist with expiry
• Severity matrix affected asset, privilege, loss/exposure, propagation and reversibility
• Observed fact, hypothesis, assumption and unknown explicitly separated
• Triage checklist contract/version/event/dependency/recent change
• Case status investigating/confirmed/contained/recovering/monitoring/closed
• Incident commander and communication/legal leads
• Timeline in UTC plus block/transaction ordering
• Evidence capture block/receipt/log/trace/state diff/bytecode/ABI/config/screenshot/report
• Multiple RPC/provider corroboration for material fact
• Evidence object hash, source, time and custodian
• Chain-of-custody access/export events
• Address/entity label source/confidence/date
• Actor/cluster attribution remains hypothesis unless authorized authority confirms
• Fund-flow graph hop, asset, amount, time, bridge/swap/protocol and uncertainty
• Do not encourage unauthorized seizure, hacking back or deceptive contact
• Exposure estimate separates confirmed loss, at-risk, frozen/recovered and unknown
• Valuation source/time/caveat
• Playbook reentrancy, oracle, key compromise, malicious upgrade, bridge, token drain, phishing/approval, provider failure
• Containment capability pause, revoke role, disable route, rotate signer, lower limit, block integration or emergency upgrade as preauthorized
• Capability availability checked continuously
• Action proposal exact target/calldata/config, simulation and blast radius
• DecisionRights/WalletPolicy/multisig approval and external execution
• No autonomous irreversible on-chain action
• Emergency path names constitutional/contractual authority and retrospective review
• Action checkpoint and confirmation/finality
• Partial action and compensating plan
• User/customer protection action revoke approval guidance, front-end warning or route disable as approved
• Public status/advisory draft approved by communications/legal
• Partner, exchange, bridge, custodian, insurer or law-enforcement contact record
• Contact does not assert guilt beyond evidence
• Indicator package address/hash/domain/contract shared under approved handling
• Recovery patch links ContractRelease artifact/audit/test
• Migration/upgrade/claim process separately authorized
• Reconciliation ChainReconcile/TreasurySafe before declaring recovery
• Safe reopening criteria invariants, monitoring window and authority
• Postmortem impact, root cause, contributing controls and uncertainty
• Corrective action owner/date/evidence and retest
• Detector/playbook update from learning
• Disclosure timeline and withheld-detail rationale
• Immutable incident evidence package and executive/technical reports
• Tabletop exercise scenarios and action-authority verification
• Metrics detect-to-triage, contain, evidence completeness, action failures and recurrence
• Pilot for four networks, thirty contracts, fifteen detectors and eight playbooks