# deep-monitoring

Storage Slot Monitoring

Not all on-chain changes emit events. Malicious or non-standard contracts can modify critical storage variables — like a proxy's implementation address — without producing any log. Storage monitoring catches what event monitoring misses.

Why Storage Monitoring Matters

The EVM stores contract state in 256-bit storage slots. Standards like ERC-1967 define deterministic slots for proxy metadata — the implementation address, admin, and beacon. These values can change via direct SSTORE operations that produce no event logs at all.

Silent proxy upgrades — a compromised admin replaces the implementation without emitting Upgraded(address)

Parameter manipulation — DeFi protocol risk factors, collateral ratios, or fee parameters change via direct storage writes

Complementary coverage — use alongside event monitoring for defense in depth

How It Works

state-poller — storage pipeline

$ storage-monitor --describe

Poll—Read the storage slot via eth_getStorageAt at a configurable interval

Snapshot—Store the 32-byte value in Redis + PostgreSQL for historical comparison

Compare—Evaluate conditions: changed, threshold crossings, or windowed anomalies

Alert—Send notification via Slack, email, or webhook

Detection Templates

Proxy Upgrade (Storage Slot)

free

Polls the ERC-1967 implementation slot every 60 seconds and alerts on any change. Catches silent upgrades that bypass the Upgraded event.

"Alert me if the USDC proxy implementation changes — even without an Upgraded event."

Custom Storage Slot

pro

Monitor any EVM storage slot for changes or threshold crossings. Provide a hex slot and choose a condition type.

"Alert me if the collateral ratio in slot 0x05 drops below 150%."

Storage Anomaly

pro

Detect sudden deviations from a storage variable's rolling average. Useful for spotting parameter manipulation in DeFi protocols.

"Alert me if the fee parameter changes by more than 200% from its rolling mean."

Well-Known Slots

These deterministic storage slots are defined by ERC standards and never change across deployments. ChainAlert auto-suggests them for proxy contracts.

Slot	Label	Decodes As	Description
0x3608…bbc	ERC-1967 Implementation	address	Logic contract behind a UUPS or Transparent proxy
0xb531…103	ERC-1967 Admin	address	Admin address that can trigger proxy upgrades
0xa3f0…d50	ERC-1967 Beacon	address	Beacon contract for BeaconProxy patterns

Storage Monitoring vs Event Monitoring

These two approaches are complementary, not replacements for each other. Use both for maximum coverage.

Event monitoring catches changes that emit logs — fast, low-cost, and works within the same block

Storage monitoring catches silent mutations that bypass events — requires polling, but covers blind spots that event monitoring can't see

For proxy contracts, we recommend using both the Proxy Upgrade event template and the Proxy Upgrade (Storage Slot) template together for full coverage.