An audit is a statement about the code as it was on one day. Monitoring is a statement about the system as it behaves now, under real deposits, real borrowers and real oracle prices. We design the invariants worth watching for lending protocols and yield vaults, implement them, and write what to do when one fires.
Most teams we talk to have the tooling already. A free Tenderly account, maybe a Defender instance, sometimes a Discord webhook wired to a transaction firehose nobody reads.
What they do not have is the list. Which quantities, specific to their protocol, should never move outside a range. What the range actually is. How long a breach has to persist before it means something rather than being a large-but-legitimate transaction. And what a human is supposed to do in the ten minutes after the alert lands.
That list is the work. The tooling is a detail, and it is usually already paid for.
Utilisation on a lending pool across thirty blocks. Nothing here is a single dramatic transaction; it is a borrow trend that crosses a line, which is how most of these actually look.
Written against your contracts, not a generic template. Every invariant is specific enough to state as an inequality.
Each one written as a plain-language claim, then as a checkable expression: utilisation ceilings, collateralisation floors, oracle deviation bounds, supply-and-borrow parity, share-price monotonicity, admin-function usage. With the reasoning for the threshold, not just the number.
Deployed into whatever you already run. Tenderly alerts, OpenZeppelin Defender monitors, or a self-hosted watcher against your own RPC endpoint if you would rather not depend on a vendor.
What the breach means, what to check first, which parameter moves, and what that parameter does to the rest of the system. An alert with no runbook is a notification, and notifications get muted.
The thresholds will be wrong at first. We backtest each invariant against your historical transactions before it goes live, then adjust once real traffic disagrees with the backtest.
This is one practitioner, and the scoping should reflect that.
We will come back with five invariants worth monitoring on it, and one thing your current setup would miss. No charge, no call required, and no obligation to continue.
Because the five invariants are the argument. If they are obvious, you did not need us. If two of them had not occurred to you, that tells you more than a sales page could.
It also tells us whether your protocol is one we understand well enough to be useful on, which is the part most vendors skip.