Security alerts
Sentinel Watch — issuer freezes, tainted funds on the move and privileged-control changes, grouped into incidents and delivered to the dashboard, the Enclave and MCP.
What it is
Sentinel Watch follows the tip of Ethereum, Base, Arbitrum and BNB Chain and turns a short list of on-chain events into incidents: things a holder might want to know about within a minute or two of them landing. The feed lives at /alerts (token-gated) and, once enabled, posts to the Enclave’s 🛡️ Sentinel topic.
Detection runs on free public data with real gaps: some chains lag, some endpoints refuse queries, and labels are heuristic. Incidents are unverified signals, false positives happen, and silence is not evidence that nothing occurred.
What it watches today
| Detector | Fires when | Typical severity |
|---|---|---|
| Issuer freeze | Tether or Circle blacklists (or unblacklists) an address on-chain. | Medium; high when the address was already watched. |
| Tainted funds moving | An address labelled sanctioned, hack-related, drainer, mixer or frozen sends funds. The destination class matters: exchanges, instant exchangers and mixers rate higher than plain wallets. | Low to critical. |
| Privileged-control change | Upgrade, admin, ownership, role, pause or Safe-module events on a tracked protocol contract; a Safe delegatecall rates higher. | Low to critical. |
Drain velocity, flash-loan profit, suspicious contract deployments and perp-DEX anomalies are on the roadmap and will be documented here when they are live.
How incidents work
Detections about the same actor (or, failing that, the same protocol) within a window are grouped into one incident, which carries a stage (funding, preparation, exploitation, laundering or info), a severity from 1 (info) to 5 (critical), a score that grows as more stages appear, and a USD estimate when one can be priced. An incident is open until it is confirmed by an external report, resolved after a quiet period, or dismissed as a false positive. Every incident links its actor to Forensics.
Delivery
- The /alerts page shows every incident at or above the severity you pick, refreshed every minute.
- Telegram: incidents that open at, or escalate to, medium severity or above post to the Enclave 🛡️ Sentinel topic. Routine issuer freezes stay on the dashboard.
- Agents: the
get_security_incidentsMCP tool returns the same feed.
What it is not
Sentinel Watch does not watch the mempool, does not simulate transactions, and does not block anything. It is a post-inclusion, block-level monitor built to be cheap and transparent, not a substitute for a security vendor.