Onchain vault monitoring: what it means for DeFi operators

TL;DR: Mellow’s vault infrastructure now uses continuous onchain monitoring across its contracts and routing dependencies, and live detection helped contain a flash-loan exploit against legacy third-party vault deployments before funds were fully drained, according to Blockaid. The case shows that vault security depends on the full dependency graph, not just the contracts teams directly deploy.

Editorial analysis by NHI Mgmt Group, based on content published by Blockaid: “Blockaid Partners with Mellow Finance to Secure Its Vault Infrastructure”.

By the numbers:

• Blockaid says Mellow's Core Vaults architecture holds more than $250+ million in TVL.
• Blockaid says it scanned over 6.3 billion transactions since 2025.
• Blockaid says it blocked 585 million attacks since 2025.

Key questions

Q: What breaks when vault monitoring stops at the contracts a team directly deploys?

A: Teams miss the dependencies that can still move user capital or corrupt accounting, especially third-party protocols and legacy deployments.

Q: Why do flash-loan exploits create such a severe containment problem for vault operators?

A: They compress attack, accounting manipulation, and value extraction into a short execution window that can repeat before manual review catches up.

Q: What are the signs that share accounting is being manipulated in a vault?

A: Look for repeated redemption patterns, deposits followed by outsized withdrawals, and fund movements that do not match the expected strategy behaviour.

Practitioner guidance

• Map the full vault dependency graph Inventory every lending market, DEX, yield venue, and legacy deployment that can influence vault state, then classify which dependencies can change capital flows or share accounting.
• Add real-time exploit monitoring to vault operations Monitor abnormal fund movements, repeated exploit transactions, and share accounting anomalies across both current and legacy contracts, with alerts routed to responders immediately.
• Pre-authorise containment actions Define who can pause deposits, pause withdrawals, and blacklist known exploit addresses before an attack occurs, and ensure those actions can be executed from the alerting workflow.

Bottom line: Vault operators need to monitor the full dependency graph because legacy deployments and routed protocols can still expose live assets.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →