Defender Is Dead — Here's How I Track Protocol State Across 15 DeFi Protocols Now

#defi #ethereum #security #webdev

OpenZeppelin Defender shut down on July 1st. If you were relying on it to keep tabs on proxy upgrades, admin changes, or protocol parameters across chains, you felt it.

OZ put out Monitor and Relayer as open-source replacements, but those handle event watching and transaction relay. The "show me the current state of my entire protocol across all chains" view? Gone.

I kept hitting this wall during audits. Every time a governance proposal executed, I'd manually pull up Etherscan on Ethereum, then Arbiscan, then Basescan, checking proxy implementations, comparing admin addresses, verifying parameters actually changed. Five chains, twenty contracts, every single time.

So I built a CLI to automate it. It's called protoscan.

How it works

One command. No config needed.

npm install -g protoscan
protoscan scan aave-v3

You get back proxy implementations, admin addresses, protocol parameters, access control roles. Everything you'd normally spend 20 minutes clicking through block explorers to piece together.

It ships with public RPC fallbacks so you don't even need to set up a config file. Just install and scan.

The part that matters

Anyone can write a script to read a storage slot. The hard part is the registry — mapping out which contracts belong to which protocol, what each admin role controls, which parameters matter, on which chains.

For Lido alone that's 10 contracts and 36 parameters. Morpho Blue has 9 contracts with vault owner, curator, guardian roles all tracked separately. Every address and function signature verified against mainnet with actual RPC calls.

I keep seeing people say "just ask AI to generate it." Sure, but AI hallucinates contract addresses. These are real, verified, tested.

Currently covers 15 protocols: Aave V3, Compound V3, Uniswap V3, Maker, EigenLayer, Pendle, Lido, Morpho Blue, Curve, Yearn V3, GMX V2, Spark, Euler V2, Fluid, and Sky.

Snapshot diffing

The scan by itself is useful, but diffing is where it really pays off.

Take a snapshot before a governance vote executes, another one after, then diff them. Changes get classified by severity — implementation upgrade is critical, fee change is warning, supply change is info. You immediately see if something unexpected happened.

This is what I was doing manually before. Now it's one command.

Quick risk check

I added a quick risk assessment too. Not replacing audits — more like a sanity check you run in 10 seconds.

It evaluates things like: is the admin an EOA or a multisig? Is there a timelock? Are all privileged roles controlled by the same address? Is there a fallback oracle?

Gives you a score out of 100 and a letter grade. Found it surprisingly useful for quickly evaluating protocols I haven't looked at before. Catches the obvious red flags that you'd otherwise miss until page 30 of an audit report.

Watch mode with alerts

For ongoing monitoring you can run it in watch mode. It scans at whatever interval you set, diffs against the previous scan, and sends alerts through Slack, Discord, or Telegram if anything changes. Just pass a webhook URL and it auto-detects the platform.

Useful for protocol teams who want to know the moment an admin key changes or a proxy gets upgraded on any chain.

API mode

You can also run it as a REST API. Start it up and you get endpoints for scanning any supported protocol, running risk assessments, listing all protocols. Makes it easy to build a dashboard on top or hook into existing monitoring.

Anyway — it's open source under MIT. If you're dealing with the post-Defender gap, or you just want a faster way to check protocol state, try it.