{
  "version": "1.0",
  "name": "Parapet Community: Core Protection",
  "description": "Pattern-based protection using built-in analyzers (no third-party API keys required).",
  "published_at": "2026-04-17T01:15:15Z",
  "source": "parapet-community",
  "rules": [
    {
      "version": "1.0",
      "id": "community-block-unlimited-delegation",
      "name": "Block Unlimited Token Delegations",
      "description": "Prevents unlimited token approvals (u64::MAX) - most common drain attack",
      "enabled": true,
      "tags": [
        "critical",
        "delegation",
        "drain-attack"
      ],
      "rule": {
        "action": "block",
        "conditions": {
          "field": "token_instructions:unlimited_approve_count",
          "operator": "greater_than",
          "value": 0
        },
        "message": "🚨 BLOCKED: Unlimited token delegation (u64::MAX) - common drain attack pattern"
      },
      "metadata": {
        "attack_type": "unlimited_approval",
        "severity": "critical"
      }
    },
    {
      "version": "1.0",
      "id": "community-block-freeze-with-approval",
      "name": "Block Freeze + Approval Combo",
      "description": "Prevents freeze authority abuse combined with token approval",
      "enabled": true,
      "tags": [
        "critical",
        "combo-attack",
        "freeze"
      ],
      "rule": {
        "action": "block",
        "conditions": {
          "all": [
            {
              "field": "token_instructions:has_freeze",
              "operator": "equals",
              "value": true
            },
            {
              "field": "token_instructions:approve_count",
              "operator": "greater_than",
              "value": 0
            }
          ]
        },
        "message": "🚨 BLOCKED: Freeze + Approval combination - attacker can freeze your approved tokens"
      },
      "metadata": {
        "attack_type": "freeze_combo",
        "severity": "critical"
      }
    },
    {
      "version": "1.0",
      "id": "community-block-burn-with-approval",
      "name": "Block Burn + Approval Combo",
      "description": "Prevents burn operations combined with approvals",
      "enabled": true,
      "tags": [
        "critical",
        "combo-attack",
        "burn"
      ],
      "rule": {
        "action": "block",
        "conditions": {
          "all": [
            {
              "field": "token_instructions:has_burn",
              "operator": "equals",
              "value": true
            },
            {
              "field": "token_instructions:approve_count",
              "operator": "greater_than",
              "value": 0
            }
          ]
        },
        "message": "🚨 BLOCKED: Burn + Approval combination - your tokens could be destroyed"
      },
      "metadata": {
        "attack_type": "burn_combo",
        "severity": "critical"
      }
    },
    {
      "version": "1.0",
      "id": "community-block-net-delegation-increase",
      "name": "Block Net Delegation Increase",
      "description": "Blocks transactions that add more approvals than they revoke",
      "enabled": true,
      "tags": [
        "critical",
        "delegation"
      ],
      "rule": {
        "action": "block",
        "conditions": {
          "field": "token_instructions:net_delegation_change",
          "operator": "greater_than",
          "value": 0
        },
        "message": "🚨 BLOCKED: Net increase in token delegations detected"
      },
      "metadata": {
        "attack_type": "delegation_increase",
        "severity": "critical"
      }
    }
  ],
  "deprecated_rule_ids": []
}