Security Tooling
PAL funded the development of security tooling which benefits the Polkadot ecosystem.
On this page you will find a list of all security tools that were funded by PAL, organized by category.
Static Analysis
Scout by Coinfabrik
Link: https://github.com/CoinFabrik/scout-audit
Scout is a static analysis tool which enables developers to automatically identify common vulnerabilities in their code (e.g. unsafe math). It includes 19+ detectors for Substrate, and 33+ detectors of Ink! smart contracts. The detectors have been selected based on an analysis of security audits to identify the most common issues.
Scout uses the rustc compiler infrastructure to analyze the syntax tree and detect problematic code. Developers can run Scout on their projects with a single command to receive a detailed report of detected issues. The tool supports multiple output formats, including HTML and Markdown, allowing users to choose the one that best fits their workflow. Additionally, Scout integrates into development environments through the Scout VS Code Extension and into CI/CD pipelines via the Scout GitHub Action.
Scout also includes a machine learning dataset which can be used to RAG train a model on Polkadot-SDK vulnerabilities - scout-substrate-dataset. This dataset is also available on Hugging Face.
Monitoring
Polkadot Ecosystem Monitoring Tool
Link: https://www.ocelloids.net/docs/
The Polkadot Ecosystem Monitoring Tool is an open-source platform for real-time and historical monitoring across the Polkadot ecosystem, currently under active development. Built on the Ocelloids framework, it provides actionable insight into transfer activity, including cross-chain bridge transfers, DeFi protocol metrics, and governance events.
Current Capabilities
- Tracking major Polkadot interoperability protocols: XCM, Snowbridge, Hyperbridge, Wormhole, and the Polkadot–Kusama Bridge.
- Monitoring governance proposal life cycles on Polkadot, Kusama, and their parachains.
- Real-time alerts delivered via Telegram and webhooks.
- Visibility of all bridge and XCM flows on XCSCAN.
- Polkadot and Kusama governance Telegram notification bot.
- A monitoring console for teams to manage alerts, visualize metrics, and investigate events.
- DeFi protocol metrics — TVL, swap, and lending volumes — across Hydration, Moonbeam, and Bifrost (DEX liquidity pools, money markets, and liquid staking).
- Alerting templates for money market health (solvency and utilization) and DEX liquidity pool TVL.
Upcoming Features
- DeFi protocol metrics for additional chains (Asset Hub, Acala).
- Visualization of transfer flows, including XCM and bridged transfers, CEX inflows/outflows, and tagged address activity.
- Enhanced rule engine with a lightweight DSL for defining custom alert conditions across chains, events, and time.
Source code: https://github.com/sodazone/ocelloids-services
Milestone Reports
| Milestone | Year | Quarter | Paid out | Report |
|---|---|---|---|---|
| Milestone 1 | 2025 | Q4 | 23,713 DOT | Report |
| Milestone 2 | 2026 | Q1 | 37,251 DOT | Report |
| Milestone 3 | 2026 | Q2 | 47,376.8 DOT | Report |
| Milestone 4 | 2026 | Q2 | 35,085.5 DOT | TBA |
| Infrastructure, operations and maintenance (12 months) | 2026 | Q2 | 19,542.5 DOT | — |