Your attack surface changed this week. Did you?
An onchain protocol's risk is not only what answers on the internet. It is also which contracts are deployed, who can change them, and whether the configuration running today is the one that was reviewed. Guardian watches both surfaces the way an attacker meets them, confirms each finding by hand, and keeps a rating that moves the moment either one does.
- Contract configuration
- Continuous discovery
- Verified exposure
- Rating
- Names & delivery path
One rating over both surfaces, because an attacker does not care which side of the chain boundary the opening is on.
You cannot defend what is not on the list.
Discovery starts from your names, not from an inventory you supply, because the asset that hurts you is the one missing from it: the staging box from last quarter, the bucket someone made public to debug something, the vendor subdomain pointing at a host you decommissioned. The sweep repeats, so next Tuesday's is found in days.
- Asset discovery Subdomain enumeration, DNS sweeps, certificate transparency, and reconnaissance across your public footprint, run from the outside with no inventory assumed.
- Exposed services Open ports, running services, and admin interfaces reachable from the internet: databases, dashboards, and internal tooling never meant to be public.
- Exposed data Public cloud storage buckets, open directories, backups, and configuration files left readable by anyone who knows the URL.
- Known vulnerabilities Outdated and unpatched software on anything exposed, checked against publicly known exploits and then verified by hand.
- Ownership Each asset traced back to a team and a reason it exists. The ones that fail that test are the finding.
A dangling record pointing at storage someone else can claim is not a theoretical finding. It is your domain serving their content.
The contract was reviewed. The configuration it runs today was not.
An audit covers a commit. What determines your risk next quarter is the operational state on top of it: which addresses are live on which chains, who holds each privileged role, what the timelock is set to now, which oracle it reads, and whether the last three deployments were ever looked at. Guardian tracks that state and scores the drift.
None of these three required a bug. Each is a configuration someone changed for a good reason on a busy day, and none of them went back through review.
- Contract inventory Every address you have deployed, on every chain, with its owner, its upgrade path, and whether the bytecode running today is the bytecode that was reviewed.
- Configuration drift Timelocks, thresholds, pause state, fee and risk parameters, and oracle sources, compared against the configuration the review was carried out against.
- Privileged roles Who holds owner, pauser, upgrader and parameter rights on each contract, which of them are EOAs rather than multisigs, and which were meant to be revoked at launch.
- Deployments and upgrades New implementations, proxy pointer changes, and parameter updates surfaced as they land, checked against the reviewed baseline rather than found at the next audit.
- Dependency drift An oracle source swapped, a bridge route added, a keeper replaced: inherited risk that arrives without an announcement and changes what your contracts trust.
Ranked by what reaching it would actually do.
A scanner ranks by CVSS. An attacker ranks by what the box is attached to. Every finding is confirmed by an engineer and then placed against the thing it threatens, so an out-of-date library on a marketing page does not outrank an admin panel one hop from your deploy credentials.
The top-right item had a lower CVSS score than the bottom-right one. It is also the one that ends the company.
- Confirmed by hand Every automated finding is reviewed and validated by an engineer, and the edge configuration is checked directly. You are not handed a scanner report.
- Ranked by reach Each finding is placed against what it is attached to: the credentials it exposes, the systems it neighbours, and how far a foothold would travel.
- An ordered fix list What to decommission, lock down, or patch, in the order that reduces the most exposure first rather than the order a tool emitted.
- Retest included A finding is closed when the fix has been verified from the outside, not when a ticket was moved.
- Quiet by design You hear about what matters, when it is found. Everything else lands in the report, which is the difference between monitoring and alert fatigue.
A number that moves when you do.
Counterparties increasingly ask for evidence rather than assurances, and a PDF from March is not evidence in September. The rating is one comparable figure over both surfaces — contract configuration and external exposure — derived from the findings underneath it, that you can show an exchange, a bank partner, or an institutional allocator, with every input still inspectable.
- Derived, not declared The figure is computed from confirmed findings and their reach, onchain and off. Nothing is scored on a self-assessment questionnaire.
- Decomposable Every point of deduction opens into the finding that caused it, and closing the finding is what moves the number.
- Shareable A view you can hand to a partner or attach to a diligence pack, without handing over the detail of what is currently open.
- Tracked over time History, so improvement is visible and regressions are obvious. A flat line after a hardening sprint is itself a finding.
- Mapped to action Each band carries what it implies: what to fix before a launch, and what a partner is likely to ask about.
The largest deduction on this page is onchain, and it is not a bug. It is three contracts running a configuration nobody signed off.
Control the name and the protocol is irrelevant.
The hosts are one half of the perimeter. The other half is the route a user takes to reach them: a domain name, a DNS answer, and a bundle served from somewhere. Control any one of those and nothing about your contracts has to be attacked at all, so the same coverage watches them.
Four hops, four owners, and usually four different people who each assume one of the others is watching it.
- Registrar and DNS Registrar account security and transfer locks, DNSSEC, registrar-level 2FA, and who inside the company can change a record.
- Domain inventory Forgotten subdomains, dangling records pointing at deprovisioned hosts, and lookalike registrations already in circulation.
- Delivery path CDN and hosting account access, build-to-deploy integrity, TLS and certificate issuance controls, and CAA records.
- Frontend integrity Content Security Policy, subresource integrity, third-party scripts on signing pages, and detection when the served bundle changes.
The registrar was hijacked and the frontend swapped. Users signed on what looked like the real site. CoW Swap · $1.2M (read the incident write-up)
Find out what answers when a stranger asks.
Give us your domains. The first sweep comes back with a complete inventory, each item confirmed by hand, an ordered fix list, and the rating you start from.