ReferencePre-inclusion detection

Live Detection

One detection core, four lanes, five layers in a fixed order. The only module that works upstream of finality, and the only one with a Solana rule set.

Scope an engagement All references

Five layers, fixed order

Deterministic rules, fork simulation, statistical baselines, ML and graph, invariants, then fusion. The order is a commitment rather than an optimisation: a probabilistic signal can never, on its own, block a transaction or trip a breaker.

rules
sim
baselines
ml
invariants
fusion

Four lanes

One core serves all four, and the shared threat graph is written and read by every one. An address that drained a wallet customer is known to the protocol lane before it arrives. A bridge is a protocol-shaped subject and sits in the first lane; the Circuit Breaker is available on every lane except wallet, which has no contract to guard.

protocol, treasury & bridge monitoring
exchange deposit & withdrawal screening
pre-signature wallet firewall
rollup pre-inclusion screening

The Solana rule set

Written against what the adapter actually emits rather than a translated EVM idea. Nineteen rules, including the durable-nonce authority change that is the Drift Protocol vector. Solana reaches no prevention lane: there is no breaker on it, and the coverage page says so.

rules.solana-nonce-authority-change
rules.solana-authority-change
rules.solana-upgrade-authority-change
rules.solana-program-upgrade
rules.solana-delegate-drain
rules.solana-stake-authority-change
rules.solana-token-account-owner-hijack
rules.solana-seize-and-mint

Cross-chain correspondence

Every destination mint must correspond to a source lock or burn: same message, same amount, same recipient, inside a bounded finality window. Four ways it breaks, all reported separately.

unbacked-mint
message-replay
amount-mismatch
recipient-mismatch

The /v1 surface

Screening, verdicts, onboarding, reserves, audit export and actuation. A screen with no live source consulted returns insufficient-data, never a pass.

/v1/screen
/v1/screen/batch
/v1/verdict
/v1/dapp-check
/v1/onboarding/preview
/v1/onboarding/apply
/v1/reserves/attestation
/v1/audit/export
/v1/coverage
/v1/graph/lookup
/v1/actuation/arm
/v1/shadow/report

Actuation is staged

Report-only against your real traffic first, writing to a durable shadow ledger, until duration, volume and distinct-subject coverage clear a bar you set. Then you arm it, through a module you own and can revoke at any block.

/v1/shadow/report
/v1/shadow/review
/v1/actuation
/v1/actuation/arm

Where the boundary sits.

In the same type as everything above it, and paired with the control that covers it. This is the part your auditor reads first.

The edge Coverage of input is tracked separately from detection quality.

Closed by A detector that never fires can be precise or it can be unreachable, and conflating the two is how a vendor reports a property of its data as a property of its detection. /v1/coverage reports observed block contiguity per chain, and correspondence refuses to gate on a chain whose coverage it cannot vouch for.

Previous referenceAI Agent Guardrails Next referenceAPI reference

Put Live Detection on your perimeter.

Engine-level detail and the full catalogue are provisioned with your engagement, alongside the console your team works in.

Scope an engagement All references