Building SolanaSentinel: Pre-Signature CPI Firewall and DeFi Clearinghouse on Solana Devnet

2026-11-08来源 dev.toEnglish

This is a submission for the MLH x DEV Writing Challenge

What I Built

Halfway through testing a Solana swap router on Friday night, I realized how easy it is for an autonomous agent to sign away an entire SPL token account if a malicious Cross-Program Invocation (CPI) slips a TokenProgram::SetAuthority(AccountOwner) call into the instruction bundle. Most wallets show a balance delta preview, yet an agent loop calling a raw signing key has no visual prompt unless you inspect the instruction tree before the Ed25519 signature happens.

I built SolanaSentinel (https://solana-ai.prince.sh) during the MLH Solana Hackathon to act as a pre-signature CPI firewall, multi-DEX order split simulator, Solana Pay checkout generator, and on-chain security arena on Solana Devnet.

When you enter a plain-English intent like swapping 1.5 SOL to USDC with a 35 bps slippage cap, SolanaSentinel compiles the exact 3-instruction tree:

  1. ComputeBudget111111111111111111111111111111 setting a 140,000 compute unit limit and 1,500 micro-lamports priority fee.
  2. JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4 executing SharedAccountsRoute across Orca Whirlpools (65%) and Raydium CLMM (35%).
  3. MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr anchoring a 256-bit SHA-256 provenance digest of the prompt and vault address onto Solana Devnet.

If a prompt or upstream payload tries to inject SetAuthority or exceed the 2.0 SOL daily policy cap, the firewall scores the payload at 96/100 risk and halts the ephemeral Ed25519 session signer before a signature is produced.

Demo

Partner Technologies

  • Solana Devnet JSON-RPC & Solana Actions v2.1.3: The engine polls getVersion, getSlot, getLatestBlockhash, getRecentPerformanceSamples, and getSupply directly from https://api.devnet.solana.com with automatic RPC failover, derives deterministic Base58 agent vaults and ephemeral Ed25519 session signers via Node's native node:crypto, and computes canonical 8-byte Anchor discriminators (sha256("global:<ix_name>")[0..8]). It also exposes /actions.json and /api/actions/audit so Solana Blinks clients can run CPI checks directly.
  • Solana Pay & Metaplex Bubblegum cNFTs: For machine-to-machine oracle calls, SolanaSentinel generates solana:<recipient>?amount=0.05&reference=<pubkey> URIs that settle in a single 420 ms slot, and computes deterministic Bubblegum Merkle leaf hashes for the three interactive security quests.
  • ElevenLabs & Groq Whisper Verification: I embedded a spoken security briefing right into the clearinghouse header using ElevenLabs (eleven_multilingual_v2) and generated custom mechanical click, telemetry scan, and firewall alert sound effects for the walkthrough video. My first TTS pass rushed through "SHA-256" so badly that it sounded like "SHA-2-6", and my first stitched full-page capture had a visible horizontal cut across the cards. Running the audio through Groq's whisper-large-v3-turbo word-timestamp API caught the mispronunciation immediately so I could rewrite the phonetic spelling and fix the exact 733 px scroll offset before rendering the final 1080p video.

Hackathon Experience

Shipping across both MLH Global Hack Week: Builders Week and the MLH Solana Hackathon over the same weekend pushed me to ditch generic dark-purple templates altogether. I redesigned SolanaSentinel around a warm archival paper palette (#F7F6F2), hairline rules, and a custom screenprint clearinghouse emblem so reading raw Base58 program IDs and instruction hex feels like inspecting a Swiss financial ledger. What other CPI attack patterns would you want a pre-signature firewall to catch before an autonomous agent signs?

原文：https://www.a8q9.cn/en/article/building-solanasentinel-pre-signature-cpi-firewall-and-defi-clearinghouse-on-sol-029291.html

相关文章