Guides / Large outflows
Get an email, Slack message or signed webhook when STX or a token leaves a contract above an amount, a share of its balance or a total for the day. One line per watch, with a 90-day backtest before it's on.
The examples use example-vault; swap in your own contract. Amounts are in token units (2 is 2 sBTC).
sentinel when transfer example-vault stx --out --over 10000 --to email
$ sentinel when transfer example-vault sBTC --out --over 1 --to slack:#oncallEach alerts when one outflow of the token (or stx) is over the amount. Over MCP, send the same text to the when tool: when { line: "transfer example-vault sBTC --out --over 1 --to slack:#oncall" }.
sentinel when transfer example-vault sBTC --out --over 20%This alerts when one outflow is 20% or more of what the contract held before it, at any vault size. It works for one named token or stx, and not with --within, --new-recipient, an inflow or * (any token). Outflows in one block add up.
sentinel when transfer example-vault sBTC --out --over 2 --within 1dThis alerts when more than 2 sBTC leaves within a day, however many transfers it takes.
sentinel when transfer example-vault sBTC --out --over 1 --new-recipientThis alerts when 1 sBTC or more goes to a recipient the contract has not sent to before. --new-recipient needs --over and does not go with --within.
sentinel describe "alert if more than 5 sBTC leaves example-vault"describe shows the line it reads the sentence as, what that line would have done in the last 90 days, and its cost. It writes nothing.
A plain headline, then one fact per line, then what to check first.
1.55 EXT left the contract
Amount: 1.55 EXT
To: «SP….recipient»
Your limit: none set, so every outflow alerts
Check first: the recipient, and whether this payout was planned.The webhook carries the same facts as typed fields, with kind: "money_out" and the transaction link. A move between a protocol's own contracts is not an outflow and never alerts.
| Any call depth | A transfer is seen however deep the call: a move inside another contract's call still alerts. |
| No limit | An outflow watch with no --over alerts on every outflow. |
| After the block | An alert arrives after the block that holds the event, not from the mempool. It is detection: the transaction is already onchain, and an alert is a correlation, not a confirmed attack. |
| Cost | Free shows what would have fired and sends one real past match as a test. Live mainnet alerts start at Builder, $19 per contract a month (Pricing). Events are never billed. |