How RiskSignal works

Every wallet you monitor lives in the monitored_wallets table inside Supabase. Each row is tied to a Supabase user and includes:

• wallet_address: the EVM address we watch.
• min_balance_usd: your threshold in USD.
• user_id: the Supabase auth user who owns the wallet.

Row‑Level Security (RLS) is enabled so that users can only read, insert, update, and delete their own wallets. This is enforced by Supabase directly, not by the frontend.

On Vercel, we schedule a cron job (via vercel.json) that hits the /api/check-risk endpoint every hour.

Each run does the following:

1. Authenticates the request using either Vercel Cron headers or your CRON_SECRET.
2. Fetches all rows from monitored_wallets.
3. For each wallet, calls Moralis:
   https://deep-index.moralis.io/api/v2.2/wallets/<address>/net-worth?exclude_spam=true
4. Parses total_networth_usd and compares it to min_balance_usd.
5. Flags any wallet where net worth has fallen below the configured threshold.

The endpoint returns a JSON summary of how many wallets were checked and how many alerts were triggered in that run.

When a wallet breaches its threshold, we currently:

• Log a critical message on the server: "ALERT TRIGGERED".
• Use Resend with your RESEND_API_KEY to send an email (mocked to user@example.com for now).

The email content clearly states which wallet dropped, what its new USD value is, and what threshold you configured, so you can quickly triage the issue.

1. Visitor lands on the marketing homepage and clicks “Sign up”.
2. On the Profile page, they enter first name, last name, email, and password twice.
3. Supabase creates the user, stores names in user_metadata, and emails a confirmation link.
4. After confirming, they log in and are redirected to the dashboard.
5. On the dashboard, they add wallets and thresholds — all stored in Supabase.
6. Vercel Cron + Moralis + Resend take over from there for automated monitoring.