Sigvex
Simulation2 min read

Threat Graph

See admin, bridge, and settlement relationships across EVM, SVM, and ZK in one graph — then compute the blast radius if a given admin key is compromised.

Open Threat GraphAll guides
graphthreatblast-radiuscross-runtime

Threat Graph joins EVM contracts, SVM programs, ZK verifiers, bridges, and assets into one diagram. It probes the admin, proxy, bridge, and settlement edges between them, and — the point of the page — computes how far the damage spreads if a particular admin key is compromised.

Why it exists

Authority relationships cross chains. A single-runtime tool can’t show that the EVM multisig on one side of a bridge is the same authority that governs a Solana program, or that an L2 settler is anchored to an L1 ZK verifier. Those shared authorities are exactly where a compromise turns into a systemic failure, so this page joins the per-runtime probes into one graph where that cross-runtime blast radius is visible.

Who uses it

  • Auditor — finds shared authorities across an engagement’s contracts, programs, and verifiers.
  • Researcher — models attack scenarios that cross bridges or rollup settlement boundaries.

How to open it

  1. Sidebar → Threat Graph.
  2. Direct URL — /threat-graph.

Building and reading the graph

Pick one or more analyzed assets as the source, then project graph to run the EVM and SVM probes in parallel and populate the diagram — or load demo scenario to explore a synthetic cross-runtime example (a shared admin across an EVM bridge and a Solana program, plus an L2 settler anchored to an L1 ZK verifier) when the workspace is empty. A stats row counts nodes, edges, chains, and admin-shared pairs, and clicking a node opens an inspector with its kind, chain, and trust neighbours.

For the blast radius, pick an admin key from the dropdown (populated by the probes) and compute blast radius: the page reports the failure mode, the directly-controlled nodes, the total reach, the chains touched, and the value at risk. Export JSON takes the graph and probes together; Export CSV takes the probe table.

Limits

  • Requires a signed-in account and a workspace with at least one analyzed EVM contract or SVM program — unless you use the demo.
  • The blast-radius math is graph-only: it works from the probed edges, not live RPC state, and the probes depend on each asset having a completed analysis with admin/upgrade-authority detection.
  • Workspaces — the container that scopes the source asset list.
  • Dependency Map — a per-contract call graph rather than a cross-runtime admin graph.
  • Governance Risk — admin concentration for a single target.