Sentinel

Demo

About

Sentinel is a confidential systemic-risk oracle for DeFi lending. It measures something that is difficult to see from any single protocol: how much debt belongs to borrowers who are simultaneously leveraged across multiple lending markets, often against the same collateral. That matters because DeFi protocols normally evaluate risk in isolation. A position may look manageable on Aave or Compound by itself, while the same borrower is using correlated collateral and carrying debt elsewhere. When that collateral falls, those positions can become liquidatable together, turning an individual liquidation into a system-wide cascade. Sentinel joins live lending positions across Aave V3, Compound V2, Compound V3, Morpho Aave V2 and other standardized lending deployments, then combines that exposure with real DEX liquidity to understand not only which debt becomes stressed, but whether liquidations can actually exit through available market depth. The challenge is that calculating this signal requires constructing a per-address map of who borrowed where, what collateral they hold and how close they are to liquidation. Publishing that dataset would create a target list for liquidation bots and expose sensitive wallet behavior. Sentinel therefore computes the cross-protocol map inside a Trusted Execution Environment and publishes only privacy-safe aggregate statistics. The resulting signal includes cross-protocol debt concentration, leverage, shock-response estimates, protocol coupling and a composite systemic-risk score. Thin groups are suppressed with k-anonymity so the aggregate cannot accidentally identify individual borrowers. Sentinel then makes the signal useful in three ways: an interactive risk dashboard for humans, an MCP server that lets AI agents query the signal with block-level provenance, and an on-chain GuardedVault that can automatically increase collateral requirements or pause new borrowing when systemic risk rises. On the live mainnet run used for our demo, Sentinel scanned 37,862 accounts and identified roughly $35.9 million of evaluable debt held by borrowers leveraged across multiple protocols on the same collateral. The goal is to turn a risk pattern that is currently hidden between protocols into a privacy-preserving piece of public infrastructure.

How it's made

Sentinel is built around two partner technologies: The Graph for standardized live blockchain data and Chainlink CRE Confidential Workflows for private computation. For data ingestion, we use The Graph's Messari standardized schemas instead of writing a custom adapter for every protocol. Five lending deployments including Aave V3, Compound V2, Compound V3 and Morpho Aave V2 can all answer essentially the same GraphQL query because they expose the same Lending/CDP schema. The key trick is that `Account.id` represents the wallet address consistently across those subgraphs, so our cross-protocol exposure calculation becomes a primary-key join instead of fuzzy address matching. Adding another compatible lending protocol is largely just adding another deployment to our registry. We also compose that lending data with the Messari DEX AMM schema across Uniswap V3, SushiSwap V2/V3 and Curve. Lending data tells us what can become liquidatable, while DEX liquidity tells us whether that collateral could actually be sold without severe market impact. The cascade pipeline makes hundreds of live depth queries across asset pairs and deduplicates pools before calculating available exit liquidity. The sensitive part runs as a Chainlink CRE Confidential Workflow. We register the workflow with `handlerInTee` and run it inside a Nitro TEE. The Graph API key and Sentinel's risk policy are fetched as secrets directly inside the enclave, and the Graph requests themselves are made from inside the TEE. That means the raw per-address position rows, API responses, risk thresholds and resulting cross-protocol leverage map never need to leave the enclave. CRE's HTTP limits forced us into a pretty interesting three-pass query design. First we bootstrap each protocol's market state and reported totals. Next each protocol independently nominates its largest borrowers so one giant protocol cannot dominate the sample. Finally we fetch complete lending books only for the selected population. We then normalize the positions, join them by wallet, calculate health and shock exposure, suppress protocol-pair buckets that do not meet our k-anonymity threshold, and release only the aggregate Sentinel signal. We also built consistency checks rather than blindly trusting standardized data. Aave V2 is intentionally kept in the deployment registry even though its current subgraph position mappings can dramatically overstate outstanding debt. Sentinel detects that a sampled subset cannot legitimately contain more debt than the protocol reports in total and automatically excludes the deployment, without any Aave-specific exception in the aggregation logic. The enclave output is ABI-encoded and reported with ECDSA/keccak256 signing. A Next.js 16 + React 19 frontend consumes the verified aggregate and visualizes cross-protocol coupling, shock scenarios and cascade risk. We use TypeScript throughout the data and risk pipeline, Viem for Ethereum-facing code, Vitest for testing and Playwright for UI verification. For an on-chain consumer, we built `GuardedVault.sol` with Solidity and Foundry. It verifies Sentinel reports and reacts to changes in systemic risk rather than blindly using the absolute score. As risk rises it can increase collateral requirements and, at the highest alert state, pause new borrowing. It also fails closed if the risk signal becomes stale. Finally, Sentinel exposes an MCP server using the Model Context Protocol SDK. It provides eight tools for querying the signal, protocol coupling, shock ladders, coverage and alert calibration. The agent never receives the private wallet-level exposure map. Those refusals are implemented in the tools themselves rather than relying on a prompt, and every numerical answer is tied back to a specific subgraph and block. One command, `npm run verify`, runs the project's full verification pipeline against live data. There is deliberately no mock-data mode. We also successfully run the CRE workflow through Chainlink's confidential-workflow simulator, while being explicit that the hackathon version is simulated rather than deployed to the live CRE network.