> Every Sentinel doc, as Markdown: https://runsentinel.app/llms.txt

# sBTC and PoX-5 alerts: stalled withdrawals, peg and admin changes

Get an email, Slack message or signed webhook when an sBTC withdrawal stalls, the peg moves in a way it shouldn't, or a PoX-5 admin role changes. One line per check, no contract to name.

sBTC and PoX-5 are watched as a whole: there is no target and no plan. Each named check runs once for everyone, from secondlayer's sBTC and PoX-5 feeds, and alerts every account that holds it.

## Stalled withdrawals

```sh
$ sentinel when sbtc stall
$ sentinel when sbtc stall --gap 5 --open 40 --to slack:#peg
```

`stall` alerts when a withdrawal is due (6 Bitcoin confirmations) and no sweep confirms for more than `--gap` blocks (default 7), or when a withdrawal stays open `--open` blocks (default 30) with no accept or reject. Over MCP, send the same text to the `when` tool: `when { line: "sbtc stall --gap 5 --open 40" }`.

## Peg and key changes

```sh
$ sentinel when sbtc peg --to slack:#peg
$ sentinel when sbtc rotation --to email
```

`peg` alerts when the newest peg output is spent outside a sweep, when a sweep moves it to a script the signer registry doesn't derive, or when a confirmed sweep waits more than 90 minutes for its acknowledgment on Stacks. `rotation` alerts when deposits completed more than `--after` (default 6h) after a key rotation are still locked to an earlier key set.

## PoX-5 admin and bonds

```sh
$ sentinel when pox5 admin --to slack:#oncall
$ sentinel when pox5 bond-setup --to email
$ sentinel when pox5 early-exit --to slack:#oncall
```

| Check | Alerts when |
|---|---|
| `pox5 admin` | The bond-admin or pause-admin role moves, or signer rewards are paused. Urgent. |
| `pox5 bond-setup` | A bond is set up. Normal inside the earlier bonds' parameters, urgent when its target rate, ratios, early-exit script, a staker or a max-sats is outside them. |
| `pox5 early-exit` | An L1 bond's Bitcoin output is spent before its lock opens, by a staker who never announced an early exit. Urgent. |

## The other sBTC checks

| Check | Alerts when |
|---|---|
| `sbtc payout` | An accepted withdrawal's sweep output doesn't pay its recipient exactly what it asked, or a sweep pays an output no accept explains. |
| `sbtc mint` | A completed deposit isn't backed by a sweep that spends it. A v2 deposit hides its recipient, so it says "v2: not verifiable now", never unbacked. |
| `sbtc protocol-update` | A protocol contract (governance, deposit, withdrawal) is replaced. Urgent, with the code diff. |
| `sbtc reserve` | The peg holds more than 0.01 BTC less than the sBTC it backs, 3 sweeps in a row. |

## What arrives

Facts only: the transactions, the blocks, the numbers, and where each came from. No model writes an alert. Bitcoin transactions come from secondlayer's SPV proofs, checked before use. Data that can't be read, or reads stale, makes a check wait and retry; it never alerts.

## What to know

| | |
|---|---|
| Paid tier | System watches are refused on Free with `402` and `sentinel upgrade builder`. They are included on a paid tier and don't count toward your contracts. |
| Shared checks | A check runs once for everyone. You choose which to hold, their parameters and where alerts go; you don't change the logic. |
| After the block | An alert follows the block or Bitcoin transaction that holds the event, not the mempool. |
| Witness fields | Fields read from a transaction's witness (a deposit's recipient, max fee and lock keys) come from the transaction bytes, which SPV doesn't prove. |
| Cost | See [Pricing](/pricing). Events are never billed. |

## Related

- [Watches & alerts: sBTC and PoX-5](/docs/watches-and-alerts#sbtc-and-pox-5)
- [Billing: what counts](/docs/billing#what-counts)
- [Monitor a Stacks contract and get alerts](/docs/monitor-a-stacks-contract)
- [Send Stacks contract alerts to Slack or a signed webhook](/docs/stacks-alerts-to-slack-and-webhooks)