Security-Council threshold reduction (RT)

Evidence summary #

Cat 6B exploit-in-progress signal [batch-24 v1.1 candidate]. Directly applicable to Raydium's Squads V4 Program Upgrade Multisig (FytDrVzDybM1TwFQPGb8qaxZR7dBCzNeqT3vtQsceZQK, 3/4 threshold, 24-hr timelock). The motivating incident for RD-F-182 — Drift April 2026 (3/5 → 2/5 SC threshold change + timelock removal, 6 days before $285M DPRK exploit) — is directly analogous to Raydium's Squads architecture. Threshold for RD-F-182: Security Council multisig executes threshold reduction, timelock removal, or new-signer addition within ≤14 days. Current posture: Squads V4 at 3/4 threshold with 24-hr timelock intact as of 2026-04-29 (confirmed via Raydium security docs). No threshold reduction or timelock removal events observed. Monitoring gap: Squads V4 transaction events on Solana are monitorable via on-chain program event subscription — this is a priority wiring target given the direct Solana ecosystem relevance and Drift precedent. Score green: current configuration intact; monitoring is

Sources #

Methodology #

Detect in real-time whether the bridge/protocol Security Council multisig executes a threshold reduction (e.g. 3/5 → 2/5), timelock removal, or new-signer addition within ≤14 days of either of those events.

See the full factor methodology and distribution across all protocols →