The Three Core Detection Rules
SentinelGuard does not rely on a single exploit signature. Three rule families run simultaneously per slot — highest score wins. Rules do not stack.
Rule 1: Flash Loan Drain
FLASH_LOAN_DRAINCorrelates flash loan program invocation with a TVL drop >15% in the same 5-slot window.
Trigger Conditions
Flash Loan Detected if:
- Program ID matches known list:
- Solend: So1endDq2YkqhipRh3WViPa8hdiSpxWy6z3Z6tMCpAo
- Marginfi: MFv2hWf31Z9kbCa1snEPdcgp168vLs2YzvYWZbe83Er
- Orca: 9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP
- OR log message contains 'flash_loan' or 'FlashLoan'
TVL Drop Check:
- Drop > 15% from peak_tvl baseline
- Within same 5-slot window as flash loan detection
- peak_tvl set from highest observed TVL
Score Formula
base_score = 40 drop_bonus = tvl_drop_pct * 100 * confidence_factor signer_bonus = 15 // if flash loan signer == drain signer final_score = base_score + drop_bonus + signer_bonus // confidence_factor range: 0.5 – 1.0 // final_score clamped to 99
False Positive Guards
- Jupiter and Raydium swap program IDs are excluded — legitimate swaps triggered false positives in v1.3
- confidence_factor drops to 0.5 if only log keyword match (no program ID match)
- same_signer_bonus only applied if signer is non-null and matches across both instructions
Rule 2: TVL Velocity Drop
TVL_VELOCITYFires when TVL drops ≥20% across 3 consecutive slots, independent of flash loan detection.
Trigger Conditions
- tvl_drop_pct >= 0.20 in last 3 slots
- current_tvl > $50,000 (low-liquidity filter)
- absolute_drop > $10,000 (noise floor filter)
- No flash loan required — standalone signal
Score Formula
base_score = 75 velocity_bonus = (tvl_drop_pct - 0.20) * 100 final_score = base_score + velocity_bonus // clamped to 99
False Positive Guards
- Requires TVL > $50k — ignores micro-protocol noise
- Requires absolute drop > $10k regardless of percentage
- Does not trigger on first 3 slots of monitoring (window not yet full)
Rule 3: Bridge Outflow Spike
BRIDGE_SPIKEFlags post-drain exfiltration — outflow volume exceeds 10x the rolling average in the current slot.
Trigger Conditions
- bridge_outflow > bridge_outflow_avg * 10
- bridge_outflow_avg computed over last 10 slots
- Catches exfiltration even if TVL impact is delayed
Score Formula
if multiplier >= 20:
score = 95
elif multiplier >= 10:
score = 85
else:
score = 0 // rule does not fireFalse Positive Guards
- bridge_outflow_avg must have at least 5 slots of history before rule activates
- Zero-outflow baseline slots are included in average to prevent cold-start spikes
Severity Model
After all three rules evaluate, highest score is taken. Score drives classification and automated response.
| Score | Classification | Alert Published | On-chain Pause |
|---|---|---|---|
| 0–39 | NONE | No | No |
| 40–59 | LOW | No | No |
| 60–74 | MEDIUM | Yes | No |
| 75–89 | HIGH | Yes | No |
| 90–99 | CRITICAL | Yes | Yes |
MIN_SEVERITY_TO_PAUSE defaults to 60. Set in config/default.toml. Lowering below 60 significantly increases false positive pause rate in high-volume pools.