After a suspicious signature, start by identifying the signed payload, active approvals, connected sessions and whether assets have moved. Do not immediately destroy evidence or sign more messages from the possibly compromised context.
This concept matters because Preserve the suspicious payload and transaction hashes.
Triage determines what authority may exist and whether losses are ongoing before remediation changes the scene.
Preserve URL, timestamp, signature, active approvals, sessions and asset movement evidence first.
At protocol and execution level, inspect detect and scope and contain and preserve and prioritize. Protocol identifiers remain untranslated because they are part of the technical payload.
detectidentify suspicious event
scopewhat accounts/sessions/approvals affected
containstop further authority
preserveretain evidence
prioritizeassets at immediate risk first
Panic signing, revoking from the same compromised device or deleting sessions can destroy useful evidence or deepen compromise.
The practical consequence is that Check approvals and sessions before assuming the incident is over. Unknown is not equivalent to safe.
Stabilize, preserve evidence and move response to a known-clean environment.
The practical consequence is that Check approvals and sessions before assuming the incident is over.
Escalate when evidence is contradictory, incomplete or the consequence exceeds routine policy.
Verify the request through independent evidence before irreversible authorization.
freeze risky activity
capture transaction/signature evidence
disconnect sessions
enumerate approvals/assets
choose containment actions by exposure
Record the facts, assumptions, unknowns and decision so another analyst can reproduce the review.
Preserve the suspicious payload and transaction hashes. and Use a known-clean environment for remediation where possible.
Preserve the suspicious payload and transaction hashes.
identify suspicious eventwhat accounts/sessions/approvals affectedstop further authorityretain evidenceassets at immediate risk firstpanic transactions
evidence deleted
wallet remains connected
active approvals unknown
compromised device reused
freeze risky activity
capture transaction/signature evidence
disconnect sessions
enumerate approvals/assets
choose containment actions by exposure
facts → material evidence
evidence → consequence / authority
consequence → explicit decision + next action
incident triage worksheetincident / triage
On 22 August 2023 Balancer disclosed a critical vulnerability affecting some pools. Its Emergency SubDAO had mitigated more than 80% of affected liquidity, enabled proportional exits and urged users in remaining at-risk pools to withdraw.
critical vulnerability in selected poolsmore than 80% of affected liquiditypause + proportional exitapproximately 4% of Balancer TVL at disclosureIncident response starts before exploitation when credible evidence exists. Asset classification, emergency authority, user-specific exposure and a safe exit path materially change the blast radius.
What evidence threshold should trigger emergency controls, and how would you separate mitigated, pausable and still-at-risk assets in the first response hour?
unexpected Permit2 signatureunknownyespossiblenot enumeratedURL + timestamp + signature availableBefore answering the checkpoint, identify the authority being granted, the trust boundary that can fail, and the consequence that becomes irreversible.
Separate identity, authority, execution and context before reaching a security decision.
Who or what is requesting, receiving or representing authority?
yesWhat capability can be granted, retained or exercised?
not enumeratedWhat will the payload, route or system actually do?
Which surrounding facts can materially change the decision?
unexpected Permit2 signatureunknownpossibleURL + timestamp + signature availableDo not answer from memory. Use the case, protocol fields and verification procedure above to write a reproducible finding.
Preserve the suspicious payload and transaction hashes.
Check approvals and sessions before assuming the incident is over.
Use a known-clean environment for remediation where possible.
Record your reasoning before the checkpoint. Finish with an explicit decision or next action. Notes stay on this device.
Develop all three sections before completion.
Triage suspicious signatures and sessions before panic causes more damage or evidence is lost.