Introducing Proposal Trace

We built Proposal Trace for Curve: a fully automated review of governance proposals and multisig transactions to supplement the work of human reviewers. It gives voters and signers another opportunity to catch mistakes before execution.

It uses Daybreak, a model focused on security, to investigate the actual transaction and the contracts it touches. The agent checks deployed code and state, follows permissions and downstream integrations, and uses fork simulations where useful. A review can extend into the oracles, lending markets, and other systems affected by a change.

A good example came with Curve’s proposal #1457, when Proposal Trace caught an unintended change to an oracle parameter. That finding also exposed the same mistake in an older proposal that had already executed. The new proposal was stopped, and a corrected replacement restored the original oracle setting.

Proposal Trace works directly in Telegram. Configured groups receive audit alerts, and whitelisted members can reply to an alert or the agent’s answers to ask follow-up questions. The agent retains the audit context, can check fresh evidence, and responds in the same conversation.

Proposal Trace was built for Curve, with a modular design that can support other protocols. Each integration feeds curated context about its contracts, permissions, and execution rules into a shared audit prompt. Integrations can also add deterministic checks. For example, Curve gauge additions are checked against the onchain gauge validator we built at yRisk, using state from the proposal’s creation block. Governance proposals and Safe multisigs use the same review process.

The API already supplies findings to Convex’s Curve voting interface and the Curve Proposal Monitor Telegram bot. Contact us for API access.

Proposal Trace is read-only. Human reviewers, voters, and signers remain responsible for deciding what should go ahead.