Guides / Admin changes
Get an email, Slack message or signed webhook when a new address calls an admin function, a role moves, or a token gets a new minter. One line per watch, with a 90-day backtest before it's on.
The examples use example-vault and example-token; swap in your own contracts.
sentinel show SP….example-vaultshow lists the @admin and @control groups, read from the contract's code. @admin is every function the code marks as an admin operation; @control is the functions that change who controls the contract. It is free and turns nothing on. Over MCP, the show tool does the same.
sentinel when call example-vault @admin --new-caller --to email
$ sentinel when call example-vault @control --role-change --to slack:#oncall--new-caller alerts when an address calls an admin function for the first time, so the usual callers stay quiet. --role-change alerts on every call that changes who holds a role. Over MCP, send the same text to the when tool: when { line: "call example-vault @admin --new-caller --to email" }.
sentinel when mint example-token example-token --new-minter --to emailThe arguments are the token's contract and the token's name. A mint has no sender in the event, so the minter is the contract the transaction called, else its sender. --new-minter alerts when one that has never minted this token mints.
sentinel when call example-multisig add-signer --to slack:#oncallThis watches calls to the multisig contract's own functions, such as the one that changes its signer set. Name the function the contract's code defines; sentinel show lists them. It says nothing about signers who approve off-chain.
An alert has a plain headline, such as "A first-time caller" or "A function that changes a role was called". Under it are the function, the caller and the transaction, then what to check first and the commands that dig in (sentinel show alr_…). A webhook carries the same facts as typed fields.
| Direct calls only | A call watch sees calls a person signs, not a call nested inside another contract's call (a DAO proposal, an authorized market). |
| State changes | Control changes also reads the state its functions write every 10 minutes. A change no watched direct call explains alerts as "changed outside a watched direct call". |
| Maps | A map is read only at keys already seen in calls, so a new entry under a key never seen isn't caught yet. |
| After the block | An alert arrives after the block that holds the event, not from the mempool. It is a correlation, not a confirmed attack. |
| Cost | Free shows what would have fired and sends one real past match as a test. Live mainnet alerts start at Builder, $19 per contract a month (Pricing). Events are never billed. |