Trade
Rings of small dark and blue blocks around a blue pillar
Transfer hook · 2.3.0 · Apache-2.0

Vigilantis. Rules on every transfer.

Our transfer hook for Solana's Token-2022. Allowlists, blocklists, limits and freezes, checked on every transfer, confidential ones included, with every action on record.

The gate.

Each square is a transfer heading for the token. Each ring is a rule. Switch the rules and see what gets through, and why the rest is refused.

TransferBlocked walletNot registeredAbove the limit
LimitPublic transfers above 1,000 are refused. Confidential ones pass only if the policy accepts that.
BlocklistSender, recipient and any delegate are checked.
AllowlistOnly registered recipients can receive.
0settled
0refused

Nine errors, no surprises.

Every refusal has a name and a number. Pick one to see when it happens and what your logs will show. The ones marked blue come from the hook during a transfer.

A compliant token in four calls.

Create the mint with the hook, set the policy, register the hook's accounts, and manage the lists. Hand the policy to a multisig with a two-step handover when you are ready.

const client = new SentinelClient(provider);

// 1. a Token-2022 mint whose transfer hook is Vigilantis
await client.createCompliantMint({ mint, decimals: 6, freezeAuthority: "sentinel" });

// 2. the policy: blocklist on, no allowlist, no limit
await client.initializePolicy({ mint: mint.publicKey,
  allowlist: false, blocklist: true, maxTransferAmount: 0n });

// 3. the accounts the hook reads
await client.initializeExtraAccountMetaList(mint.publicKey);

// 4. block a wallet and freeze its accounts, with the reason on record
await client.blockAndFreezeWallet(mint.publicKey, suspect,
  { reasonCode: ENFORCEMENT_REASONS.sanctions, caseRef: caseRef("CASE-0042", salt) });

Tested hard. Audited next.

Self-audited, not independently audited yet. Next come roles for compliance officers, a token-wide pause and court-ordered seizure, then an independent audit after the seed round. The audited release, Vigilantis 1.0.0, comes under the Business Source License 1.1: free below a size threshold, a commercial licence above it, and Apache-2.0 three years after each release. Versions up to 2.3.0 stay Apache-2.0.

0integration tests on a local validator
0of 39 deliberate bugs caught by the fuzz model
0% of program lines covered
0random operations in each fuzz run, all matching the model

Figures for Sentinel 2.3.0. The program runs on Solana devnet (2.1.0 deployed). Vigilantis is its new name, used from the audited release.

Private amounts need the rules too.

Vigilantis decides who may receive. Arcantis moves the money privately.