base-sentinel

A Go service that streams Base L2 blocks and routes interesting on-chain events through Xiaomi MiMo for human-readable risk intelligence — alerts on rug pulls, sandwich attacks, governance exploits, and anomalous flows.

Most on-chain alerting today is regex over JSON-RPC logs. base-sentinel adds a reasoning layer: every interesting event becomes a structured prompt for mimo-v2.5-pro, which produces a short risk note — "this is a known router, ignore", "deployer just bought a million of their own token, watch", "this withdrawal is 12 standard deviations above protocol norms". Operations teams get a stream of human-readable risk notes, not a wall of opcodes.

Why MiMo

• mimo-v2.5-pro runs long chain-of-thought against transaction graphs, contract bytecode, and historical context.
• mimo-v2.5 triages high-frequency events at low cost.
• JSON-mode outputs make every alert machine-parseable.

Features

• Real-time block streamer over WebSocket (ethclient.SubscribeNewHead).
• Pluggable detectors: largeOutflow, suspectDeployer, governanceProposal, priceManipulation.
• MiMo intelligence layer: each candidate event yields a one-paragraph natural-language risk note.
• HTTP API + Webhook fanout (Discord, Slack, generic POST).
• Per-protocol policies in YAML (Aerodrome, BaseSwap, Friend.tech, etc.).
• Prometheus metrics + structured zerolog.

Quick start

git clone https://github.com/FlipZ3ro/base-sentinel
cd base-sentinel
cp .env.example .env  # add MIMO_API_KEY + BASE_RPC_URL
go run ./cmd/sentinel

Send a test webhook:

curl http://localhost:8080/v1/test-alert | jq .

Architecture

   Base RPC + WS
          │
          ▼
   ┌──────────────────┐
   │   block_stream   │  ethclient — newHead subscription
   └────────┬─────────┘
            │  *types.Block
            ▼
   ┌──────────────────┐
   │   detectors      │  parallel — largeOutflow / deployer / gov / price
   └────────┬─────────┘
            │  Candidate{kind, ctx}
            ▼
   ┌──────────────────┐
   │   mimo client    │  → mimo-v2.5-pro: risk note JSON
   └────────┬─────────┘
            │  Alert{severity, note, refs}
            ▼
   ┌──────────────────┐
   │   fanout         │  HTTP API + Discord/Slack webhooks + Prom counters
   └──────────────────┘

Bundled detectors

Detector	Trigger	Severity scale
largeOutflow	Single tx moves > 5 % of a protocol's TVL	low → critical
suspectDeployer	New contract by EOA with < 7 days history	low → high
governanceProposal	New proposal on tracked DAOs	info → high
priceManipulation	Price moves > 8 % within a block	medium → critical

Configuration

configs/sentinel.yaml:

base:
  rpc_url: "https://mainnet.base.org"
  ws_url:  "wss://base-mainnet.public.blastapi.io"

mimo:
  base_url: "https://token-plan-sgp.xiaomimimo.com/v1"
  triage_model: "mimo-v2.5"
  deep_model:   "mimo-v2.5-pro"

detectors:
  largeOutflow:
    pct_of_tvl: 0.05
  suspectDeployer:
    min_age_days: 7

api:
  bind: ":8080"

webhooks:
  - url: "https://discord.com/api/webhooks/..."
    min_severity: "medium"

Roadmap

• Block streamer + 4 reference detectors
• MiMo triage + deep-analysis split
• HTTP API + webhook fanout
• Mempool streaming (alchemy / blockpi pending-tx WS)
• Bytecode-similarity detector (against scam template registry)
• Multi-chain expansion (Optimism, Arbitrum)

Token economics

Throughput	MiMo tokens / day
1 alert / minute	~5M
1 alert / 10 sec	~30M
Mempool stream	~150M

A production deployment monitoring the top-50 Base protocols 24/7 ≈ ~3 B tokens / month.

License

MIT — see LICENSE.