Security-Council threshold reduction (RT)
A real-time signals factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal fires when a protocol's Security Council multisig executes a threshold reduction (e.g., from 3-of-5 to 2-of-5), a timelock removal, or a new-signer addition within 14 days of either of the previous two event types. The signal is generated by monitoring multisig contract events for threshold modification functions and signer-change events on known Security Council addresses. This factor was added in v1.1 (batch-24) as a specific sub-class of RD-F-182 following the Drift Protocol incident. Category 6 context: this is an exploit-in-progress signal that fires during Security Council governance manipulation — the enabling step before a DPRK-class insider drain.
**Why it matters** The Drift Protocol incident (April 2026, $285M) is the direct evidence base for this factor: a 3-of-5 Security Council threshold reduction and timelock removal were executed on March 25–27, and an admin key transfer occurred on April 1, six days before the $285M DPRK exploit. The threshold reduction lowered the required signers to compromise the Security Council from three to two, materially reducing the attack cost. The static-axis equivalent of this signal is RD-F-031 (signer rotation recency). The combination of threshold reduction and same-window timelock removal is a specific pattern not captured by either the general bridge-signer-change signal (RD-F-103) or the governance-proposal-execution signal (RD-F-101), warranting its own factor.
**Green / Yellow / Red** Green is the baseline when no Security Council threshold reductions or timelock removals have occurred in the trailing 30 days, or when a documented and governance-forum-approved rotation is underway. Yellow fires when a signer addition occurs following governance disclosure — a normal rotation event. Red fires when a Security Council threshold reduction (lowering required signers) or timelock removal is executed within any 14-day window, particularly without prior governance-forum discussion.
**Common gray cases** Gray applies when the protocol does not have a Security Council (not applicable for non-bridge, non-Layer-2 protocols), or when the multisig management contract does not emit standard threshold-change events in a monitorable format.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect in real-time whether the bridge/protocol Security Council multisig executes a threshold reduction (e.g. 3/5 → 2/5), timelock removal, or new-signer addition within ≤14 days of either of those events.