OnChain Sentinel Features

OnChain Sentinel is built to address the real-world risks of digital assets: supply-chain compromise, address swaps, fraudulent approvals, insider errors, and systemic failures at custodial providers. Below is a comprehensive list of features, organized by category, and the protections they provide.

ID	Feature	Helps vs. Supply-Chain / Address-Swap	Helps vs. Policy / Control Flaws	Notes
A1	Deterministic builds & lockfiles	✅ Prevents malicious dep drift	—	Stops bad package versions from sneaking in.
A2	Sigstore/Cosign provenance	✅ Ensures package authenticity	—	Critical for npm compromise scenario.
A3	SBOM generation & drift alerts	✅ Detects injected deps early	—	Gives visibility into supply-chain risk.
A4	Subresource Integrity (SRI) + CSP	✅ Protects DApp UIs from tampered JS	—	Hardens client side against injected payloads.
A5	DApp allowlist by code-hash	✅ Only trusted builds allowed	—	Prevents running compromised UIs.
A6	Emergency dependency quarantine	✅ Pause when deps are compromised	—	Org-wide kill switch on new versions.
B1	Hardware-wallet–first policy	✅ Mitigates address-swap theft	Partial: enforces stronger auth	Protects signing layer; infra flaws are upstream.
B2	Address Lock / Whitelist	✅ Prevents silent address swaps	✅ Adds explicit policy guard	Users/orgs can only send to pre-approved addresses.
B3	Typed-data signing guard	✅ Blocks malicious off-chain approvals	✅ Surfaces risky policy grants	Prevents blind signing of contracts.
B4	Allowance firewall (time/amount bounds)	✅ Mitigates drain risk if approvals injected	✅ Better policy enforcement	Would reduce approval sprawl.
B5	Two-channel confirm (QR/air-gap)	✅ Detects tampered recipients	✅ Adds separation of duties	Separate device = stronger attribution.
B6	Multi-sig in-policy co-sign	✅ Stops single compromised signer	✅ Enforces duties separation	Direct fix for single-actor control flaws.
C1	Address checksum & ENS validation	✅ Catches swapped/malformed addrs	—	Useful in clipboard/JS hijack scenarios.
C2	Clipboard-hijack detection	✅ Detects swapped addrs at paste	—	Immediate protection against malware.
C3	Sticky recipient protection	✅ Prevents last-second swap	—	Locks in reviewed address.
C4	Micro-send challenge	✅ Verifies correct recipient	—	Slows attacker but safe for user.
C5	Mempool simulator & decode	✅ Ensures on-chain target matches UI	✅ Transparent audit of signer attribution	Would detect policy drift.
C6	Domain/link guard	✅ Blocks phishing dApps	—	First line of defense against UI-level swap.
D1	Tamper-evident UI	✅ Blocks injected scripts altering addresses	—	Stronger runtime integrity.
D2	Remote-config hardening	✅ Stops dynamic script hijack	—	Useful against malicious “feature flags.”
D3	Signed autoupdate w/ rollback protection	✅ Prevents poisoned updates	—	Relevant to supply-chain vectors.
D4	Session attestation	✅ Detects compromised wallet clients	✅ Verifies signer identity	Adds attribution layer custodians lack.
E1	Velocity & anomaly rules	—	✅ Flags abnormal flows/patterns	Detects bulk drains.
E2	Geo/IP geofencing	—	✅ Stops out-of-policy access	Adds contextual access policy.
E3	Sanctions/heuristics checks	—	✅ Prevents high-risk recipients	Policy reinforcement.
E4	Pre-check async verdict	✅ Blocks out-of-policy swaps	✅ Blocks out-of-policy flows	Adds PGTAIL enforcement.
E5	Incident “pause new recipients” mode	✅ Mitigates live supply-chain exploits	✅ Org-wide lockdown control	Emergency kill-switch.
F1	Real-time approval/dashboard	✅ Surfaces injected approvals	✅ Visibility into signer attribution	Monitoring + revocation.
F2	Alerting integrations	✅ Detects suspicious activity fast	✅ Early detection of policy breach	Speeds response.
F3	Forensics bundle export	—	✅ Aids accountability & attribution	Supports post-mortems.
F4	Emergency advisory templates	✅ Customer warning system	✅ Regulatory comms	Speeds containment.
G1	Pre-commit policy & dep diff gates	✅ Blocks compromised deps	—	CI/CD safeguard.
G2	Canary dApp detectors	✅ Traps malicious UI behaviors	—	Active honeypot defense.
G3	Sandbox replay	✅ Test attacks safely	—	Reproduce exploits without risk.
G4	Incident playbooks	✅ Standard response process	✅ Institutionalizes lessons	Clear RACI & escalation.

These features form the backbone of OnChain Sentinel’s PGTAIL framework — protecting against supply-chain compromise, address manipulation, and custodial control failures.