Sky Monitor: Featured App Integrity Guard
Author: Alex
Status: Draft
Created: 2026-04-02
This proposal introduces Sky Monitor, a real-time surveillance system specifically designed to pulse-check the integrity of Featured App (FA) activity on the Canton Network. Canton's CC emission mechanism relies on Activity Markers generated by FA participants. When these markers are artificially inflated through automated farming, circular flows, or "wash activity," it directly dilutes the rewards for all honest validators and developers.
Sky Monitor closes the "detection gap"—currently estimated at several days of manual auditing—by providing automated, real-time insight into the quality of transactions triggering Activity Markers.
Sky Monitor provides the Canton ecosystem with an automated, always-on detection layer that identifies suspicious on-chain behavior patterns, flags anomalous fund flows, and delivers actionable intelligence to the Canton Foundation. By closing the current gap between fraudulent activity and its discovery—which can often take several days under current manual monitoring—Sky Monitor enables timely intervention before significant economic damage occurs.
Specification
1. Objective
The core objective is to protect the Canton Development Fund by ensuring that CC rewards flow only to genuine economic activity. By focusing specifically on Featured Apps, Sky Monitor reduces the data noise of general chain monitoring and delivers high-signal intelligence:
- Focused Real-time Monitoring: Tracking all transactions specifically linked to Activity Marker templates from Featured Apps.
- Abuse Pattern Detection: Identifying circular fund flows (A→B→A), high-frequency micro-transactions, and "empty" transactions that serve no purpose other than marker generation.
- FA Integrity Scoring: Providing a transparent score for every Featured App based on the organic nature of their activity.
- Fast-Track Reporting: Enabling the Canton Foundation to catch and stop million-CC farming operations in minutes, not days.
- Public Ecosystem Health Dashboard: A transparency tool to show aggregate network integrity and FA quality metrics.
2. Implementation Mechanics
Data Ingestion Layer
- Connects to Canton participant nodes via Ledger API to specifically ingest transactions involving Featured App ID templates.
- Maintains a specific index of Activity Marker events across the network.
- Historical baseline computation for "Organic vs. Bot" behavior.
Detection Engine
The core detection engine applies multiple analysis techniques in parallel:
- Circular Flow Detection: Graph analysis to identify closed-loop fund transfers (A→B→C→A) within configurable time windows. Circular flows are a primary indicator of wash trading and Activity Marker farming.
- Velocity Anomaly Detection: Flags accounts or applications exhibiting transaction rates that deviate significantly (>3σ) from their historical baseline or from ecosystem-wide norms.
- Sybil Cluster Analysis: Behavioral clustering to identify groups of parties that exhibit correlated activity patterns — same creation timing, identical transaction cadences, mirrored fund flows — suggesting single-entity control.
- Micro-transaction Farming Detection: Identifies patterns of high-frequency, minimal-value transactions designed to maximize Activity Marker generation with minimal capital commitment.
- Fund Source Tracing: Traces the origin of funds used in suspicious transactions to identify whether farming operations are self-funded through circular capital.
Scoring & Classification
Each Featured App receives a continuously updated Integrity Score based on:
- Ratio of unique counterparties to total transactions (diversity index)
- Average transaction value relative to ecosystem median
- Temporal distribution of activity (natural vs. bot-like patterns)
- Proportion of transactions involving flagged party clusters
- Fund flow directionality (healthy ecosystems show diverse, non-circular flows)
Alert System
- Warning (Score drift): Integrity Score drops below threshold; logged for review.
- Alert (Pattern match): Known farming patterns detected; notification sent to Foundation operations team.
- Critical (High-confidence fraud): Multiple detection signals converge; immediate notification to Foundation via a Fast-Track Reporting interface with full evidence package for rapid mitigation.
Alerts include: affected parties, transaction evidence, detection method, estimated CC impact (how much emission was diverted), and recommended actions.
Dashboard & Reporting
- Foundation Dashboard (private): Full detail view of all monitored applications, alert history, investigation tools, and entity relationship graphs.
- Public Ecosystem Health Dashboard: Aggregate metrics showing network-wide integrity indicators — percentage of validated vs. flagged activity, ecosystem diversity index, and trend lines. No individual project data is exposed publicly.
- Periodic Reports: Automated weekly and monthly integrity reports summarizing ecosystem health, newly detected patterns, and cumulative estimated impact.
3. Architectural Alignment
Canton Sub-transaction Privacy Considerations
Sky Monitor operates within Canton's privacy model. It monitors transaction patterns visible to the monitoring party (as an observer or through public transaction metadata). It does not require or attempt to break sub-transaction privacy. Detection is based on observable behavioral patterns — transaction frequency, timing, counterparty graphs, and volume distributions — rather than private transaction content.
Canton Ledger API Integration
Sky Monitor consumes data through standard Canton APIs (Ledger API, JSON API), ensuring compatibility with current and future protocol versions. No protocol modifications are required.
Complementary to CIP-0082 / CIP-0100
While the Development Fund governs how CC is allocated to development grants, Sky Monitor protects the broader CC emission mechanism that funds validators, applications, and ecosystem growth. Both systems serve the same goal: ensuring Canton's resources flow to genuine contributors.
4. Backward Compatibility
No backward compatibility impact.
Sky Monitor is a non-intrusive read-only layer focused on Activity Marker events. It does not modify any on-chain state or protocols.
Milestones and Deliverables
Milestone 1: FA Event Listener & Core Detection (2 weeks)
- Focus: Real-time ingestion of Activity Marker events and basic fraud pattern detection.
- Deliverables / Value Metrics:
- Functional Ledger API listener for FA templates.
- Core algorithms: Circular Flow Detection and Micro-transaction frequency caps.
- Data pipeline and primary event database.
Milestone 2: Integrity Scoring & Foundation Dashboard (2 weeks)
- Focus: Per-app scoring model and investigator UI.
- Deliverables / Value Metrics:
- FA Integrity Score computation logic (publicly documented methodology).
- Foundation Internal Dashboard: Full investigation tools, party-link graphs, and evidence packaging.
- Alert system (Webhooks/Email) with "Fast-Track" reporting for critical abuse.
Milestone 3: Public Health Dashboard & Production (1 week)
- Focus: Ecosystem transparency and mainnet deployment.
- Deliverables / Value Metrics:
- Public Dashboard: Aggregated health stats and top-performing (organic) applications.
- Weekly/Monthly automated ecosystem integrity reports.
- Mainnet production deployment.
- Open-source release of core detection methodologies.
Acceptance Criteria
The Tech & Ops Committee will evaluate completion based on:
- Deliverables completed as specified for each milestone
- Demonstrated functionality or operational readiness
- Documentation and knowledge transfer provided
- Alignment with stated value metrics
Project-specific acceptance conditions:
- Detection algorithms must demonstrate ≥90% precision on a curated test dataset of known farming patterns (minimizing false positives that could harm legitimate projects)
- The system must process real-time transaction streams with ≤30 second detection latency from transaction commit to alert generation (ensuring "Zero-Day" response capability)
- Critical alerts must include sufficient evidence for the Foundation to take action (e.g., suspending markers or emissions) without additional investigation
- The Integrity Score methodology must be documented and reproducible — the Foundation must be able to independently verify scores
- The public dashboard must not expose any information that could identify individual projects or parties beyond aggregate statistics
Funding
Total Funding Request: 1,200,000 CC
Payment Breakdown by Milestone
- Milestone 1 (FA Listener & Detection): 360,000 CC upon committee acceptance
- Milestone 2 (Scoring & Foundation Dashboard): 480,000 CC upon committee acceptance
- Milestone 3 (Public Dashboard & Production): 360,000 CC upon final release and acceptance
Volatility Stipulation
The project duration is under 6 months (estimated 5 weeks total).
Should the project timeline extend beyond 6 months due to Committee-requested scope changes, any remaining milestones must be renegotiated to account for significant USD/CC price volatility.
Co-Marketing
Upon release, the implementing team will collaborate with the Canton Foundation on:
- Joint announcement of Sky Monitor as Canton's ecosystem integrity infrastructure
- Technical blog post explaining the detection methodology and how Canton's transparency enables effective fraud prevention
- Periodic "State of the Canton Ecosystem" integrity reports co-published with the Foundation
- Developer documentation enabling other ecosystem participants to contribute detection rules and patterns
Motivation
The Canton Network's economic model is sound in design — Activity Markers align incentives between applications that generate real value and the network that rewards them. But incentive systems are only as strong as their enforcement. Without monitoring, the rational strategy for a bad actor is clear: manufacture Activity Markers at minimal cost and extract maximum CC rewards.
This is not a hypothetical risk. Observable patterns on the Canton mainnet already suggest that some applications are aggressively generating Activity Markers through artificial means. Under current monitoring conditions, these operations can persist for days or weeks before detection, allowing malicious actors to siphon off millions of CC in rewards that should belong to legitimate participants.
The economic impact is direct and quantifiable: every fraudulent Activity Marker dilutes the rewards earned by every honest participant. If a significant percentage of Activity Markers are artificial and go undetected for days, the network effectively subsidizes fraud at the expense of its most valuable contributors.
Sky Monitor provides the immune system that Canton's economic body needs:
- For the Canton Foundation: Actionable intelligence to enforce ecosystem integrity, with evidence-grade data supporting governance decisions.
- For honest applications: A level playing field where genuine economic activity is rewarded fairly, not diluted by manufactured noise.
- For validators: Protection of reward economics — validators earn CC based on the network's real economic activity, not inflated metrics.
- For the Canton community: Transparent, verifiable ecosystem health metrics that build confidence in the network's long-term fairness and sustainability.
The cost of not building this is far greater than the cost of building it. Every quarter without monitoring is a quarter where fraudulent actors extract value unchecked, and honest participants bear the cost.
Rationale
Why a dedicated monitoring system rather than manual audits?
Manual audits are retrospective, expensive, and slow. A project farming Activity Markers today is often not caught by "official" channels until days later, by which point millions of CC have already been extracted and potentially moved off-chain. Real-time automated detection catches fraud as it happens, reducing the detection window from days to seconds and dramatically minimizing economic leakage.
Why behavioral pattern analysis rather than on-chain rules?
Hardcoded on-chain rules (e.g., "reject transactions below X value") are easily circumvented by sophisticated actors and risk harming legitimate use cases. Behavioral analysis detects the underlying intent — the pattern of farming — regardless of the specific technique used. As farming strategies evolve, the detection engine evolves with them.
Why a public dashboard?
Transparency is the strongest deterrent. When projects know their Activity Marker quality is publicly visible, the cost-benefit calculation of farming shifts dramatically. A public integrity dashboard creates social and economic pressure against gaming, complementing the Foundation's enforcement capabilities.
Why this team?
The implementing team operates an active Canton validator node on mainnet and has firsthand experience observing on-chain transaction patterns across the Canton ecosystem. The team has direct technical familiarity with Canton's Ledger API, transaction structure, and Activity Marker mechanics — enabling rapid development of accurate detection algorithms grounded in real-world data rather than theoretical models.
Alternatives considered:
- Relying on community reports: Too slow, too subjective, and easily manipulated by bad actors who can also file false reports against competitors.
- On-chain rate limiting: Blunt instrument that restricts legitimate high-frequency use cases and creates a cat-and-mouse game with farming techniques.
- Third-party blockchain analytics: Canton's privacy model and Daml-specific transaction structure make generic blockchain analytics tools ineffective. Purpose-built tooling is required.
Sky Monitor is the minimum viable integrity infrastructure that Canton needs to protect its economic model as the network scales.
