Solana governance layer. Tracks 50+ protocols. Live dashboard. GovWatch. Blast Radius. Charts. Telegram Bot. Data sourced onchain, protocol docs and disclosures
Joined April 2026
- Tweets24
- Following9
- Followers60
- Likes379
SolGov retweeted
It detects/monitors proposals across protocols on solana. As zinn said, the framework was already running on those, so adding DAOs is straightforward. I put up a DAO page today so you can see it for yourself, it's also wired into the TG bot. Open to suggestions on which other DAOs people want to see on solgov
SolGov retweeted
Recently Listed:
🔒 Track protocol security @SolGov_
📊 Earning yield, simplified @cashflow_fi
🛠️ Tools for traders & devs @dflow
🗣 Governance, evolved @MetaDAOProject
← This & more, @Solana Index link in Bio
SolGov retweeted
Activity feed live on @SolGov_
TG bot subscriptions available for push alerts
Dug into the BonkDAO treasury drain for 20M+
Config made it a sitting duck, SPL governance did exactly what the passed vote told it to through a single malicious governance proposal
Quorum - 1% of supply
Timelock - 0
Proposal creation threshold - 100M BONK
Voting power - liquid BONK, not staked or locked
Direct treasury transfer execution via Realms
Proposer/executor - 8xxRdtzsw1CJWfEahViqNjZwh5dYJAdSbBctWwcbycVo
Voter - CyEE7oHVDaFJ5xZLbXY3h2Z2uk1VwhTkdy72kPUEtypQ
Timeline (UTC)
June 30 08:25 - proposer creates BIP #76, inserts 4 instructions (2x metadata as cover, create recipient account & the SPL token transfer) signs off and voting opens
July 4-5 - voter acquires 882.3B BONK from exchanges. 530,397,045,677.94 from Binance and 351,888,204,104.41 from a second CEX hot wallet (reportedly Bybit)
July 5 04:46 - voter locks 882,285,249,588.801 BONK into governance
July 5 06:56 - voter casts the deciding yes 882.38B over the community's 710.85M no. About 1240x the real voters
July 6 08:25:39 - voting closes
July 6 08:26:03-08:26:28 - proposer finalises the vote and executes all 4 instructions. Drain completes at 08:26:28, 49 seconds after close
July 6 08:45 - voter pulls the vote and withdraws their 882,285,249,588.801 BONK
Proposal was live for 6 days without any intervention
The drain was a single token transfer. Once the vote passed, Realms governance sent 4,426,104,450,305.966 BONK from the treasury (F8FqZuUKfoy58aHLW6bfeEhfW9sTtJyqFTqnxVmGZ6dU) to the attacker (9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ). Total fee = 0.000105 SOL to move over $20M
TLDR
Fronted $4M of BONK (882.3B), a fraction over the 1% quorum
Fully refundable - withdrawn 19 minutes after the drain
Profit - effectively the entire treasury (20M+).
Net cost - gas (0.000105 SOL)
What would have prevented it
A new proposal alert. A proposal carrying a treasury transfer sat live for 6 days. One alert the moment it was created catches it
An execution timelock (1-3 days) as a failsafe, so a malicious proposal can't fire the second voting ends (basically instant execution like Drift)
A higher quorum + vote escrow (staked/locked, not liquid), so voting power can't be rented for a day and handed back
solgov flags exactly this type of setup in real time via the telegram bot with push alerts and a live activity feed on the website. You'd think with there being 600M+ in hacks since April there would be more urgency to tighten things up. Need to start taking this stuff more seriously as it's just embarrassing at this point
SolGov retweeted
Dug into the BonkDAO treasury drain for 20M+
Config made it a sitting duck, SPL governance did exactly what the passed vote told it to through a single malicious governance proposal
Quorum - 1% of supply
Timelock - 0
Proposal creation threshold - 100M BONK
Voting power - liquid BONK, not staked or locked
Direct treasury transfer execution via Realms
Proposer/executor - 8xxRdtzsw1CJWfEahViqNjZwh5dYJAdSbBctWwcbycVo
Voter - CyEE7oHVDaFJ5xZLbXY3h2Z2uk1VwhTkdy72kPUEtypQ
Timeline (UTC)
June 30 08:25 - proposer creates BIP #76, inserts 4 instructions (2x metadata as cover, create recipient account & the SPL token transfer) signs off and voting opens
July 4-5 - voter acquires 882.3B BONK from exchanges. 530,397,045,677.94 from Binance and 351,888,204,104.41 from a second CEX hot wallet (reportedly Bybit)
July 5 04:46 - voter locks 882,285,249,588.801 BONK into governance
July 5 06:56 - voter casts the deciding yes 882.38B over the community's 710.85M no. About 1240x the real voters
July 6 08:25:39 - voting closes
July 6 08:26:03-08:26:28 - proposer finalises the vote and executes all 4 instructions. Drain completes at 08:26:28, 49 seconds after close
July 6 08:45 - voter pulls the vote and withdraws their 882,285,249,588.801 BONK
Proposal was live for 6 days without any intervention
The drain was a single token transfer. Once the vote passed, Realms governance sent 4,426,104,450,305.966 BONK from the treasury (F8FqZuUKfoy58aHLW6bfeEhfW9sTtJyqFTqnxVmGZ6dU) to the attacker (9bxWkNf3BtJ6iehq9KbX9uCWMjem4TFiPZ19T2sYJHvQ). Total fee = 0.000105 SOL to move over $20M
TLDR
Fronted $4M of BONK (882.3B), a fraction over the 1% quorum
Fully refundable - withdrawn 19 minutes after the drain
Profit - effectively the entire treasury (20M+).
Net cost - gas (0.000105 SOL)
What would have prevented it
A new proposal alert. A proposal carrying a treasury transfer sat live for 6 days. One alert the moment it was created catches it
An execution timelock (1-3 days) as a failsafe, so a malicious proposal can't fire the second voting ends (basically instant execution like Drift)
A higher quorum + vote escrow (staked/locked, not liquid), so voting power can't be rented for a day and handed back
solgov flags exactly this type of setup in real time via the telegram bot with push alerts and a live activity feed on the website. You'd think with there being 600M+ in hacks since April there would be more urgency to tighten things up. Need to start taking this stuff more seriously as it's just embarrassing at this point
SolGov retweeted
Orca multisig threshold raised from 3 to 5 (5/9)
Governance changes since April 1 on-chain:
- 24 hour governance timelock added
- threshold raised
- signer rotation & role separation (6 of the old signers had full perms, no single signer can now propose, vote and execute)
Why those changes are important:
-a decent timelock would have halted the instant execution of the Drift exploit
-higher threshold = more signers that need to be compromised
-role separation complements the higher threshold, now needs 5 voters plus a separate 1 propose/execute, not just any 5 full signers
What else is positive:
-orca's multisig is autonomous. No configAuthority is set, so the threshold, timelock and members can't be changed outside the full 5/9 vote. No single key can override the above
SolGov retweeted
Awesome stuff here. I really love the idea of independent third parties documenting security practices in a transparent way that everyone can understand.
DeFi protocols shouldn't be a "trust me bro" black box.
Update on solgov, now has a split view for protocols running more than one multisig as per feedback from @redacted_noah
Quick view tool tip on the main dashboard then further detail in the dropdown. Pre-empted some potential Drift changes Noah mentioned from last week. Blanks are ready to fill in when its ready to update
Added Kamino example to demonstate how it looks when this is filled out. Done the same for a few other protocols running multiple multisigs
SolGov retweeted
I ask everyone that you check out SolGov today. Support @Trader_CSK in his efforts in making this space safer.
The latest protocol hacks, drains, scams, etc have been absolute bullshit, and more people should know what kind of security protocols they deposit into have.
Protocol health & security is one of the most important topics today. You should feel safe depositing your funds - verify it with SolGov.
@SolGov_ is now live on Soladex!
🔗 Link to review article below ⤵
SolGov retweeted
Protocol health & security is one of the most important topics today. You should feel safe depositing your funds - verify it with SolGov.
@SolGov_ is now live on Soladex!
🔗 Link to review article below ⤵
SolGov retweeted
Had a quick look into the Humanity ($H) exploit today. Was running a 3/6 multisig, threshold was met as all keys lived on the same device. Had no timelock either.
solgov tracks the Solana equivalent (program upgrade authority, timelock & multisig changes) and I've also added a Token Custody section today. This shows top holders, custody type and wallets that are potentially linked (first funder)
Another example of how a timelock could have helped in this situation. solgov provides alerts within TG for governance changes on chain. All of this can be seen on the activity feed on the website
The alert function could have highlighted the authority update equivalent. Team could have had chance to react by receiving a notification of weird activity, then they reject the transaction. Users are also made aware of the situation so they have time to react as well
I'm aware there's talk about whether this hack was an inside job. Main actionable point I took from this was trying to add more preventative and safety measures on solgov for Solana protocols and users
Welcome any feedback or new information as the Humanity exploit continues to surface
SolGov retweeted
If you want to track the Drift security overhaul. Check SolGov for updates. You can also subscribe to Drift TG alerts via the SolGov bot. On chain case study is located in the Blast Radius section if the team wants to cross reference data with their own findings
Today we are sharing an update on Drift recovery and relaunch
drift.trade/updates/drift-re…
SolGov retweeted
If you've used @SolGov_ and have any feedback I'd greatly appreciate it. Added the link to the @colosseum submission below
SolGov retweeted
Another timelock added
BulkSOL Rate Markets are LIVE on Exponent v2!
Trade the variable yield or lock in a fixed rate, with limited-time rewards for placing YT Limit Orders
Access the BulkSOL rate market on Exponent: app.exponent.finance/en/mark…
SolGov retweeted
Great to see Yieldbay Protocol Health signals being used as part of @SolGov_'s monitoring stack for @colosseum Frontier.
This is exactly what we built the API for.
Been building @SolGov_ for @colosseum's Frontier. Breakdown of what's live
Dashboard
-50 Solana protocols, 60+ governance multisigs
-Multisig config, signer roles, timelocks, program upgrade authority, external config authority, verified build, insurance coverage
-Click any protocol for member roles, Squads best practice comparison, program split authority, audit & docs
-No ratings. On-chain data, protocol disclosures
GovWatch
-Threshold, member and timelock changes
-Every proposal, approvals, rejections, cancellations, execution speed
-Shows who proposes, approves, executes. Flags when the same signer does both
-Public activity log, Telegram alerts routed by severity
Blast Radius
-Upstream & downstream dependency maps across 50 protocols
-Shows where a single weak link cascades through oracle, collateral, routing, settlement
-Rough TVL at risk via contagion
Charts
-Timelock adoption, role separation, threshold ratios, Squads version distribution
-Solana DeFi governance trending up or down over time
Signer Intelligence
-Independence scoring across multisigs
-Flags shared signers across protocols, governance keys touching DeFi, brand new signers, off hours activity
-Same patterns that would have caught Drift's pre attack activity early, applied across all 50 protocols. Prevention layer, not post mortem damage control
Also tracking
-30+ tokens for freeze/mint authority & circuit breaker coverage
-22 LayerZero DVNs
-@yieldbayfi operational signals connected
-Durable nonce detection
-Token-2022 extensions, 1-of-N multisig setups
Hoping to make Solana safer for users & teams, more coming soon.