Breakpoint

Inspiration

In Decentralized Finance (DeFi), diversification is often a dangerous illusion. A treasury might split its capital across five different platforms, thinking it is safe, while unknowingly remaining dependent on the exact same small group of humans holding the master keys

It then begs the question: how much diversification do you really have if the same small group can authorize sensitive actions across all your positions? and What is the smallest number of keys that could get hacked, go rogue, or fail, and completely lock me out of my money?

The information is on-chain, but an owner list for one wallet does not explain how its control overlaps with another. We wanted to make those relationships easier to investigate—and give teams a way to test the consequences of changing them.

We built BREAKPOINT because if you cannot map your hidden dependencies, you cannot truly protect your capital.

What it does

BREAKPOINT helps protocol security teams and DAO treasury operators investigate shared control across Safe multisignature wallets and rehearse withdrawal-pause scenarios. It has two connected workflows:

• Read live Safes. Import two to five Safe addresses on a supported network. BREAKPOINT reads their owners, approval thresholds, nonces, and native ETH balances at a single blockchain block. An interactive graph reveals addresses shared across multiple Safes.

• Rehearse control locally. Deploy actual Safe contracts and demo vaults on an isolated blockchain. Choose a signer group, calculate which vaults it can pause, and execute the pause through the Safes’ normal authorization process.

• Compare a proposed change. Adjust a local Safe’s owners or threshold and preview the effect. The comparison checks both the selected group and other groups of the same size, so removing one pair does not conceal another pair with equally broad control.

• Verify and share the result. Apply the configuration through valid Safe approvals, repeat the scenario, and inspect the transaction receipts and observed outcomes. Save the review or export it for another reviewer.

The live importer is read-only. Its calculations describe the owner-threshold model; modules, guards, and contract-owner policies can affect actual execution. Live imports currently include native ETH balances, while transaction rehearsals remain on the local demo chain.

How we built it

We built the interface with Next.js, React, and TypeScript, using React Flow for the relationship graph. Users can reveal the control structure step by step, select signer addresses, switch to a table, and inspect the underlying configuration.

The local environment runs on Hardhat. We deploy official Safe Smart Account contracts, a demo ERC20 token, and pauseable vaults written in Solidity using OpenZeppelin components. ethers.js handles contract reads, transaction encoding, and signature preparation.

The analysis engine evaluates signer combinations against each Safe’s approval threshold. It uses integer arithmetic for balances and exhaustive search within a bounded model of up to twelve distinct owner addresses.

For live ingestion, server-side RPC reads avoid browser CORS issues. The importer checks recognized Safe proxy and implementation bytecode, pins configuration reads to one block, and checks that block’s identity again before returning the result.

We used Mocha and Chai for contract and analysis tests and Playwright for browser workflows. OpenAI Codex assisted with implementation, debugging, and test development. The application itself requires no AI API, paid RPC, wallet connection, or purchased cryptocurrency for its core demonstration.

Challenges we ran into

The first challenge was taking this from a simple idea into a working one, especially adding the live safes.

The second one was the UX, trying to make even someone with little experience about this subject walk through it

Accomplishments that we're proud of

Tackling the challenges and making a functional and intuitive demo

What we learned

Reducing shared control involves tradeoffs. Requiring more approvals may limit the reach of a small group, but it can make emergency coordination harder. Different signer addresses also do not necessarily represent different people.

What's next for Breakpoint

The next step is to connect live discovery more closely to controlled testing. We want to add ERC20 balance discovery, broader Safe configuration support, and explicit analysis of modules, guards, and nested contract owners. We also want to let users fork a supported live configuration into a local environment and rehearse changes against it. For teams, we would add saved configuration histories, change comparisons, and more complete review reports. That would help an operator answer both “Who shares control today?” and “What changed since our last review?” The goal is to make shared authority something a team can regularly inspect, discuss, and test before it becomes an operational problem.

Built With

• chai
• css
• ethers.js
• hardhat
• javascript
• mocha
• next.js
• node.js
• openzeppelin
• playwright
• react
• react-flow
• safe-smart-accounts
• solidity
• typescript