Your protocol treasury holds $50M in USDC and ETH. A multisig signer gets compromised. An automated rebalancer hits a bad state. A grant disbursement fires twice due to a race condition.
In each case, the blockchain records it instantly. Your monitoring layer finds out when you check Etherscan.
That gap — between when something happens on-chain and when you know about it — is where treasuries get drained.
The problem with manual treasury oversight
DeFi treasury management has evolved significantly. Protocols run multisigs with Gnosis Safe, automate grant streams with Sablier, deploy capital into Aave or Compound, rebalance via on-chain strategies. The complexity has grown; the tooling for watching it largely hasn't.
Most treasury teams rely on a combination of block explorers, spreadsheet reconciliation, and Discord alerts from community members. This works until it doesn't. Large transfers don't trigger anything. Unusual contract interactions go unnoticed until a monthly report. Emergency response requires a human to notice something first.
What's missing is a live monitoring layer that treats your treasury addresses as first-class monitoring subjects — watching continuously, alerting immediately, and giving you full transaction context when something breaks the expected pattern.
What 0watch watches on treasury wallets
0watch tracks treasury addresses in real time across Base, Ethereum, Arbitrum, Optimism, and Solana. You define what normal looks like; 0watch alerts when it diverges.
Spend velocity — Set a maximum transaction rate per wallet. If your treasury multisig suddenly executes 20 transactions in an hour, that's not normal operations — you want to know before transaction 21.
Large transfer detection — Define thresholds appropriate to your treasury size. A $500K outbound transfer from a DAO reserve wallet should wake someone up immediately, not show up in a weekly reconciliation.
Protocol exposure — If your treasury strategy is limited to Aave, Compound, and Uniswap, any interaction with a contract outside that list is worth examining. 0watch can alert on any transaction to an unapproved protocol address.
Failed transactions — Reverted transactions on treasury wallets often signal problems: insufficient allowances, broken automation, unexpected state. Surface them immediately.
Setting it up
Three API calls to get a treasury wallet under watch:
# 1. Get an API key
curl -X POST https://watch.0agent.ai/api/keys \
-H "Content-Type: application/json" \
-d '{"owner_email": "[email protected]"}'
# Returns: { "key": "owk_..." }
# 2. Register your treasury wallet
curl -X POST https://watch.0agent.ai/api/wallets \
-H "X-API-Key: owk_..." \
-H "Content-Type: application/json" \
-d '{
"address": "0xYourTreasuryMultisig",
"label": "Main Treasury",
"chain": "ethereum"
}'
# 3. Set alert thresholds and webhook destination
curl -X POST https://watch.0agent.ai/api/webhooks \
-H "X-API-Key: owk_..." \
-H "Content-Type: application/json" \
-d '{
"wallet_address": "0xYourTreasuryMultisig",
"url": "https://your-ops-server/hooks/treasury",
"threshold_eth": 50.0,
"velocity_limit": 5,
"approved_protocols": [
"0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9",
"0x87870bca3f3fd6335c3f4ce8392d69350b4fa4e2"
]
}'
The webhook payload includes the full transaction object — hash, block number, from/to addresses, value, input data, gas used, and the alert type that triggered it. Your ops team gets everything needed to assess the situation immediately.
If you're using the TypeScript SDK:
import { watch } from '@0agent/watch'
watch.register({
wallet: '0xYourTreasuryMultisig',
chain: 'ethereum',
label: 'Main Treasury',
alerts: {
transferLimit: 50, // alert on transfers > 50 ETH
velocityThreshold: 5, // alert if > 5 txns/hour
protocols: [
'0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9', // Aave
'0x87870bca3f3fd6335c3f4ce8392d69350b4fa4e2', // Aave v3
],
failedTransactions: true,
},
webhook: 'https://your-ops-server/hooks/treasury',
})
Who this is for
DAOs with substantial on-chain reserves — If your treasury holds significant value and operations are partly or fully automated, real-time monitoring isn't optional. It's infrastructure.
Protocol teams running automated strategies — Rebalancers, yield optimizers, and liquidity managers can behave unexpectedly under edge conditions. You want to know when they do.
Multisig operators — Even manual multisigs benefit from an external watch layer. If a signer is compromised or a proposal goes wrong, you want an alert that doesn't depend on your own infrastructure being intact.
Auditors and security researchers — 0watch's alert history gives you a timestamped record of every transaction against monitored wallets, useful for incident postmortems and ongoing security monitoring.
Response when an alert fires
The webhook fires immediately when a threshold is crossed. Your response depends on your ops setup — for most teams, the flow is:
- Alert hits webhook endpoint
- Ops system (PagerDuty, Slack, custom) routes to on-call
- On-call verifies the transaction on-chain
- If anomalous: freeze further operations, initiate incident response
The 0watch webhook payload includes alert_type, wallet_address, transaction_hash, value_eth, block_number, and timestamp. No digging required to understand what triggered it.
Start monitoring
Free tier covers 3 wallets with 7-day history. No card required. For production treasury coverage with real-time alerts and full history, Developer tier starts at $49/month.
If you're managing on-chain capital at any scale, start now: watch.0agent.ai