Argus4626
Real-time ERC-4626 vault monitoring that detects attacks before they become lost funds.
Demo
About
ERC-4626 vaults can be affected by donation/inflation attacks, liquidity drains, share-price crashes, and unbacked minting. I built Argus4626 as a real-time watchdog that detects these patterns directly from on-chain activity and exposes actionable alerts through a live dashboard and GraphQL API. Argus currently monitors four attack patterns: abnormal asset growth without matching shares, withdrawals consuming more than 35% of available liquidity in a short window, sharp asset or share-price drops without a matching withdrawal, and supply growth without sufficient backing assets. I validated the system against a real first-depositor donation attack on a deployed Sepolia vault. The attack used a direct ERC-20 transfer that bypassed the vault’s own events, and Argus still detected it through the underlying asset’s Transfer event and produced a CRITICAL alert end-to-end.
How it's made
I built Argus with Rust, The Graph Substreams, Subgraph Studio, Next.js, TypeScript, and GraphQL. The core Rust Substreams module decodes ERC-4626 Deposit and Withdraw events together with ERC-20 Transfer events directly from Firehose blocks. Store modules maintain per-vault asset and supply deltas, while rolling 60-second withdrawal buckets measure sudden liquidity outflows. A separate Rust module evaluates the security invariants and emits alert entities for a standard EVM Subgraph. The detection logic avoids floating-point arithmetic and division. Threshold comparisons use a custom U1024 type so uint256-scale multiplication cannot overflow. To validate the project, I deployed an ERC-4626 vault and asset on Sepolia, executed a real first-depositor donation attack, and confirmed the resulting CRITICAL alert through the live Subgraph and dashboard.