DETECTION RULES

The Three Core Detection Rules

SentinelGuard does not rely on a single exploit signature. Three rule families run simultaneously per slot — highest score wins. Rules do not stack.

Rule 1: Flash Loan Drain

FLASH_LOAN_DRAIN

Correlates flash loan program invocation with a TVL drop >15% in the same 5-slot window.

Trigger Conditions

Flash Loan Detected if:

  • Program ID matches known list:
    • Solend: So1endDq2YkqhipRh3WViPa8hdiSpxWy6z3Z6tMCpAo
    • Marginfi: MFv2hWf31Z9kbCa1snEPdcgp168vLs2YzvYWZbe83Er
    • Orca: 9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP
  • OR log message contains 'flash_loan' or 'FlashLoan'

TVL Drop Check:

  • Drop > 15% from peak_tvl baseline
  • Within same 5-slot window as flash loan detection
  • peak_tvl set from highest observed TVL

Score Formula

base_score = 40
drop_bonus  = tvl_drop_pct * 100 * confidence_factor
signer_bonus = 15  // if flash loan signer == drain signer

final_score = base_score + drop_bonus + signer_bonus

// confidence_factor range: 0.5 – 1.0
// final_score clamped to 99
Score: 40–99Window: 5 slots

False Positive Guards

  • Jupiter and Raydium swap program IDs are excluded — legitimate swaps triggered false positives in v1.3
  • confidence_factor drops to 0.5 if only log keyword match (no program ID match)
  • same_signer_bonus only applied if signer is non-null and matches across both instructions

Rule 2: TVL Velocity Drop

TVL_VELOCITY

Fires when TVL drops ≥20% across 3 consecutive slots, independent of flash loan detection.

Trigger Conditions

  • tvl_drop_pct >= 0.20 in last 3 slots
  • current_tvl > $50,000 (low-liquidity filter)
  • absolute_drop > $10,000 (noise floor filter)
  • No flash loan required — standalone signal

Score Formula

base_score = 75
velocity_bonus = (tvl_drop_pct - 0.20) * 100

final_score = base_score + velocity_bonus
// clamped to 99
Score: 75–99Window: 3 slots

False Positive Guards

  • Requires TVL > $50k — ignores micro-protocol noise
  • Requires absolute drop > $10k regardless of percentage
  • Does not trigger on first 3 slots of monitoring (window not yet full)

Rule 3: Bridge Outflow Spike

BRIDGE_SPIKE

Flags post-drain exfiltration — outflow volume exceeds 10x the rolling average in the current slot.

Trigger Conditions

  • bridge_outflow > bridge_outflow_avg * 10
  • bridge_outflow_avg computed over last 10 slots
  • Catches exfiltration even if TVL impact is delayed

Score Formula

if multiplier >= 20:
    score = 95
elif multiplier >= 10:
    score = 85
else:
    score = 0  // rule does not fire
Score: 85–95Multiplier: 10x+

False Positive Guards

  • bridge_outflow_avg must have at least 5 slots of history before rule activates
  • Zero-outflow baseline slots are included in average to prevent cold-start spikes

Severity Model

After all three rules evaluate, highest score is taken. Score drives classification and automated response.

ScoreClassificationAlert PublishedOn-chain Pause
0–39NONENoNo
40–59LOWNoNo
60–74MEDIUMYesNo
75–89HIGHYesNo
90–99CRITICALYesYes

MIN_SEVERITY_TO_PAUSE defaults to 60. Set in config/default.toml. Lowering below 60 significantly increases false positive pause rate in high-volume pools.

Was this page helpful?